Re: UMSY

Mike, thank you for your reply.

Why bother with mole reporting if it does not contribute to the SCbl? 
Hmm....

As to why I did not post the full tracker: The tracker contains information 
that identifies me, my antispam measures and and my mail server. Much too 
much information to put on a public newsgroup monitored by spammers.

As to why I went "mole". Same thing. What prompted me to go "mole" a couple 
of years ago was regular upsurges of spam after I reported some spam. 
Watching the detailed spam parses these days for the stuff I drop into the 
"Report" form, much too often I see that the report would not be anywhere 
near sanitized well enough, or would be going to someone who has a 
connection with the spammer. For example, I don't for a second believe that 
spamcop reports to chinanet are just ignored. There is just too much good 
stuff to mine from them.

My posting to mail was because as a spamcop mail customer I think the 
problem with this particular spammer getting through so easily is a 
SpamAssassin rule problem, rather than a reporting problem. Every single 
address that particular spammer has been using that I bothered to track down 
looked like a zombie. A different one every time, of course.

C_O

"Mike Easter" <[email protected]> wrote in message 
news:[email protected]...
> CO-DBA-SC-EL wrote:
>> Why can't SpamCop email filter these annoying UMSY spams? See for
>> example report ID 1677920143.
>
> When you call up your own reportid, you can access everything about it
> via its tracker.  When anyone else calls up your reportid, they can only
> see the subject Promo Movers: Weekly Member Newsletter
>
> Then, in order to know whatever it is you are trying to talk about, I
> have to go to sightings to find a spam and determine that it is a
> stockspam, and then I have to further derive that UMSY is a stock
> abbreviation by determining that US MedSys Corp is a known stockspam
> 'marketer'.
>
> So, then further, I have to search a little harder in sightings to find
> an actual UMSY stock promo in a promo movers newsletter.
> http://snipurl.com/n5gu
>
> Then, since you didn't provide a tracker to an example of the spam, I
> guess I'll make one myself
>
> http://www.spamcop.net/sc?id=z889921579z6324ae41d86ed5577815eb2cb0b372ffz
>
> That particular item was sourced from a CBL listed proxy
> 222.40.149.15 -- and it is entirely possible that yours was too.
>
>> I am bombarded with those, obviously sent through botnets. This has
>> been going on for over one week. The spammer has obviously found the
>> right formula to get around spamcop and spamAssassin. They don't even
>> bother to try to obfuscate "UMSY".
>
> From your reportid, it appears that you are not spamcop reporting your
> spam, but instead you are mole reporting, which means that your spam
> isn't contributing to the SCbl.
>
> If you want to discuss why a particular spam wasn't blocked, you should
> be looking at its headers and you should be thinking about what
> blocklists you have enabled, and you should be thinking about how you
> have your SpamAssassin SA score set, because the item which I provided a
> tracker for was caught be a SA type filter, and that item would have
> also been caught by my filter on the basis of its CBL listing.
>
> So, if your choice of configuration for spamcop's filter isn't doing the
> job, maybe you should consider fixing your configuration.
>
> So, my gripes about this communication so far are:
>
> - if you are going to talk about a spam which wasn't filtered, you
> should post a tracker for it, not a reportid
> - if you are going to talk about /anything/ don't abbreviate more than
> what someone who isn't looking at the same thing you are looking at will
> be able to figure out.  This isn't a guessing game, altho' sometimes we
> play it
> - if you are 'just' a mole reporter, your reports don't really count,
> so you aren't helping the SCbl and therefore your reports aren't helping
> other people filter their spam
>
> -- 
> Mike Easter
> kibitzer, not SC admin
>