Re: Does it work?

Gareth wrote:
> Hi
> 
> I am new to spamcop. I recently opened an email account with my ISP 
> which has obviously been used before and receives around 10 spams per day.

Reporting spam  emails via SpamCop contributes to the SBL (SpamCop 
Blocklist), and potentially allows abuse desks at the sites hosting the 
spammer to be notified of the illicit activity. If the spammer's ISP 
cares, then yes, it can have an effect since the ISP can take measures.

If not, then it probably won't stop the spam source, at least not 
immediately. However by contributing to the spamcop block list, you and 
others can make use of that blocklist to either tag and divert incoming 
mail to a spam folder, or possibly block the source directly during the 
SMTP transaction if your ISP allows that for your account.

> I have been reporting all the spam for nearly a month now but have not 
> noticed any change in the volume of spam I receive.

The spam problem is huge on the Internet. The spam filter program I use 
currently has over 60,000 domains listed in the filters internal lists, 
and about 20,000 IP/CIDR ranges. Reporting spam via spamcop won't stop 
spam. However it can be used as one of several weapons in an arsenal 
used to fight spam.

> Is this normal? Should I persevere or are these spammers just too good 
> at avoiding being being blocked?

Yes, it's normal (using normal in this sense as "the current state of 
affairs on the Internet"). Not to be confused with "desired".

Yes, I think you should persevere. Spammers are not really very good at 
avoiding being blocked, but that depends on how you define "being 
blocked". The way I use the definition is: If the spam is kept out of 
your inbox and ends up in a junk or spam folder, or is accurately tagged 
as spam, then it was successfully "blocked".

What you infer is that like most of us, you don't want to even have to 
look through a spam folder for potential false positives show up in your 
spam folder, or see false negatives show up in your inbox.

That's the hard part of filtering and is what spammers count on because 
when you open a piece of their spam email even to examine it as a 
specimen to improve your filtering methods, it allows their message into 
your consciousness. In that respect being a spam fighter is similar to 
being a plumber.

Sometimes you hire a plumber to do the dirty work. Sometimes you don't, 
and just do it yourself. When you make use of spamcop by choosing to 
open and examine spam specimens before reporting them, it's similar to 
you joining the ranks of plumbers on the Internet. Spamcop in that sense 
is like the plumbers helper, as are various spam filters.

As for "blocking mail":

I can block 100% of email. I will get no spam. I'll also get no email at 
all. :)

Or I can implement a system to sort email into good email and bad email 
(spam) categories using various mechanisms. This is what spam filters 
attempt do, some are better at it than others, but none are perfect, 
though they can get above 99.9% accuracy which is very good even for 
manufacturing standards.

Or I can implement a system to use DNS based blocklists such as the SBL 
to block IP's during the SMTP transaction level. The best DNS blocklists 
are about 50-70% accurate, and are prone to false positives. They are 
better used in a tag and divert mode rather than as a direct block of email.

Or I can implement a combination white listing, DNS blocks, and 
filtering, or DNS tag and divert, and filtering, etc.

There are many to deal with the issue as a receiver.

Personally, I run my own mail server, because this gives me maximum 
control over the server configuration.

On that server I use the following:
  Geographical blocks. (email from source countries such as China is 
blocked except for email sent to role accounts.)

  Spamcop blocks. (If an IP is on the SBL and not addressed to a role 
account, it is blocked. Email sent to role accounts are allowed to 
bypass this, or can be bypassed on a per account name basis.)

  Bayesian scoring, using a bayesian filter to give an opinion on the 
spamicity of the email, and set certain other variables based on that score.

  Custom whitelisting, using a combination of procmail recipes and email 
aliases that map to my accounts given to websites where I want their 
information that allows such email bypass further filtering

  Finally I use a spam filter to filter mail that fails the other tests, 
and have that filter configured to auto submit to spamcop.

ISP's don't generally have such fancy filtering systems in place.

In the end, it's up to you how to deal with the spam issue by making use 
of available tools or coming up with some home brew solution.

This sort of system can be made to work with an unfiltered ISP email 
account if you set up the filter such that it downloads the mail then 
filters it locally according to whatever system you choose to setup.

--
Garen