SpamCop

SpamCop is a free spam reporting service, allowing recipients of unsolicited bulk email (UBE) and unsolicited commercial email (UCE) to report offenses to the senders' Internet Service Providers (ISPs), and sometimes their web hosts. SpamCop uses these reports to compile a DNSBL of computers sending spam called the "SpamCop Blocking List", (SCBL) and websites referenced in the spam are used to create the Spam URI Realtime Blocklists (SURBL) RHSBL.

SpamCop has tools for ISPs to manage the reports sent to them, to see details on individual spam messages, and to mark incidents as resolved. Paying members can configure how reports are sent and avoid a "nag" screen. There are also forums for discussing the services. Also available are paid email and mail management services which include spam filtering.

Overview

Like other DNSBLs, SpamCop's SCBL is controversial. Criticism comes primarily from those whose IP addresses have been listed by the SCBL, causing their mail to be rejected by servers that use the SCBL. Third parties that don't send spam are affected when an IP address they use becomes listed on the SCBL due to reports that accuse their IP address of being a spam/UBE source. This can happen because their IP address is shared with many other customers of their ISP. It may also be the result of malicious, careless or over-zealous reporting of spam.

Additionally, SpamCop automatically lists IP addresses that send mail to spamtrap email addresses. Since these addresses may be falsely used as return addresses on spam messages, backscatter caused by these messages (including vacation messages and other auto-replies) can result in an otherwise innocent server being blocklisted if it fails to employ backscatter prevention techniques. One of the unique features of the SCBL, however, is that a listing expires automatically when no spam is reported from that source for 24 hours.

SpamCop notes that "The SCBL is aggressive and often errs on the side of blocking mail. By using the SCBL, you can block a lot of spam, but you also may block or filter wanted email" and suggests using the SCBL as part of a scoring system. Unfortunately many ISPs and IT consultants use the SCBL as a simple blocking mechanism, often without making it clear to their clients that valid incoming messages may be rejected.

Although SpamCop recommends that the SCBL be used as a filter, rather than a block, its website contains detailed instructions only on how to set it up as a total block "for administrators who cannot use a more subtle approach for whatever reason." There is no help or support for those wanting to use it as a filter.

SpamCop provides procedures for ISPs to request de-listing; see [http://www.spamcop.net/fom-serve/cache/298.html SCBL dispute resolution] . Users of listed IPs can use other IP Addresses or smart hosts if their outgoing mail servers are blocked. SpamCop's on-line forums and FAQ pages, as well as news.admin.net-abuse.blocklisting, are sources of advice to users who find themselves blocked. On the forums, other users will give advice, although some can be impatient with those who are not familiar with the system and terminology involved and have not read the multiple, overlapping FAQs.

SpamCop also has a fee-based email system which provides email accounts that are optionally filtered by the SCBL, as well as other blocklists.

Limitations

For first-time SpamCop Reporters, the SpamCop Parsing and Reporting Service requires the reporter manually verify that each submission is spam and that the destinations of the spam reports are correct. People who use tools to automatically report spam, who report email that is not spam, or report to the wrong people may be fined or banned. This verification requires extra time and effort. Despite these steps, reports to innocent bystanders do happen and ISPs may need to configure SpamCop to not send further reports if they don't want to see them again. SpamCop Reporters with a proven track record are allowed to file Quick Reports, reducing both time and effort.

It is not clear whether reporting one's spam using SpamCop's reporting service actually reduces the amount of spam that one receives, and complaints on SpamCop's online forum provide anecdotal evidence to support some skepticism about its effectiveness. While some spammers may use SpamCop's reports for listwashing, others could retaliate. Spammers who determine the identity of the complaintants can, by doing so, also verify that the email addresses are still in use. What is clear is that much spam email is filtered or blocked by the SCBL, which is fed by many SpamCop Reporters reporting their spam.

That said, SpamCop is effective at helping ISPs, web hosts and email providers identify accounts that are being abused and shut them down before the spammer finishes operations. Finally, SpamCop provides information from its reports to third parties who are also working to fight spam, amplifying the impact of its services beyond its own reach.

It is also remarkable in its own right that SpamCop has survived for so many years, considering the severity of opposition other anti-spam companies have faced in the past, most notably osirusoft and Blue Security. SpamCop has dealt with attacks by spammers thus far by hiring services from Akamai, but is still the target of many hackers and could face serious difficulties like those faced by Blue Security if it continues to grow in size and effectiveness. The successful attack on Blue Security shows that significant offensive weapons can be wielded by the criminal syndicates behind spammers. SpamCop views itself as an attempt to stop spam without the necessity of governmental intervention, but because it lacks the power of a government or large ISP, it may have greater difficulty dealing with spammers' expertise as well as the large "bot" networks that they control and that they used to cripple Blue Security with a massive DDoS attack.

Fake similar organizations

Several websites exist purporting to provide similar services to SpamCop.net. For example, abusecentral.org appears to be run by phishers who redirect webtraffic to abusecentral.org when people try to enter the phishing website in ways that phisher doesn't want. This will give investigators the incorrect impression that the phishing site has been taken down. Another such organization is SpamCop.com. According to posts on SpamCop.net's forum, SpamCop.com is a newer service owned by a company named Interspectrum, which uses the service to market its anti-spam products. The use of the same name for the same type of service may constitute trademark infringement, and may be confusing to new users who expect the more established of the two services to be hosted on the .com top-level domain.

History

SpamCop was founded by Julian Haight in 1998 as an individual effort. As the reporting service became more popular, staff was added and the SCBL became more useful. It has commonly been the target of DDoS attacks and lawsuits from organizations listed in the SCBL.

Email security company IronPort Systems announced its acquisition of SpamCop on November 24, 2003, [ [http://www.ironport.com/pdf/ironport_2003-11-24.pdf PRESS RELEASE IRONPORT SYSTEMS Acquires SpamCop] 24 November 2003, accessed 11 August 2007] but it remains independently run by Julian Haight, two staff membersFact|date=August 2007 and volunteer help in its forum.

IronPort agreed to become a division of Cisco Systems on January 4, 2007 [ [http://newsroom.cisco.com/dlls/2007/corp_010407.html Cisco Announces Agreement to Acquire IronPort] 4 January 2007, accessed 9 October 2008] effectively making SpamCop a Cisco service.

See also

* Comparison of DNS blacklists
*Spam (electronic)
*Spam
*E-mail spam
*Blue Frog
*Spamhaus
*List poisoning
*Network Abuse Clearinghouse

References

External links

* [http://spamcop.net SpamCop Official site] (Note: There are copycat sites at similar URLs with other TLDs.)
* [http://forum.spamcop.net/scwik/ SpamCop Wiki]
* [http://forum.spamcop.net/forums/index.php SpamCop Forums] and [news://news.spamcop.net/spamcop newsgroups]
* [http://www.spamcop.net/fom-serve/cache/298.html SCBL dispute resolution] from the [http://www.spamcop.net/fom-serve/cache/1.html FAQ]
* [http://wiki.fastmail.fm/index.php/SpamCop A critique of spamcop] .
*The [http://www.surbl.org SURBL] is an RBL based on SpamCop data to block or tag spam based on URIs contained within the message body.