Version 4.2.5 Updates, Handling abuse responses, bounces Options

[Jeff Hendrickson]

I've posted a new version on the web site.

I've added a tag to the SMTP header of abuse complaints sent using Sp@mX.

The tag is listed below:

X-Sp@mX: Abuse Complaint

This will make it easy to add a filter to your email clients to put the abuse responses, and bounces in a client folder, or delete them outright. The Sort and Report Filtering Interface in Sp@mX will also look for this tag when it's filtering items.

Em@ilCRX is also being programmed to look for this tag when it's classifying email for filtering.

[amaloney]

re: Adding a filter to email app
I am uncertain of what to do.

Using Thunderbird, do I
go to Tools->Message Filters->New and
enter «X-Sp@mX: Abuse Complaint»
into Subject->Contains-> X-Sp@mX: Abuse Complaint
then
Perform these actions
Move to (eg Trash)

[Jeff Hendrickson]

That tag will show up in the SMTP header, so it should come back in all responses to your abuse complaints.....

[amaloney]

re: Adding filter to Thunderbird

Forgive me.
I am challenged by the lingo.

That tag will show up in the SMTP header, so it should come back in all responses to your abuse complaints.....

The list given to match under «For incoming messages that…»
does not contain the phrase «SMTP header».

Do I use the «Sender» option?

Thanks
Al

[Jeff Hendrickson]

No problem Al.

You want your filter to look for the phrase ...

X-Sp@mX: Abuse Complaint

... and do with it what makes sense for you....

[msealey]

Al,

Not a Thunderbird user, but hope I can help; once you've found where you set filters (as you have) there should be - for each item - four settings:

1 - the criterion ('contains', 'matches', 'does not match', 'begins with etc) on which to filter/match.

2 - the match (the string or text you need to filter out; in this case it's going to be "X-Sp@mX: Abuse Complaint".

3 - the field against which to try the match; this may be in a drop-down and look something like 'headers' or 'sender' etc This is where the new string will be - an SMTP header.

4 - the action or what to do; this is what Jeff means by '... and do with it what makes sense for you....' I suggest you divert/transfer all the found messages into a folder from which you can retrieve them if needed - and until you're satisfied that your filter's working OK.

Good luck!

[karsten]

OK - using Apple's Mail.app - just what do I pick to scan the header?

I can pick: From, To, CC, or Subject

I can add a new header type to scan for, but what's the tag for where it's located in the full SMTP header?

[msealey]

I'm assuming that the bounce, or response which we want to filter will actually quote X-Sp@mX: Abuse Complaint in the body of the message they send back - along with all the other SMTP headers we sent in our report in our original messages.

Jeff will correct me if I'm wrong - but I'm thinking, Body.

[karsten]

I tried the body first, no luck...

[RobLewis]

I've gotten a few replies back using 4.2.5, and using Apple Mail's View:Message:Long Headers option, I don't see anything resembling your new tag.

[Jeff Hendrickson]

What's supposed to happen is the message should come back with the original SMTP header in tact. So, you can search the SMTP header for the tag.

I've also received a few notifications back where the original SMTP header was not in tact, and only the Received: lines were maintained.

To handle these, you can also add your own tag using Sp@mX's ability to change the subject of your abuse complaint. e.g. abuse complaint <mytag>, and then search for both the Sp@mX tag in the SMTP header, and <mytag> in the subject.

[Steve]

OK - using Apple's Mail.app - just what do I pick to scan the header?

I can pick:  From, To, CC, or Subject

I can add a new header type to scan for, but what's the tag for where it's located in the full SMTP header?

In the list of options in creating a new rule, one of the filters in Apple Mail is "Message Content." Use this one. Select "Contains" in the next pull down menu, and use the value "X-Sp@mX: Abuse Complaint" (Without the quotes).

In the action, Move it to trash or any other folder. I created a folder called "bounce-response" so that I could move these items there first as I like to look at them.

[HMK]

I did a 'report' yesterday but cannot find it among the web stuff - trying again this way.

After downloading the 4.2.5 updater only yesterday, I was still asked for configs, so added them.

When attempting to report yesterday's (single) spam, I go the message 'error, opening (file name)'. I tried on this morning's spam and got the same message. Nothing has changed except the URLs to be reported - I used the suggested 3.

OS10.4.2, Apple Mail - not at home machine to see anything else right now.

I'd like the ability to keep track of the spams reported from version to version - default is zero. The easiest way is to write them on a sticky, I suppose - any easy way for you to log within the application?

Harry

[karsten]

Steve -

That was the first setup I tried. So far it has caught a total of 0 messages out of hundreds...

I've looked through a number of the headers on these and can't find the 'X-Sp@mX: Abuse Complaint' in any of 'em...

[Jeff Hendrickson]

Interesting Karsten. I'm looking for the tag in the SMTP header, and another in the subject, and between the two, I'm hitting every one...

Some responders return the header unmolested, some the subject, some both....

[Steve]

Steve -

That was the first setup I tried.  So far it has caught a total of 0 messages out of hundreds...

I've looked through a number of the headers on these and can't find the 'X-Sp@mX: Abuse Complaint' in any of 'em...

It is working fine here, but only on those replies that copy the original report that was sent by my computer and using the current version of Sp@mX. It is sorting out about 50 % of the automated replys as a lot of them come from automated servers that don't include your e-mail reporting the abuse. Here is an example of one that worked and sorted to my response file without problems:

Thank you,
Postmaster, CNET Networks Inc.

http://www.cnetnetworks.com


From steve@xxxxxx.com Mon Sep 05 06:36:57 2005
X-IronPort-RCPT-TO: abuse@cnet.com
Received: from G4-Laptop.local (cpe-66-75-199-183.bak.res.rr.com [66.75.199183])
by ms-smtp-01-eri0.socal.rr.com (8.12.10/8.12.7) with ESMTP id j85DaqFf001694;
Mon, 5 Sep 2005 06:36:52 -0700 (PDT)
Received: from [192.168.1.103] (localhost [127.0.0.1])
by G4-Laptop.local (Postfix) with SMTP id 78BAE62746A;
Mon,  5 Sep 2005 06:36:51 -0700 (PDT)
Date: Mon, 5 Sep 2005 06:36:51 -0700
Subject: Report of Abuse - Unsolicited Bulk Email
From: steve@xxxxx.com
To: hostmaster@ussignalcom.com
Cc: abuse@cnet.com, bjones@ussignalcom.com, SPAM@UCE.GOV, UCE@FTC.GOV,
        ENFORCEMENT@SEC.GOV, FRAUD@USPIS.GOV, ISFEEDBACK@NASD.COM,
        SPAM@NASD.COM, WEBCOMPLAINTS@ORA.FDA.GOV, CASPAM@DOJ.CA.GOV
X-Sp@mX: Abuse Complaint
Content-type: text/plain;
Content-transfer-encoding: 7bit
Message-Id: <20050905133651.78BAE62746A@G4-Laptop.local>
X-Virus-Scanned: Symantec AntiVirus Scan Engine

The hilighted text above triggered the filter that I have set to move this message to my bounce folder when the message content contains X-Sp@mX: Abuse Complaint. Your filter is likely not configured right, but remember, this will only catch some of the bounces and responses.

[Steve]

Here is my exact Apple Mail 2.0 filter configuration. This catches about 90%.

If ANY of the following conditions are met:

Message Content Contains X-Sp@mX: Abuse Complaint
Subject Contains Returned Mail
Subject Contains Report of Abuse

Move Message to Mailbox Bounce-Response

You have to create a mailbox with the name that you want first and substitute it above, or just move everything to trash.