Help | Site Map
| Text size: - +

Spam Cop News Jan 17, 2005

2-day-old spam no longer accepted
SpamCop and the ISPs who receive reports from it need fresh spam. Previously, SpamCop would accept spam up to 72 hours old. However, this old spam was essentially useless. SpamCop now requires that spam being reported be less than 48 hours old.

Furthermore, we recommend that users not bother reporting spam that is more than 24 hours old. Usually, sources of spam over 24 hours old have already been dealt with one way or another. As always, the fresher your spam, the better. Oct 21, 2004

New look and feel
Welcome to the new look of SpamCop. Modern web standards have been used to create a clean look and feel as well as a fast, scaleable, compatible web interface. The latest versions of opera, mozilla (firefox) and Microsoft IE should work perfectly with the new design. Older browsers may cause some cosmetic problems, but the site should still work OK. Please report any problems in the forum as always. Sep 22, 2004

Mirrors still needed
We are still looking for a few good mirrors - we're asking for root access to a *nix based system hosted on your network, using about 1Mbit of bandwidth. These systems will be used to provide free, public access to the SpamCop block list. If you would like to help, Contact Us

IronPort Settles Litigation with
Press release (255K pdf). Due to the terms of the settlement, SpamCop cannot comment on the settlement beyond what is included in the press release.

New security system
Free users will be encouraged to establish a password with SpamCop to better secure their accounts and provide for more advanced features and preferences. After some time, the existing (old) URL authentication scheme will be disabled and all users will be forced to establish a password. Free users and paying users will use the same authentication methods henceforth; therefor the distinction between the two classes of users will be less important, and references to these two user types will be removed from the website. Unpaid accounts will still be subject to nag screens and ads on the website. Cookie-based or HTTP authentication methods will still be supported for all users. July 9, 2004

New Look (updated)
You probably couldn't help noticing our new look. We hope it is easier to use and more readable. We will be refining it as always. It should be entirely compatible with HTML 4.0. If anyone sees problems in any browser, please report them in the forum as usual. Only the latest versions of IE, Mozilla and Opera were tested for perfect looks, but the site should function with any browser. Update: A "Site Style" pull-down and various alternate styles have been added. Included is the "clean" style which approximates the previous site design. 2nd Update: Various fixes for older browsers have been added (special page for netscape 4.x aka IE5.x). May 20, 2004

One Billion spam reports
On Friday, report number one billion was sent to Bucking the odds, this report was sent by a live user (rather than a spamtrap). The user involved has been awarded 1 year of free SpamCop email - congratulations. Happy one billionth report, SpamCop! May 5, 2004

Mailhost Beta - update
We have been testing the mailhosts system for several weeks now, and it is looking more and more reliable. Users are encouraged to adopt it as soon as they feel comfortable doing so. To get started, just click on the "mailhosts" menu item. You will still have a chance to back out if you encounter problems. Using this system helps prevent spammer forgeries from fooling SpamCop into blaming the wrong site. Some improvements will still be forthcoming, but for most users, the system is ready. Apr 26, 2004

System Downtime
Our new linux fileserver has been crashing randomly - we think due to an immature SCSI driver. This has caused a couple of system outages over the past week. Thankfully, these outages have been short due to the late night diligence of the IronPort IT staff - thanks Mike and Tom! Today we plan to upgrade the kernel (to 2.6.6-rc2) in the hopes of preventing this in the future. But doing so will require another short period of downtime sometime today. The site should be down for only a few minutes (5-10 if all goes well). Please be patient if the site is unavailable. Apr 19, 2004

Mailhosts Glitch
For approximately the past day (Thursday, Friday), mailhosts test emails have been ignored due to a problem with the processing code. A new version is now online which should work better. This new version also provides instant gratification in the form of a web-submission system. Sorry for the inconvenience, please try again.

Stats back!
SpamCop has long been lacking a list of the top targets of spam reports. This report has finally returned to the statistics menu. Two of the largest us-based, broadband ISPs are leading the pack: Comcast and Road Runner. View the hall of shame Apr 15, 2004

System slow - 2nd update
A relatively trivial problem has been linked to the morning slowness. We feel confident that the problem is now solved. Feb 28, 2004

SpamCop seeks block list mirror volunteers (particularly non-US)
SpamCop provides free access to its block list via DNS. The servers and bandwidth hosting this free resource are donated. We are in need of capacity increases to keep up with the growing demand. If we choose you to host a mirror, you will receive free high speed access to the updated list ( valued at $1,000/yr). All inquiries welcome and we are particularly interested in adding mirrors outside the US. You must have at least 1Mbit/sec of bandwidth (sustained) to offer as well as a linux or freebsd server (average PIII is sufficient) hosted on your network. Reliable networks and power configurations are preferred. If you are interested, please email with a brief description of your network and the server. You must provide us with root access to the server - we will configure and maintain it and the software needed to provide the SpamCop block list service. Cable modem or xDSL connections are not sufficient. Dec 16, 2003

Yesterday afternoon and this morning (Dec 11), one of SpamCop's servers started spawning processes out of control. Before I could log in and fix it, this caused some serious problems (errors and general slowness). Also today, we moved the main SpamCop database from Seattle to San Bruno, CA (IronPort's headquarters). This caused some additional downtime, but was generally very successful, with only a little more than the anticipated amount of downtime.

Now, we have resolved the problems and finished the hardest part of the migration, so things should be back to normal. Please report any problems you find in the forum, as usual. Dec 11, 2003

Downtime, unscheduled and scheduled
Yesterday afternoon and this morning (Dec 11), one of SpamCop's servers did something unexpected and bad. I'm still trying to figure out why, but the system load was as high as 100 when I finally got into it this morning. The problems should be easing now, but there is probably a big backlog as a result of the problems, so things might remain a bit slow. I will keep an eye on it today.

Also, today we plan to move our operations to IronPort's headquarters in San Bruno, CA - from Seattle. We are attempting to do this in a "nice" way, so there will be limited downtime. Perhaps 10 minutes or so. During the downtime, there will (or at least should be) a placeholder site with news. Please bear with us during this transfer, we are here working on this until the problems are resolved. Dec 11, 2003

Problems with "human friendly name" feature
I've been making some improvements to the integration between SpamCop's reporting system and the email system. In so doing, I introduced a "feature" which users have been rather unhappy with - using the full-name preference from the email system for sending spam reports. As I have learned the hard way, users often want to use an alias or a different name for spam reports. I removed the "feature" and wiped out email user's display names (sorry, I couldn't restore them to the originals). This "feature" is now history, and it should be safe for users to set a permanent display name without worry that it will be over-written. This issue only affects flat-rate email users.

Appologies for the error and inconvenience!

Cookies are delicious
I have implemented a cookie-authentication method. This means you no longer have to use "http-auth" for logging in (you may still use it if you prefer). Update your bookmarks to (click on "log in")

Use which ever method you prefer. As with any new feature, there may be some bugs in the cookie login method, please report them in the forum if you find any. Once the bugs are worked out, we may make cookies the only method for authentication. Any major objections to that should be voiced now. Nov 26, 2003

SpamCop Purchased (a message from the founder, Julian Haight)

After careful consideration and negotiation, earlier this year, I decided to sell SpamCop to IronPort Systems, producers of fast mail servers and the spam-tracking system, Senderbase. I am pleased with the terms of the deal, in no small part because I feel the people at IronPort are going to support my goals, helping me protect and nurture SpamCop. We all agree that SpamCop is valuable and needs proper care and feeding. I plan to continue as the driving force behind the "product direction." IronPort is freeing me from other tasks so that I can focus on what's important. Users should not expect any radical changes - that's worth saying twice - nothing will be changing as a result of this move!

I have discussed selling SpamCop with various people at various times, but other offers have always fallen short. Ironically, I found IronPort's offer interesting first because it made sense from their point of view: I could understand easily what was in it for them, and their interest in SpamCop did not conflict with my own. They are basing their product's spam-filtering feature, in part, on the data provided by SpamCop. It's clear that they have a vested interest in the quality of that data.

Those who are familliar with SpamCop know that I never have enough time to do all the things I'd like to do. I have been a one man show for far too long, and SpamCop has often suffered as a result. I don't think I'll ever have enough time. But the support I have already received from IronPort is helping immeasurably. For example, one of the first things I did was to hire Ellen. For those who don't know, I have always relied upon unpaid volunteers to help with the hundreds of emails we get every day. Don was my first paid employee, and Ellen is now the second. IronPort employees have also contributed, helping me with such things as system administration, accounting, and legal issues. In addition, IronPort has accepted the considerable cost of professional denial-of-service protection, both for SpamCop's site and their own systems.

Although the purchase is officially being announced today, November 21, it was inked in June. It was not announced sooner for a variety of reasons, chief among them fortification of our electronic defenses.

I want to take the opportunity to thank everyone who has supported me in the past, financially, with your time and with servers, bandwidth, free advice, etc. I welcome IronPort as the newest and most significant benefactor of our efforts to STOP SPAM!

I will be making myself available in the main spamcop news group ( NNTP | Email | Archive | WebTV ) to talk about this decision and to address any questions or concerns. Please do not flame those who post criticism. Allow me to address my critics in a civil and respectful environment. Oct 30, 2003

Severe DNS problems
Update: Joker has fixed the problems, but it may take 48 hours or so to actually show up for everyone. Happy Halloween!
Spamcop's domain registrar has caused a serious problem by removing our primary DNS records. Please look here and here for more information and status updates. Sep 15, 2003

Update: SpamCop changes cause conflict with some email software
I have made some changes to the method SpamCop uses when finding links in email bodies. This new method is generally more accurate, but it also requires accuracy from your email software. Unfortunately, two of the most popular email applications (Eudora and Outlook) are practically (or totally) incapable of producing accurate copies of some email.

Now, there is an experimental alternative for users of non-compliant email software. Note the "outlook/eudora workaround" link near the spam submission form. By selecting this link, SpamCop will accept mail in broken html format in two parts instead of all in one. There is also a bug reporting form available to help iron out problems with the way this works.

However, users are still urged to find a better email application for use with SpamCop. Mozilla is a full-featured email system which works on Windows, Mac and *nix. It provides complete spam source for SpamCop, via cut and paste or email. It can be installed side-by-side with your existing email software (be sure to use 'leave on server' if POPing mail). Aug 14, 2003

Attention AdSubtract users: Network Error problems
Please see the new FAQ for updated information on problems between SpamCop and AdSubtract's software. July 25, 2003

SpamCop under denial of service attack
Just more evidence that SpamCop is a thorn in the spammer's side. We are currently handling the load, but please bear with us if things change. July 16, 2003

Service update: Crackers bringing us down
At midnight pacific time, the ongoing Denial of Service attack picked up a lot of steam, swamping the routers upstream of SpamCop with about 500Mbits of traffic. We are doing what we can, but defending against this sort of thing is not always possible. June 21, 2003

Service update Jun 20
Later today, I will be taking down the site briefly to upgrade the RAM in the database server (and move it's existing memory to the new webserver). This will upgrade the database server from 1GB to 6 and the webserver from 1GB to 2.

Probably unrelated to the ongoing denial of service attack, SpamCop's core webserver has become rather unreliable. Another faster server has been brought online to take it's place. Service should be back to normal.

Much longer than expected database maintenence
What started as some minor maintenance on SpamCop's database gradually deteriorated into a major database overhaul resulting in a 24-hour outage. With a new version of the MySQL software, and new, faster hardware, this downtime should be worth it. A trivial benchmark test runs for 3 minutes, 16 seconds on the old system, and takes just 1 minute, 8 seconds on the new. Email sent during the downtime will be processed ASAP. June 10, 2003

Cyveillance helps SpamCop reports copyright infringement
You may have noticed that copies of all spam reports are now being sent to "Cyveillance spam collection". Although I believe Cyveillance will benefit the cause of stopping spam, some users have voiced mistrust. In response, I have created a new option for paying members, so that 3rd party reports, such as the cyveillance ones, can be disabled by default (all users still have the option to select or deselect any reports on a case-by-case basis). June 4, 2003

Email address spamvertisement reporting discontinued
Due to several factors, most importantly the high false-positive rate, SpamCop will no longer offer to report email addresses found in the body of spam messages. Users are still welcome to report these issues manually - SpamCop will still give the correct abuse reporting address if given an email address seperate from a spam message. But reports (and blame for false reports) must now rest solely on the user. Do not report email addresses unless you are sure they are 1) owned by the spammer and 2) working.

Help defend against spammer lawsuits
SpamCon (with an "N") is collecting money to help defend fellow anti-spam organization Spamhaus from attack by a florida-based lawyer representing un-named "bulk emailers". May 21, 2003

Service Announcement
Over the weekend, the newsgroups were offline for a few hours when the server housing them locked up (see email news above for more details). Today, the usual monday-morning crush is affecting replies to spam submitted by email. Rest assured the backlog will be processed and replies will be sent. Please do not resubmit spam; this will only make the problem worse. Hopefully, more hardware will be online by next week to resolve this problem more permanently. May 12, 2003

Service update: Slowness
SpamCop grows ever more popular. No matter how many users I can support, I always seem to have more traffic than my servers can comfortably handle. SpamCop is now handling about 5000 spam submissions per minute (Correction - about 15,000 per hour), both from users and spam-traps. In addition to the existing database server, three "farm" web/email servers and one multi-use server, I will be adding two new farm servers and a new, faster database server. I will also be upgrading the database software. Some of these changes may result in short periods of downtime or 'hiccups'. Please bear with me as I make these upgrades, and thank you for the financial support which makes them possible! Mar 20, 2003

Help with Friendfinders lawsuit
Mark Ferguson is currently involved in a no-holds-barred lawsuit with alleged-spammer Friendfinders, Inc. If you have received spam from friendfinders, please visit his site to see what you can do to help. This case has the potential to change the interpretation of California's anti-spam law. Feb 27, 2003

SpamCop reporting changes
SpamCop's header-parsing system is being re-built to avoid some new spammer forgeries and provide more accurate source tracking. However, as things change, there have also been some problems. Please be careful reporting spam during this time. Be sure SpamCop does not identify your own mail server as the source before you file reports.

SpamCop will not trust mail relays (authorized or open) which have not previously been submitted to relay/proxy testers through SpamCop. Only users who forward mail from one account to another even have a chance of falling afoul of this new requirement. More information.. Feb 10, 2003

Service announcement: Sunday, Feb 9 9pm EST
SpamCop's colocation facility is moving to a different space in the same building, so servers will be down briefly while they are moved. Downtime should be very brief (15 minutes or so). Only reporting service will be affected. Email accounts will remain online. Jan 26, 2003

SpamCop email service in transit
SpamCop's email system was having trouble because of a new internet worm which is eating bandwidth. We figured this was as good a time as any to move the system to it's new, more worm-resistant quarters. Reporting held mail has been disabled until the move is complete. Service should be restored soon (Sunday morning at the latest). Jan 10, 2003

Service Update
SpamCop will experience a hopefully-short outage in the afternoon on Friday, Jan 10 in order to upgrade the database server software. Dec 17, 2002

Old Authorization codes disabled
Some older authorization codes have been disabled in favor of more secure codes which do not include your email address. Affected users will be required to register for a new code. Thanks for your patience and understanding.

Database caused trouble again
Updated 12/11: New database server has been performing perfectly. The fault with the old hardware has, in the end, been isolated to a bad RAM chip. I still don't like Tyan motherboards.
Wed, Dec 04 was another dark day for SpamCop's main database system. The recovery process included both another round of new hardware and a lengthy database backup/restore process. User's email was never affected, however spam reporting was down for the entire day. The Tyan Thunder dual-Athelon mainboard which was running the database server has been replaced with an Intel dual-Xeon server board with two 2.4Ghz, 512K Xeon processors. This board features Intel's latest Hyperthreading technology. Hopefully the new Intel board will prove to be reliable. It should at least be faster (not that speed has been a problem lately). Appologies for the inconvenience. Nov 23, 2002

Service update: SpamCop under attack
Starting around 9pm EST Nov 15th, SpamCop came under a denial of service attack. This lasted on-and-off until 11am the next day. Service has returned to normal, but of course the attack may resume at any time (now or in the future). These attacks only serve to reassure us that our efforts are effective at stopping spammers. Keep sending your spam, and we will do our best to keep SpamCop online!

An extra thank-you to all the people at my ISP, Accretive Technology Group for their efforts at this critical time. Nov 16, 2002

Firewall problems documented:
Some users have noticed network errors submitting spam to SpamCop. A new FAQ documents the problem and suggests two solutions. Oct 27, 2002

Database problems
As some of you have noticed, SpamCop's database has again been acting up. After pulling a late night Saturday when an initial crash struck, I have been discovering latant problems caused by this crash and fixing them as they crop up. Most of these problems were not actually caused by the crash, but by my own bleary-eyed attempts to fix things post-crash.

One of the worst side-effects of the recovery process is that some user's data has been lost and/or scrambled with other user's records. This damage has now been fixed by restoring all prefs from a backup made after the crash. The only remaining problem (that I'm aware of currently) is that users who have reported spam over the past 3 days may not see the reported spam in their logs. Other users may see phantom spam in their logs which they were not responsible for reporting.

None of these problems in any way affect user's email or preferences related to the email system. Flat-rate email users and free users who activated spam reporting during this time will need to re-activate their reporting accounts.

Appologies for the problems and downtime. I wish I could promise this would be the last database issue, but I am still hunting bugs and hopeing for a better release of mysql (I am using a beta version). Aug 26, 2002

SpamCop hosted by Accretive
SpamCop has been moved to a new colocation facility, Accretive Technology Group. The old facility, New York Internet has (almost) always served me well, and I want to make clear that I'm moving only so that I can have physical access to my servers (since I live in Seattle, not New York). My recent problems with a new database server have made it clear that I need to have quick access to the hardware. NYI has always provided great service - the speedup in SpamCop's operation is due to coincidal changes in software and hardware, not internet connectivity. I will continue to run NYI banners until the transition is finalized. My new contract with Accretive includes no banner-hosting provisions, so the banner space on SpamCop is for rent. Please see the new advertising FAQ for more information.

Service update:Email delays
Emailed spam submissions and other reporting-related email has been delayed. Some mail may have bounced, other mail is not being processed in a timely manner. Users may notice that their submissions are going un-answered. Please avoid re-submitting spam if you do not get an immediate reply. Your original submissions will be processed in time.

This problem should be going away gradually. A new mailserver has been added. As DNS records update to recognize the new server, submissions should be handled more quickly. The new server appears to be keeping up - there is no backlog. The old mail server will eventually work through it's backlog. Aug 01, 2002

Service announcement: SpamCop down .. from 8:30 am to 8:30 pm, Saturday, Jul 20. NYI points to a DoS attack from Qwest IP space. Hopefully we'll now be able to get that spam reported and blocked! Email users may notice more-than-normal amounts of unfiltered spam as a result of this outage, but these problems should resolve themselves.

New server and slow service update
The new database server is still not online - I'm reconsidering how to roll it out. However, I have made some software changes which should take some of the pressure off in the short term.

Spam Reporting Slowness (updated)

The database server is on-site, but it seems to have developed some "infant mortality" hardware issues - either due to defective parts, or damage in shipping. Jul 01, 2002

As I'm sure you are all aware, SpamCop is again becoming unbearably slow. As always, this is particularly true on Monday mornings and mornings in general. After doing some database maintenance, things are getting a bit better. However, the real good news is that I am in the process of setting up a new database server - currently the main bottleneck. The hardware is almost ready, but not on-site, and not configured completely.

For the curious, the server specs are:

  1. 2U enclosure, 450W power supply
  2. Dual AMD Athelon 1900MP processors (Tyan S2462 MB)
  3. 4 120GB WD1200BB IDE hard disks (RAID 5)
  4. 64-bit-pci 3-ware 7410 RAID controller
  5. 2GB RAM
  6. Slackware v8.0 Linux, 2.4.18 kernel
  7. MySQL 3.something-latest

Once this new server is online (by the end of the month, if not sooner), I hope and trust things will get better. How much better remains to be seen. I am also constantly evaluating new ways to improve performance through software. One major area for improvement is to allow no-wait spam reporting. I've long been considering ways to implement this type of thing in a safe and sane way and I hope to have some sort of no-wait option available soon.

My sincere THANKS to all the paying members who have made these upgrades possible.

POP users forced to reconfigure
Some legacy accounts have been configured to receive report replies to SpamCop's pop server. These accounts have now been reset and users affected will see a message stateing their account is not active. Some problems with the email-settings pages have been fixed, and this message should now lead to a working email-confirmation system.

Small change to ISP replies
When you file a spam report, the recipient will often reply. In the past, you had three options for how to handle such replies. One of these options has been defunct for some time, and is now going away permanently: "hold replies". Since SpamCop email and reporting are seperate systems now, you will have only two options: either you can receive only human replies or receive all replies, human and otherwise. Users who currently have their options set to hold human replies should not be surprised to find these replies arriving at their inbox.

Preferences screens have also been expanded and corrected. You can change or check your preferences by clicking "preferences".

Flat-rate SpamCop email accounts available:
Sign up today!
SpamCop's next-generation email service has been out for some time, and is near ".1" quality. Flat-rate email accounts now available for only $3/month. Anyone who uses their email address should read carefully in order to understand these changes:
General information about new email system
Specific information regarding what will change

SpamCop account changes
"Legacy" email accounts are no longer available - all new email accounts are the above flat-rate, $3/month accounts. Reporting-only accounts are available for those who don't need filtered email. Existing email users will not experience any significant changes yet. Eventually, legacy accounts which are not converted will become reporting-only accounts (email sent to those accounts will bounce, POP client/server service will be discontinued). Existing email users are urged to convert ASAP. A warning email will be sent at least one week before legacy email service is discontinued.

To summarize:

Virus filtersFeb 14, 2002
All SpamCop email accounts now have InterScan VirusWall filtering. Currently, this system produces annoying messages whenever it filters a virus, subject "InterScan NT Alert". Jeff will be working to make the filters more graceful. These alerts are not spam, nor are they a hoax. They indicate that you have been protected from a potentially harmful virus.

Flat-rate users' system improvements: Flat rate users now have equal access to the members spam-reporting server. This won't prevent all delays/slowness, but it should be more "fair" at least. Now all flat-rate users can release mail from the held-mail menu.

Fixed bugs in email spam-submission system:
New flat-rate users and some other users who have had problems submitting spam for reporting via email should have more success now. See above for your personalized spam-reporting address. Note the address is CaSe-SenSiTive. Submissions are no longer accepted except to personalized addresses.

SERVICE UPDATE: Email filtering problems Jan 29, 2002
Update: Email filters are working again. Held email is being recovered. All held mail that can be recoved soon will be. Some users have noticed a discrepancy in their held-mail counter. This discrepancy reflects the held mail that is not accessible. Once any lost messages have expired from the held-message database, this discrepancy will disappear.

Update: Database recovery still not successful. Database server crashes again, email data still in limbo. Repair efforts continue to retrieve held email. In the meantime, I have moved that data out of the way and started with a clean slate. Filters resume operation. Old email will be reimported if/when it is recovered. Watch this space for details.

Due to problems with linux bugs and files larger than 2GB, there has been significant data loss in SpamCop's database. The spam-reports table which holds headers was completely corrupted. Some mail processed over the past 24 hours has been lost! This should only affect held messages (mostly spam). Currently, the filters are offline to avoid further data loss (all mail is being delivered, including spam). I expect to bring the filters back online as soon as database repairs are complete - hopefully within the next 24 hours.

Users on the new email system have not experienced any significant problems with account conversion, and they have not been affected by this latest crash. So this seems like a perfect time to open the new system to all users. There are still a few features missing (most noteably, users who do not store mail on the SpamCop mail server cannot release held mail easilly). However, the system is proving to be fast and stable - and the missing features will be restored.

Filter updates Jan 02 2002
Problems with real-time updates over the weekend and on Monday caused a larger than normal batch of spam to slip past the filters. This problem has now been rectified.

Many users are still not happy with the amount of spam slipping past the filters, and I'm working to make this better. I thank everyone who submitted samples. Feel free to continue sending them, but for now I think I have enough data to indicate where problems lie.

I have another filter rule in the works which (if it does not cause too many false positives) - will eliminate most of the type of spam that has slipped through the new filters.

Spam email reporting changes Jan 02 2002 will be going away soon. It is being replaced by per-user reporting addresses. So each user will report spam to a customized reporting address which uniquely identifies them. Forwarded spam will generate a reply to the original registered account, not the account from which the mail was sent. Users who use the cut and paste method do not need to make any changes.

Check the top of this page for your personal spam-forwarding address.

Update: New filters fixed Nov 08 2001
I hear you! "The new filters suck", "Give me my money back", etc.. I know. I'm working on the system, the feedback has been very helpful. I found a major bug Monday which was causing filters to pass spam, it is now fixed.

I also have a few more tricks up my sleeve to help tighten things down. I hope you'll stay through these growing pains, but you are always welcome to a refund of any unused portion if you would rather terminate your account - just post in the forum as always..

If you get spam that has been passed by SpamCop since Monday, please forward it (with complete headers of course) to I will be using these cases to find new ways to block spam without blocking legitimate mail. Please *do not* send important email to this address, as it may be deleted unread.

In addition to the beta test of the entirely new system, the SpamCop filters already in use will change effective immediately. These new rules are more accurate but less strict. This means fewer held messages with the possibility of a spam slipping through here or there. This change will give all users a taste of things to come.

Users who prefer less spam at the expense of more held mail should change their filter options to "Block all":

(This setting is controlled through your filter preferences normally)

Free SpamCop offline Friday Oct 30th 2001
I found member's email being delayed as a result of database activity. Barring free users from the site provides a temporary solution. Stay tuned for news on the permanent fix!

Blocked Senders reset ~ Sep 27th 2001
While rebuilding the database, I decided to purge old entries from users blocked-senders list. Only older, single (not domain-wide) entries have been removed.

Email filter downtime
Email filtering software crashed unexpectedly around 10PM EST, Sep 25. The system is currently working to deliver the backlog of stored email. No mail will be lost, but it may take some time to deliver it. New mail will be delivered concurrently with backlog, so new mail should go through relatively quickly.

I've been working on a new filtering system, and this problem was caused by errors in that new system.

My appologies to those affected by this problem.

More carnage
Someone at NYI kicked a power cord at 5:35pm PDT Sep 27th. Main DB server went down cold. Repairs take a very long time. Thinking about ways to reduce dependancy on mysql for large chunks of data, the main cause of long rebuild times. Everything is more or less back to normal as of midnight, 7.5 hours later. Appologies for the downtime.

SirCam Update / New Filtering Feature Sep 26 2001
SirCam continues to mutate, and I am always more interested in fixing a general problem than patching a transient one. So I have created a new feature which will allow greater control without the guesswork of blocking specific viruses.

This feature is attachment filtering. Filter users may now elect to avoid all costs associated with attachments by deleting them from inbound email. Users who don't want attachements of any kind (including SirCam) should activate this feature. In a few days, I'll see who has enabled this feature and credit only those accounts retroactively for large emails received in the past.

(This setting is contolled through your filter preferences normally)

Old SirCam news
Many members have been troubled by a large virus, sircam, eating their fuel. This virus has been blocked, mail from infected senders is being rejected as the senders are identified. These viruses will no longer show up in your held mail, nor will they use fuel.

I have decided to refund fuel for users who have been stung by this virus through no fault of their own. In total, I've given back over 1.5 GBytes of fuel! However, affected users are being asked (nay required) to foot the bill for up to 1MB each. This cost is real; although I don't want to wipe anyone out, I think it's fair that some fuel is spent on this problem. Telling which charges were caused by the virus is not an exact science, so some users may benefit erroniously from this fix. C'est la vie.. Billing records begining on July 20th have been taken into account.
More information on sircam virus

Upgrade and downtime Sep 26 2001
8/1/01 1:20pm: SpamCop's webservers have been upgraded from 128MB RAM each to 1GB. This should provide much better response and fewer "too busy" errors on monday mornings. Webservers experienced a short downtime during this upgrade and email delivery was delayed.

SpamCop open source
SpamCop's reporting engine (not the member email-management system) is now freely available under the GNU Public License.

Spamcop news server offlineJun 27 2001
The spamcop news server will be offline until tomorrow (Tuesday) morning (or thereabouts). Please hang in there, service will be restored ASAP. SpamCop itseslf should still be working normally.

Filter Bug FixesJun 22 2001
Some users have reported problems with their "held mail" counter falling out of sync with the report itself. This problem should now be fixed. In the process, I have done some cleanup and rearanging of the release/delete mail system. Please look for bugs and report them in the forum as usual! Jun 01 2001

Email delivery offline overnight
I turned off my monitoring script to do some testing, forgot to turn it on again and the filtering process died unexpectedly. Instead of being paged immediatly, I noticed the problem when I checked my mail this morning and found none. The backlogged 27,000 messages are being delivered now.
Update:Delivering the backlog is taking longer than expected, but I am now processing it concurrently with new incoming email. So new email will be delivered quickly while older email will be delivered on a delay. May 25 2001

Report history erased
I typed the wrong thing - erased all report history. I'm going to try to resurect it, but don't know if it's possible. Ack! Sorry!

SpamCon: San Francisco, 24-25 May
SpamCon 2001 is the first vendor-neutral spam conference for those most affected by its effects: Internet system administrators and email service companies. May 16 / 2001

Downtime - 5/9 8:15am - 2:00pm PST
I'm still not sure what caused all the problems (slowness continued long after downtime), but things seem to be returning to normal now. Sorry for the inconvenience.

Thanks to Tampa Bay Connect
Who provide hardware and hosting for the SpamCop news server. Check out their innovative SmartMail services! May 04 / 2001

Report History back online
Report history is rewritten and back online. Not as feature-rich as the previous version, but it taxes the server much less. More enhancements will be available eventually. Apr 04 / 2001

Overloaded server
Update: More SpamCop work is being moved onto three new FreeBSD servers (shagrat, shelob and saruman). Although only partially complete, things should already be faster for both paying and free users. Missing features and problem fixes will be online as I get time to work on them. Please be patient through this transition.

12midnight Mar 22 (23rd)

POP mail mangling fixed - changes to Email Log
The release mail function has changed slightly. When you select 'release', held mail is no longer delivered in 'real time': released messages may remain in your held mail log briefly. They will be delivered and marked as such ASAP. This new behavior fixes a bug which was causing corrupted mail for some high volume pop server users.

Short Downtime - 7:00 pm PST 2/27/01
Latest linux kernel (2.4.2) is now online. This may speed things up on Monday mornings.

Authorize senders fails - bug fixed 2/20/00
Authorizing senders through the email log was not having the correct effect. Senders authorized using the email log during the last week will need to be re-authorized. Sorry!

I never reproduced the bug personally, but as I understand it from others' descriptions, these blank mails were in addition to actual email. No actual mail was lost, you just got extra junk in addition.

Free users can't report spam - bug fixed. 2/18/00
Just when you think it's safe to step away from the bug reports. You create a new bug. Or at least that's how it works for me. Sorry free users!

SpamCop is upgraded and running normally - where normally is defined as slightly less than total chaos. I'm glad to have the upgrade done, and I'll be posting more information on new features and a schedule for bringing back some of the peripheral data (report history for members, statistics). Please be patient. I'm sure there are bugs, and I'll be fixing them ASAP. This upgrade is mainly a back-end change. That's why the report history is gone, but why you don't see too many changes in the user interface. These changes will facilitate many more enhancements over the coming months.

Problems: Some email which was held as spam may be only partially saved. In some cases, you'll only see the headers in your email log. In other cases, the end of the mail will be chopped. This problem is now fixed.

New version of MySQL 2/14/01
SpamCop's database is powered by MySQL. It is newly upgraded to version 3.23.33.

Downtime: 10:29am - 1:00pm EST, Sep 11th 2000
"Power problems" at caused an hour of downtime, followed by more downtime recovering databases afterwards. Uptime was 60 days previous to this.

New news server: Please update your newsreader.
Please update your newsreader software to use the new SpamCop news server ( Posting has been disabled on the original system, so your posts will not show up unless you use the new system.

A new, majordomo-based email mirror will soon be available for those without "real" NNTP access. Watch this space for details.

Downtime: From 15/Apr/2000:08:43:14 -0700 to 15/Apr/2000:11:25:03 -0700.
The site was "up", but it's network connection was down. No email should be lost or bounced. Some mail will be delayed. Sorry for the inconvenience.

3/29/2000 SpamCop causing duplicate emails
.. again. The morning of March 13th brought a shadow of the duplicate email problem. Some messages were sent twice. The underlying problem was different and has been fixed.

Recently (Friday, March 3rd), I introduced a bug which caused the SpamCop filters to deliver multiple copies of email to many users. The bug has been fixed and I have also credited everyone with an extra 50K of fuel to make up for any lost fuel. This will be a net positive for most everyone. If you think you lost more fuel, please feel free to contact me.

Small changes 26-Feb-2000: Several bugs have been fixed recently. checking is back online. A problem with the email interface has been fixed. There is a new FAQ entry for Eudora users who are having trouble with the new, strict HTML email validation rules. More information in the forum as always.

Email processing offline: Back online now (22 Feb 2000)
Just as I decided to go away for the long weekend, the email processor decided to quit. The filters were offline for a little over 24 hours, for which I am both sorry and embarrassed. However, no email was lost - just delayed - and SpamCop is now back to it's normal turnaround time.


Extra reporting address for members: Send reports to anyone by default
To make up for taking away the option, I have added an advanced preference for sending copies of your spam to any one or more email addresses. You can include or any other address you want to get copies of your spam.

Removed FTC, added default Spam Recycling Center options on reporting page.
Members no longer get an FTC option by default, but they may of course add any email address to their reports that they want. Members and free users now have the ability to send reports to the Spam Recycling Center. This option is selected by default, but it is still optional. You should familiarize yourself with the goals and methods of the SRC if you are concerned about how this data is used before you choose to send your spam.

Improved Held Mail log: New features save time
Members now have a new, improved log for reviewing and releasing held email. You can filter your mail log by several additional criteria. You can also release and/or delete multiple messages at once. 1/17/2000:

More filter tightening
I just added another blocking rule. Previously, only the original source of email was compared against the ORBS relay database. Now, every server which handles email is checked against ORBS. This should help the filters stop a lot of spam with few civilian casualties.

Dump AOL, get mindspring: AOL users, free yourselves from tyranny!
I couldn't resist posting this. Please, help punish AOL for their spam-friendly policies. AOL is not only to blame for huge quantities of outgoing spam, they also spam their own customers incessantly. Help send them a message. Mindspring is running a special offer to help you switch away from AOL painlessly.

HTML email sterilization: Preserve your security and privacy
Members; SpamCop filters now include an optional HTML email sterilization feature to counter HTML email threats including involuntary return-receipts and scripting problems. This feature is still BETA, but it's fairly simple and seems stable enough. Click above to read more and activate this feature. Please report any problems in the forum. 12/20/1999:

More algorithm updates: A slight tightening move
For those using the filters, you may remember a week or so ago, I changed how the filters worked. While I am mainly pleased with the new system, I found that spam was slipping through too often. I am now concentrating on correcting this. I have added back a check for the IP address's past spam history as well as the ISP's history. I hope this will help keep persistent spam sources blocked when contact information changes. - ISPs are identified by unique contact address and thus can lose their history when they change configuration.

I am also improving my own tracking tools so that I can gather better statistics on both erroneously held legitimate email as well as erroneously passed spam. 12/16/1999:

Address-finding algorithm changes (mainly affects members)
SpamCop is now using a more conservative method for finding responsible party email addresses. This is a kinder, gentler and surprisingly more effective way of getting spam complaints addressed. While there are frequently changes to spamcop which result in different handling of certain issues, this change is important because it effectively divides the internet into a much larger number of sub-networks.

What this means to you: Over the next few days, some spam may slip through the filters as we re-populate the database for known spam sources who have new reporting information. Over the long term, I hope this new system will allow more accurate identification of common spammers, and less filtering of innocent networks. Time will tell, and your feedback is always welcome in the forum. You can also get more technical details by reading the current forum posts.


Web archive: Forum messages available from the web
The navigation is rather clumsy, but may be an alternative for people who are not able to use NNTP. Only the main group and the geeks group are archived on the web site currently. Index files are updated nightly. 10/4/1999:

New Version: Version 1.2
Ran through a final checklist of tests, and put the new version on-line. I will be monitoring the system and the forum closely for bug reports. Check out the changes document to see what's new.
Update: As the new system imports emails from your email list, it re-numbers them. The URLs embedded in email passed before the switchover will not work.

Email interface is back! No more cutting and pasting!
BETA! Please post any problems or feature requests in the forum. You can now forward your spam to This works for members and free users.

POP3 support
SpamCop now has POP3 support for members. If you want to use the spamcop filters but have not been able to because you cannot forward your mail, this *may* solve the problem (not for AOL users, apparently).

Privacy Bug

  • Last night (6/2/1999 ~11pm PDT), I introduced a new version of SpamCop which required all the free users to verify their return address. I also re-wrote a few other things. Something I broke in the process was this:
      10/31/1998: (mod 11/6/1998)
    • By default, spamcop no longer CCs you the complaint as it is sent. You may still request a CC by entering "cc:" before your email address, like this:
      DO NOT put anyone's address in this field EXCEPT YOUR OWN. This is where the email is FROM, not just a CC field.
    • You may also leave this field blank. Spamcop will send complaints FROM - a valid email account on this server. I will peruse the responses from time to time, but don't expect real personal service. This is simply a better alternative to using a fake address.
    • Hardcoded abuse addresses for often-failing ( and (
    • NEW! Mail Queue (now defunct) This is a list of all the email waiting to be delivered. See what happens to your complaint after you fire it off.
    • Fixed IP lookups through arin database. (
    • Added support for IPs under kr TLD. (
    • FAQ report: Here's a pretty common email:
      Q: Subject: bad address in your database.
      FYI: Here is the header from a returned message that bounced back to me, after using SpamCop to send a spam notice...

      A: Don't worry about this stuff. I don't maintain a 'database' per se. I try 3 places to send complaints. sometimes one (or even two) of the three will bounce. It's not really a 'problem'; however, I'm thinking about adding a feature where you can disable sending to either address on a case-by-case basis. the abuse@ address is probably the most likely to fail, becuase it's just an agreed-upon 'standard' complaint-line. I don't know for sure that it exists at the domain I'm sending to. The other address - "SOA" - is supposed to be correct, however it is sometimes woefully out of date, or simply missing altogether. You will usually get through on one or the other and if that dosn't work, the third - will hopefully find the right person. Perhaps I should maintain a database of these places, but that means I'd have to keep it up to date, which is more time than I want to spend. For now, see the next item - I only plan to update this DB with the biggest ISP's - not every mom-and-pop. You just have to put up with the bounces, or lie about your address so you never get any mail from spam-cop sources.

    • Added a long-overdue feature so that spam cop 'knows' about the main ISP's abuse addresses (currently,,, When one of these ISPs is to blame, we send email only to the official email abuse address and forgo the usual abuse@, SOA address and addresses. This should cut down on a lot of bounces.

      If you want to recommend an abuse address for this list, be sure to include the address that spamcop comes up with 'naturally' as well as the new official abuse address.

    • Fixed a problem that I introduced recently - I'd give up too soon, when I hit the "Message-Id:" field. Now I put it back to looking only for the "Date:" field.
    • Something I did earlier must have screwed up the netscape header parsing - at least to the point where I couldn't find the Subject line (for the archive). Fixed that bug thanks to a tip from a user.
    • Expanded domains which are off-limits to complaints - added,,,, to the already existing
    • More minor improvements to the reverse-DNS lookups
    • When getting domain name, try an nslookup before resorting to DIG.
    • Added another backup method for finding a domain for an ip - "whois". Right now this method is a last-ditch, but I may make it the preferred method.
    • Ditched the banner ads - I made $4 in a month and pay $200 in the same time. Feel free to send money.
    • Made spamcop slightly more permisive in parsing type 1 headers, also let it use non-reverse DNS matching to verify the Received chain.
    • Fixed a problem that was causing Spam Cop to notify administrators in domains that are mearly providing secondary DNS for spam IPs. When I can't find an SOA for an IP now, I use the first ANY record to determine the domain, then get the SOA for that domain.
    • Added support for a 'type 5' received line. Looks like this:
      Received: from (actually by george (PP) with SMTP; Sun, 13 Sep 1998 06:21:07 +0100
    • Added explicit support for hotmail. We now notify so that the hotmail account will get yanked as well as the ISP used to connect to hotmail. This should surprise some spammers!
    • Fixed a bug that falsely notified ISI.EDU of spam that wasn't their fault. (Sorry, it won't happen again.)
    • Added an explict message for people who don't give me the full headers.
    • Small change to the hostmaster-finding algorythm so that it fails gracefully to a default "postmaster@" instead of refusing to continue.
    • Removed much of the logging. I am receiving about a megabyte of spam a day through spam cop. I can no longer personally check on the accuracy of spam cop's determinations, so I will no longer be keeping full headers on the spam that spam cop parses correctly. I am still logging and investigateing spam that spam cop is unable to parse correctly. I am now counting on you, the user, to notify me if you see something that dosn't look right.