www.earthlink.net myEarthLink myVoice My Account Support webmail.earthlink.net

« How do I add another email address?     |   Back to MAIN   |     Web Mail 5.15 released April 30 »

What happens when I report spam? - 04/23/07

From: Email Guy
Subject:       What happens when I report spam?
Date: April 23, 2007 6:58 PM
Permalink   |   Post Comment

Users wonder if anything really happens when they use the "This Is Spam" feature in Web Mail, since they usually don't see an immediate result. We hope to add some features later that allow you to see reports about the effect of your own reporting. But in the meantime, know that several very useful things do happen, and please continue to use that feature. Here are some of the things that happen when you report a message as spam:

  • The IP number of the message origination is automatically checked against public blacklists of known spam sources, and against lists of dynamic IP numbers. A dynamic IP number is one reserved for assignment to individual end-user's computers on a per-connection basis and should never be hosting a mail server that originates messages. So email that comes from a server at a dynamic IP number is almost always being generated by spam-bots on compromised computers (search Google for "bot-net" for more info). When an actual human user sends email they should be sending through a legitimate mail server hosted by their provider, or they host their own mail server on a fixed IP number that they own. So when you report a message as spam, and the originating IP number is found to be a dynamic IP number, that IP number is added to a global block list at EarthLink and no more email is accepted from that IP number. So in these cases, the result of your report is almost immediate. That doesn't mean you won't get more spam from the same sender, since the spammer may use a large bot-net that contains many compromised computers. But at least one source gets blocked, and over time many do. Our IP block list has over 200 million blocked numbers at any given time.
    Note that the IP block described above does NOT result in blocking a real user from sending legitimate email, as they will be using the *outgoing* mail server set in their email software, which is not the same as the mail server where EarthLink accepts incoming email from other servers (MX server). Only connections to the latter are blocked, which doesn't affect anything legitimate that a user is doing, it only blocks the spam-bot mail server running on the unsuspecting user's computer.

  • If the originating IP number is found on a public blacklist of known spam sources or open proxies (such as the CBL), your report results in it being blocked from sending any more email to EarthLink users, just as described above.

  • The messages you report are compiled and analyzed along with all other reported spam, to create new content-based filtering rules that recognize the characteristics of that particular spam, but in a way that prevents false-positive blocking of legitimate messages. Not every spam report can result in a new rule being created, but when a critical mass of similar spam is reported, it does often result in a new block being created. Once a rule is created, those messages are then flagged as Known Spam for all EarthLink users, and deleted according to your own account settings.

  • The total count of reports from the "This Is Spam" feature is closely monitored and tracked, and when we see that number going up or down, we know how effective our efforts are at blocking spam.

So yes, we do act on your reports of "This Is Spam". Please do keep using this feature. And watch for some news later this year about us creating ways to give you more insight into the direct effect of your own reporting.


Posted by: Joe Goswick   |   April 24, 2007 7:55 AM    |   (1)

Second Request for this information!! When I attempt to sign in to email all is well until I attempt to sign in with the password. I get automatically bounced back to the name box until your #@##@## ads have loaded. If I don't type fast enough I ending up typing my password in the login name area in clear text. Only after your ads finish loading will the system allow me to use the password area. WHY is this? I have requested many times to take the ads off of my log in screen. I do not care about the U. of Phoenix, the coupon ads etc. etc. They are a waste of my time and cause a dial up system like mine to slow down. Thanks..I would at least like the courtesy of a response.

Flash ads will sometimes cause the cursor to move out of a form entry box, and this is a known problem that we have on our list to try and correct. This is not unique to Web Mail, and happens on many web sites, on pages with a form entry box and an advertisement on the same page.

Email Guy

Posted by: Lisa   |   April 24, 2007 3:15 PM    |   (2)

Is there a way to file email on earthlink, like you can on AOL.....in other words, take it out of the Inbox and put it in a file?

Ours works exactly the same way. The only difference is that they have already created a folder for you called "Saved". Just click on Folders and create any folder name(s) you wish, and then move messages there. All messages in any folder you create (and in your Inbox) are saved forever as long as you have the account, until you remove them.

Email Guy

Posted by: James Willis   |   April 25, 2007 11:54 PM    |   (3)

I'm curious as to what exactly is meant by this statement:

"So when you report a message as spam, and the originating IP number is found to be a dynamic IP number, that IP number is added to a global block list at EarthLink and no more email is accepted from that IP number."

When you say no more email is accepted from that IP, does this mean that the email will show up in the "known spam" folder, or does this mean the email will be thrown in a bit bucket at EarthLink, never to be seen by the user.

Once an IP is blocked, it is not allowed to connect to the EarthLink incoming mail servers at all, so no messages will be accepted into our network from that source. It is standard practice across the industry to refuse email from known dynamic IP numbers, which are not supposed to host mail servers. Users on dynamic IP numbers send email through their provider's (outgoing) mail server, which is always on a fixed IP number.

Email Guy

Posted by: Barbara   |   April 30, 2007 5:57 AM    |   (4)

Is it possible to increase the allowed number of blocked sites? I am over your limit and still the annoying Spam.

No. See this FAQ.

Email Guy

Posted by: Leigh   |   May 2, 2007 10:02 AM    |   (5)

Will any of the upcoming fixes address the issue of items marked as spam being sent to the Trash folder instead of being removed from the server? I seem to recall this issue was raised some months back, but it's still happening -- at least to me. Thanks.

Yes, it will be fixed.

Email Guy

Posted by: Barb   |   May 3, 2007 9:30 PM    |   (6)

I am tired of reporting several spam messages every day with the word "penis" in the subject line. Can I block certain words, so I won't have to deal with this @#$% any more?

Posted by: Bradley Warner Tompkins   |   May 5, 2007 2:09 PM    |   (7)

Hello Again, e-Mail Guy!

So far I've decided to stay with EL, at least for a while anyway, since you continue to seem genuinely trying to fix the bugs. BTW, this blog was the ONLY reason I'm still with you. Without it (or if I hadn't found it) I'd have been long gone. EL's phone support began sucking when they farmed it out to India. They are *very* nice people, incredibly polite (we could do well to emulate that), but totally clueless…

re.: "take it out of the Inbox and put it in a file"

I wonder if maybe the subscriber was asking how to get it off of your server entirely and into a file on her own hard disk drive, a different procedure than you described, but also easy to do.

re.: "Once an IP is blocked, it is not allowed to connect to the EarthLink incoming mail servers at all"

Since these are dynamic IPs, and probably from hijacked computers, I perceive a scenario where an innocent user who just doesn't understand the rules might have legitimate mail blocked. Does such a user receive a bounce message, or do they just get left clueless? (They really should get a bounce message. It might wake them to the fact their computer has been compromised.)

re.: "spam being sent to the Trash folder"

This is the straw that almost broke this camel's back. This issue very nearly caused me to leave EL after phone support tried to feed me a line of pure BS. The resources wasted on the "News" debacle could have been used to fix this a long time ago.

re.: "the word "penis" in the subject line"

In all my decades of computing, I've *never* seen the p-word, or any of it's variations, in any e-mail that was *not* spam. And every case of "enlarge + penis" is a slam dunk, yet it sometimes gets through your traps. However I concede artists, doctors, scientists, and patients, might legitimately use it.

Please consider adding a check-box feature for users to specify enabling filters for carefully selected individual words to block from both the subject and body. Depending on how it is implemented it might even be possible to let the user have one checkbox where he or she can type in their personally disgusting word. I would definitely use, and appreciate, such a feature.


(Corrected response 5/9)

There is no way to know the real user identify behind the spam attack, in order to notify the user. The spam bot is not going to use the user's identity. Since these compromised computers can send out thousands or even millions of spams a day, it is pretty much a universal practice in the industry to block them. This does NOT result in blocking that user from sending email, as they are using the *outgoing* mail server set in their email software, which is not the same as the mail server where EarthLink accepts incoming email from other servers (MX server). Only connections to the latter are blocked, which doesn't affect anything legitimate that the user is doing, it only blocks the spam-bot mail server running on the user's computer.

We do plan to add user-defined filters for email later this year. You will then be able to define the dispostion of messages according to text that appears in the subject line, for example. You are correct that a global filter based only on a common word in the subject line is not appropriate for all users and can't be assumed to be spam based on that characteristic alone.

The bug where messages you mark as spam are going to the trash folder, will be fixed.

Email Guy

Posted by: Sharon Mitchell   |   May 17, 2007 4:00 PM    |   (8)

Every time I log into email it asks if I want it to remember my ID and password and then never does. Actually, at one time it did remember the (deleted)@earthlink.net. It doesn't any more. This is typical of earthnet. I And I thought AOL was bad.

This is the browser on your computer providing that feature and that message, not EarthLink Web Mail. There is a bug in some releases of the Firefox browser that causes this behavior, and you need to update to the latest version, which you can get here. For any other browser, check your settings. For more information see this FAQ.

Email Guy

Posted by: chris   |   August 13, 2007 9:35 AM    |   (9)

My spam is still going to the trash, what happened, it never did this before? I have Safari, MacOSX.

thanks for your help.

This is a known bug to be fixed.

Email Guy

Posted by: barry   |   October 31, 2007 7:15 PM    |   (10)

in reply 7 you state:
>We do plan to add user-defined filters for email later this year. You will then be able to define the dispostion of messages according to text that appears in the subject line, for example.

i'd like to be able to filter for words not only in the Subject field, but also for anywhere within the Headers, as well as within the body of the email. as well as filter for non-english characters, such as russian and chinese.

Posted by: Mike   |   December 21, 2007 9:31 PM    |   (11)

It's now the end of the year, and I'm wondering what has become of the two VERY important end-user issues which you say (above) will be fixed, or will be accommodated by year's end.
It's the end of Dec.2007.

I want to know why (1) my hundreds of spam messages I'd like to delete as spam immediately (in one step) STILL end up in trash, taking up space (2) There's been not one iota of user-manageable features appearing (like the ability to filter key words, promised above).

These are huge daily-life annoyances, second only to reading assurances that "we're on it" only to find that's not so. (I'm a long-time mindspring->earthlink user and shareholder, and nothing imm is as responsible for the lack of satisfaction among subscribers as the issues described above, and the failure to listen to the consumer, and be honest or determined to make the things happen which users want and need, and say so.

Thank you, Happy New Year! For my presents.... please deliver what you've already promised!

We're working on it. The spam-to-trash is a low priority bug for us since Trash is auto-deleted periodically anyway, but it will be fixed. Adding user-defined filters for incoming messages is still on the list, but not near-term at this point. I'm sorry to have gotten your hopes up on that one, I did try to get it moved up on the roadmap. I'd love to have the feature myself. There are however, a lot of other improvements coming up soon. Things slowed down some with the recent re-orgs in the company (you're a stockholder and know this) but we're moving forward and building up steam again.

Email Guy

Posted by: Kathy   |   January 31, 2008 3:48 PM    |   (12)

First of all, I'm asking a serious question here and not just complaining, so please consider this idea carefully. Instead of merely reporting spam and deleting spam, why can't we just BOUNCE them back to the spammers? I can do that with my MailWasher program, so it seems only logical that it could be done from inside Earthlink's Web Mail, too. I mean, think about it. All this reporting of spammers and deleting their emails doesn't stop them and never will. So what will? Maybe if everyone they send emails to BOUNCED their emails right back at them, they'd get so overwhelmed with bounced messages that they'd give up and go out of business permanently. Seems like we're tackling the spam problem from the wrong end. We're chasing them, hunting them down. Why bother?... since they'll just pop up again using another phoney email address and with some other domain name. They've got us jumping through hoops trying to find them. That's a DEFENSIVE approach because they're on the attack. Maybe we need to go on the OFFENSIVE, by giving them back all their emails by BOUNCING them back! It would sure serve them right. Spammers mailboxes filled with their own spam. Just think of it! I know we can't always trace the source, and so emails can't always be bounced, but a lot of them sure could!

That may be a valid idea for an individual user, but there is no way that could be done on a large scale for an entire network, as it would result in all EarthLink email getting blocked by other networks. Most spam uses fraudulent return addresses, so the bounces would usually not really go the spammer anyway, they would go to some service provider and either be "user unknown" or be spam back to the innocent person whose address was spoofed. Both of those are bad, and both would result in that other provider taking action to block the source of them. That source would be us, which is why we can't do it, and why no email provider does it.

Email Guy

Posted by: liz98   |   April 20, 2008 4:49 PM    |   (13)

Reference: What Happens When I Report Spam? (04.23.07) and Leigh's posting (#5) and Email Guy's response "Yes, it will be fixed." ~ Only in recent weeks (spring 2008) have I incurred a problem with emails dropping into my Trash folder AFTER I report them as Spam (this was not happening in 2007). When I went looking for an answer, I found the 04.23.07 (that's 2007) report and reply. So, now I'm wondering: if the problem was fixed, why is it now happening with my profile? ~ Be assured, Email Guy, I appreciate all your good work.

It hasn't been fixed yet. We consider this a low priority since Trash is autodeleted according to the schedule you set in Preferences (defaults to keep each message 2 weeks). There's also some debate about whether the current behavior is in fact better, and safer, in case users make a mistake that would cause them to permanently lose a message. The Trash folder is a safety mechanism, allowing recovery of a message. Nevertheless, the old behavior did immediately delete those messages, and it was inadvertently changed way back then and not yet fixed.

Email Guy

Email Guy

Posted by: tiredofit   |   June 21, 2008 9:54 PM    |   (14)

I am getting lots of spam. I have examined these mails, and look at the header. The mail is NOT being sent to me, but to others with the first three letters of my email address, rather it is being sent to GROUPs at earthlink. I think three is something seriously wrong with the mail system. Anyone else had this problem? DId you report it? What was the result?


It is being sent to you. The To header doesn't control delivery and is easily spoofed to fool you. The addressee is specified during the sending transaction by the sending software, and you will only get a message addressed to your exact address.

Email Guy

Posted by: Bob   |   July 17, 2008 11:19 PM    |   (15)

I've seen a significant influx of spam in the last two weeks. I've been diligent about reporting it, but so far, the amount that has gotten through your filters hasn't seemed to go down. Is Earthlink noticing a general increase in the amount of spam being reported? If spammers have discovered a new technique that lets their messages get through your filters, are you aware of it and are you taking steps to block it? For months, I got almost no spam, and it was great. Now, all of a sudden, I have to spend extra time dealing with this distraction several times a day. Please look into it, and help if you can. Thanks.


Posted by: Hugh   |   October 25, 2010 6:46 PM    |   (16)

I may have accidentally reported my son's music teacher as known spam, and now cannot get any email from him. I there any way of reversing this? What happens when I report that a message in my known spam folder is not spam?


Posted by: William P   |   November 3, 2010 9:13 PM    |   (17)

I have been an Earthlink subscriber for many, many yearsand feel that it has served me well, but after reading some of the comments and responses indicating lack of action concerning customer needed issues, I am ready to move on and start using my gmail account. I, like other folks, need to filter words so trash emails won't disrupt my time and life. If it can happen soon, I would love to stay with my Earthlink account. Your action to fix what has been promised is not too much to ask.

Thanks for your help in advance.


Posted by: nursery   |   March 22, 2011 8:11 AM    |   (18)

why do i continually get a "The option to add a domain to your Blocked Sender List is not available with this selection" message for some domains. It is exceedingly annoying to have to constantly receive spam from the same address and domain that i have to report, obviously to no productive end. I see many suggested and promised fixes to your spam blocker that you've never attended to for years and years. Apparently, customer service in this area is truly unimportant to you.

Posted by: paula   |   February 22, 2012 3:47 AM    |   (19)

For some reason, I, and very senior members of my family, keep receiving emails from my husbands supposed email address. He does not send out emails but when I get 1 with his name and proper email address on it, I just know that he did not send nething. I do not know h.ow to block emails on my mobile device so instead, I report them as spam. Is this not the correct way to handle this problem?

Posted by: JDunn   |   February 28, 2012 11:01 AM    |   (20)

The past couple of weeks I've been getting TONS of spam (dozens per day) from unique email addresses with the .info suffix. I never receive any useful emails from there (except, possibly, those in my address book) so why can't I block the entire .info suffix? Sure, they go into my suspect email folder, but I still have to check that for useful emails so I have to see them all every day.

I've been using this email address since the late 90s and I'm really on the verge of burning it and leaving Earthlink because the spam is so utterly out of control. This thread is five years old; why do we not have a single new tool for dealing with this stuff?

Posted by: Karl   |   July 19, 2012 11:53 AM    |   (21)

Email guy can't say it so I will: if your biggest problem is spam going to your trash (forcing you to make the agonizing choice between an extra click to empty it or letting it autodelete)… you need bigger problems. If having to see the subjects and senders of suspected spam in an effortlessly deleted list is a big deal to you… big deal. These are comically trivial objections. Legitimate arguments exist for both retaining deleted messages temporarily and for deleting spam deliberately rather than invisibly blocking it by a guesswork filter. You may have a preference and your preference may be thwarted by a lack of consensus or allocation of time and effort elsewhere but you need to seriously consider what's wrong with you when something so innocuous and insignificant looms so large. Computers do amazing amounts of computation amazingly rapidly but you were led astray if someone told you software would release you from ever having to think for yourself, make decisions or follow processes again. It's right and proper that customer complaints are looked into and an effort made to address them, but if their priority criteria begins with security, reliability and unequivocal improvement, recognize that these two may never rise to the top of the To Do list.

Post a comment Back to MAIN

Please read the Ground Rules before submitting comments.

Please check the FAQ (Frequently Asked Questions) and try the Search feature before posting a new question. If your question is answered in the FAQ or in a recent article on the front page, it might not get published.

(All blogs get tons of automated spam from robots, so unless you answer this question, your comment will automatically be considered spam and won't be posted. Type human, one word, all lower-case letters.)