I am getting bombarded with at least 2 of those per day that are not caught in my e-mail account's spam filter, and they are always image spam, directing to IP addresses in Romania - and usually now in octal IP addresses.

Problem is that the default reporting addresses point back to an abuse address at a domain which is controlled by the spammer network themselves.

Would it be best to report to their upstreams? I can provide IP addresses and AS numbers if necessary, but those should be pretty known to be IP networks/AS numbers that are totally owned by spammers themselves (either bought out or totally stolen). Usually these are /20 or /21 IP blocks, but are known to go to as much as a /16 or /15, based on the IP addresses involved.

I have one prolific spammer who seems to send me at least three or four messages per day. I have put them in my personal black list, but they are still getting through. I have kept a webmail window open, in case that's the issue, but they are still getting through. How do I get them redirected to held mail if the personal blacklist doesn't stop them?

A majority of spam seen at two of my reporting addresses is of the Glavmed / "Canadian Pharmacy" variety (counterfeit/placebo/toxic medications and magical sexual-size-and-performance enhancers). Spamvertised domains are typically pointing by DDNS proxy to targets at 58.218.177.253, 61.235.117.75 and 124.248.32.48.

Nearly all in the last week have pointed to the 61.235.117.75. None of these however are newly compromised addresses.

Spamcop directs reports for hosting to spam[at]ccert.edu.cn, abuse[at]anti-spam.cn, and abuse[at]chinatietong.com. These are nonresponsive.

APNIC's WHOIS record for the net which contains 61.235.117.75 includes some better information.

route: 61.232.0.0/14
descr: PACNET (proxy-registered route object)
origin: AS9394
remarks: This route object is for a PACNET customer route which is
being exported under this origin AS.

This route object was created because no existing route
object with the same origin was found, and since some
PACNET peers filter based on these objects this route
may be rejected if this object is not created.

Please contact abuse[at]pacnet.net if you have any
Concerns regarding spam/Abuses related to this object.

Very actively spammed at present are sites the domains of which are "self-routed" via remote dynamics by "organcamp.ru" -- here's a useful listing from URIBL:

http://rss.uribl.com/ns/organcamp_ru.html

ALL point to 61.235.117.75. A wholesale nip-in-bud by removal of the onerous route-object would be a wonderful thing.

So I am wondering if my peers could include this information and reporting-address in their reports for this spammer - and what if anything I may be able to suggest in order for SC to automate it.

I realize (from a prior note to admin) that popping of mail is on a 'every so often basis', whose time interval gets elongated every time the server says basically "I'm busy, go away"...

However sinze Friday, the popping has been very erratic.
Right now I have mails stting on Yahoo server since Firday 7:37AM (US Eastern)
Once in a while one or 2 make it. Sometimes a batch makes it in.
But I still 150+ in yahoo inbox
SPAMCOP is now showing 'unknown error 24

GMAIL pops fine, and consistent.

Is this on SPAMPCOP's end, or has YAHOO dorked their server farm again?

Thanks!!

It appears as if all inbound messages to our domain (rrjfs.org) are being bounced back with the following message:

173.9.185.13 does not like recipient.
Remote host said: 550 5.7.1 208.109.78.208 has been blocked by Spamcop
Giving up on 173.9.185.13.

When I test our email server locally using telnet on port 25, I get the same message stating that my INTERNAL ip address being blocked. I am now getting messages stating that my local gateway ip is being blocked by Spamcop as well.

This sounds like a virus to me, but I cannot seem to find any information that matches that my sepecific problem.

Help!