I've received the same spam from a particular ip on 3/27/07, 4/10/07, 4/11/07, and again today. Every time I submit it to Spamcop, I always get the same message, "ISP has indicated spam will cease", each time with a different date. It is the same message from the same spammer going out through the same IP address each time.

Here's the latest:

http://www.spamcop.net/sc?id=z1281589625zc...82bd942906e000z

Unfortunately I don't have report id's for the older ones, since no reports were filed:

Submitted: Wednesday, April 11, 2007 11:37:09 -0700:
Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY)
No reports filed
Submitted: Tuesday, April 10, 2007 19:49:50 -0700:
Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY)
No reports filed
Submitted: Tuesday, April 10, 2007 11:34:31 -0700:
Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY)
No reports filed

How many chances does SC give an ISP? If an ISP gets relisted within a certain period of time, doesn't that count against them with a heavier weight? Shouldn't SC handle subsequent delisting requests wth a certain amount of skepticism?

Each Report has a set of options for the ISP/Host/whoever to select from in response to that Report. In the scenario of the complaint being about an spew from an IP address, there is the 'OK, it's going to stop' checkbox, which then basically sets a 24 hour clock on receivng more Reports ... the point being, that id this ISP is now aware of the issue, has taken steps, why continue to bombard them?

Looking at SenderBase data at http://www.senderbase.org/search?searchBy=...g=204.15.74.178 there is the appearance that something has in fact happened .... (thought there might be other reasons ..???)
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ......... 1.6 .. -100%
Last 30 days ... 3.7 ... 343%
Average ......... 3.1

On the other hand, even your "no reports sent" scenario feeds into setting of that background data (for Reputation Points), not generating enough statistics for a SpamCopDNSBL listing, and even notfication of that ISP/Host ...

90 day history on "that same IP address" ...

3 reports sent on 11 April
1 on 14 April
1 on 17 Apr

The 'action taken' seems to have happened within three hours of that first (and only) Report ....

I'm not "bombarding" them, we are only talking about less than a dozen messages. But, they keep coming back. And this is happening over a period of several weeks, not just several hours. Again today I got another one:

http://www.spamcop.net/sc?id=z1282131773z5...de0e9243acd5daz

Looks like they are now getting picked up by other blacklists:

http://psbl.surriel.com/listing?ip=204.15.74.178
http://www.spamcannibal.org/cannibal.cgi?p...p=204.15.74.178
http://www.sorbs.net/lookup.shtml?204.15.74.178
http://www.emailbasura.org/cgi-bin/consult...l?204.15.74.178

Yep, thats what happens when an ISP ignores the early warning lists like spamcop. Some of those are going to be MUCH harder to get off than if they had really fixed their problem when spamcop sent the first reports.

18 APR 2007 1443 GMT-5
http://www.senderbase.org/search?searchBy=...g=204.15.74.178
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.8 .. 4757%
Last 30 days .. 3.8 .... 346%
Average ........ 3.1

Yep, must have been something else ...

Never saw this before: For the past month whenever I report a longtime spammer, Spamcop doesn't accept it. Instead it says:

"ISP has indicated spam will cease; ISP resolved this issue sometime after <Fri Oct 3 14:44:02 2008 -0700>"
-- The date it was "resolved" always is the same date the spam was received.

Has this spammer somehow found a way to trick Spamcop into no longer accepting reports against him? He's actually been increasing the frequency of his spams.

Hi, daveyrosen,
...When I went to the top of the page and entered "ISP has indicated spam will cease" into the text box between the "Search for -->" button and the blue "GO" button and then clicked on one of those buttons, I got several hits, including for SpamCop Forum thread "ISP has indicated spam will cease?." Have you read that thread? Does it help?

Edit: Former post number 9810 was moved here by the Forum administrator after I replied to daveyrosen's original post.

This post merged into just one of many existing Topics/Discussion about the same subject. As Steven mentions, there is a reason those mulyiple Search tools are right at the top of the screen.

PM sent to advise of the actions taken on this "new" post.

How many times does an ISP get to say that spam will stop before it becomes clear the ISP is the spammer.

I report them - they say they will stop it starts again - here is a little collection since I started noticing this behavior:

postmaster[at]thecolosite.com bounces (165 sent : 83 bounces)

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.
ISP has indicated spam will cease; ISP resolved this issue sometime after
Tuesday, November 18, 2008 5:48:54 PM -0500

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.
ISP has indicated spam will cease; ISP resolved this issue sometime after
Wednesday, November 12, 2008 10:02:38 AM -0500

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.
ISP has indicated spam will cease; ISP resolved this issue sometime after
Sunday, November 09, 2008 1:07:35 PM -0500

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.
ISP has indicated spam will cease; ISP resolved this issue sometime after
Thursday, October 23, 2008 7:49:53 PM -0400

A fraught subject - the SC staff 'keep an eye' on ISP claims and I guess it depends on the volumes seen thereafter (and some UBErs perhaps 'snowshoe' to avoid trip points). What is/are the IP address(s)? That ISP has just the one which is apparently/clearly disreputable:

http://www.robtex.com/ip/67.209.135.230.html

[on edit] Hmmm ... and a couple of SpamCannibal hits:

http://www.robtex.com/ip/208.76.97.129.html
http://www.robtex.com/ip/208.76.102.95.html

All of those are low volume, hard to get listed unless they hit a spamtrap.

[on further edit] And ... it looks like many of the rest are on spam.dnsbl.sorbs.net though SenderBase sees no volume from them at all. That list is sort of like a spamtrap-triggered hit but listings are long-term.

Thanks - they are all in the 208.76.97.xxx range

Okay, (low) volume is what's working against listing, even without the "spam will cease" intervention. Reputation score filtering would probably pick them up but they sneak under the radar for most other methodologies, by the look of it. Except for the fearsome sorbs spam list (though that is supposedly configurable for those not wanting to filter out quite the whole internet).

Anyway, the IP range seems quite limited so I suppose most could filter on that. The full list seen by SenderBase is at http://www.senderbase.org/senderbase_queri...thecolosite.com - just 25 addresses. Unless whoever is using that network to spam becomes more ambitious, I don't think they are ever going to come on the radar, generally. Probably the 'snowshoe' thing.

Another approach would be to send manual reports but it looks like those might bounce a bit. And the ISP might be complicit anyway.