A mojority of the spam I receive comes from cnc-noc.net. Why do they not get shut down? It seem pointless to report spamers that goes on for years.

/Anders

I don't know about cnc-noc, but there are some spammers who own the IP addresses that they send from. And you are right, it is pointless to send reports to them. Again, I don't know about cnc-noc, but many of those that do not respond are sent to devnull (meaning the report is not sent), but are listed on the blocklist.

There are two aspects to spamcop reporting. One, is the report which is useful to a server admin who has a leak in his outgoing spam control system or is ignorant of how to control unsolicited email. In the beginning the report was more important, but now reports only go to responsible server admins once in a blue moon. And two, the listing of IP addresses currently sending spam so that server admins can filter the spam out. The second reason has become more important at the present time.

There is no authority that can shut down a spam sending IP address unless the service provider lives in a country that has laws against spam. The internet solution is to block incoming email from those IP addresses which works really well unless there are legitimate users who use that IP address. IMHO, they should get blocked also, but most ISPs disagree. Therefore, they use blocklists to filter. An IP address that has a reputation for sending spam is permanently on other blocklists and server admins use a combination of lists and methods to determine what to deliver.

You don't say whether you use the spamcop email service or not or how you filter spam. Nowadays, it is the way that email is filtered that is pointless or not.

Miss Betsy

cnc-noc is China Netcom, which is in China, aka that large country whose main exports are cheaply made goods, and exceedingly large quantities of spam.

I have never received a response to a spam complaint sent to any entity in China, nor have I ever received a legitimate email from China during my 18 years online, which is a major reason why my local blocklist includes all IP address space known to be assigned to China or Korea. When I implemented the local blocklist several years ago, the spam volume dropped 40-50% as soon as I added China and Korea to the list.

I do have the advantage of being able to block based on IP at the time of the SMTP exchange, so my server simply refuses to talk to them.

The reporting adress of gzy[at]21cn.com is the only cooperative one I've ever reported to. They have even asked me to unmung URL's embedded so they can shut the bastages down.

What happened to China's push to end spam? A couple years back, they publically executed a ringleader and gave a hundred of his cohorts 20 years in the dungeon as a show of good faith?

Good question. They have laws (well, obviously, if they shoot/shot people for breaking them), one of my rare Chinese responses even quoted relevant parts in excellent English, I should have kept a copy (mainland too, not HK IIRC - incidentally they don't seem to shoot people in HK, I think they give them medals instead, "loyal capitalists" or whatever). Lots of room for conjecture, no actual data.

In recent months, in addition to the usual spam for phony pharma, etc. originating from CNC-NOC.NET, I have been receiving several times a day message-less spam, which may be malware probes. After sending a couple dozen complaints to abuse[at]cnc-noc.net, my own IP number has ended up blocked by CNC-NOC.NET. I have concluded that CNC-NOC.NET exists only to spam and send malware. Has anyone ever received clean mail from a CNC IP number? Unfortunately, I can not block all Chinese IP numbers, as I actually do get e-mail from one friend in Beijing.

China is second only to the USA as a source of spam according to SpamHaus. The majority of members 'here' would see nothing but spam and malware from or involving any Chinese network - but that is USA, Britain, Canada, etc. It is/may be a different story in Asia and (perhaps) Eastern Europe. The Western European-American experience of CNC-NOC.NET will not necessarily be a reliable guide to their overall activity. For what it is worth, abuse 'sightings' of that network will be found amongst the posts in Google Groups CNC-NOC.NET

Hope this helps.

For your reference, I (an American citizen) am currently working and living in Japan. Most of the spam I receive, including messages written in Japanese (which I read fluently), originate in China, and, to a lesser degree, Russia and Korea. And almost all of the spam from China is sent from a CNC-NOC.NET IP number. In any case, I think the fact that CNC has blocked my IP number after receiving dozens of complaints from me shows just what an unscrupulous organization it is.

Thanks for the information on the Japanese 'experience' - unless you have reason to believe your address there is particularly targeted for spam in comparison with the rest of the country, I would say your assessment of CNC-NOC.NET is accurate in the larger (as well as 'Western') framework. In general the abuse from China is scandalous, IMO, and includes hosting of the most obvious and blatant phishing sites and services perfectly adapted to the needs of spammers (including high-volume, low-cost automated domain registration). Why the international 'community' permits their activity is unbelievable. Well, it's not a community, of course, and the spamming activity, illegal in China, (along with brand-name piracy and other economic crimes) evidently is not a priority for control nor does it conflict too heavily with the agenda of the Chinese authorities except when it suits them to do a little window-dressing/prevarication. Other times I suppose they can just point to the USA and retort with the 'pot calling the kettle black' line when it comes to spam and the drivers for it and overlords of it.

So, on present evidence it seems no-one has yet to sight a 'straight' message from CNC-NOC.NET. Yet SenderBase records zero sighting of any messages (let alone spam) from the network under that name. The explanation is, undoubtedly, simple. But beyond me even so, or needing a little more research than I have done. I guess one has to go 'upstream' (or downstream) for evidence. There has to be millions of messages per day showing somewhere.

From my experience, Chinese providers never respond to or do anything about spam complaints, at least those from Japan and perhaps any other country but China. There are historic reasons why many in China and Korea feel it is alright to exploit Japan, but I am neither Japanese nor even from the generation that occupied parts of Asia. Korean providers will sometimes act on a complaint--paritcularly if it is from a woman such as myself about smutty spam. The fastest responses I have had to spam complaints came from Israel and somewhat surprisingly from Poland.
Japanese providers are usually fairly diligent. However, when I was getting bombarded with bogus bills for supposedly joining a porn DVD club in late August to September 2007, DTI (Dream Train Internet), while admitting it had other such complaints, refused to act, with the excuse that it had no idea what transactions I had with the organization sending me the bills. Of course, there should have been logs they could have checked. Moreover, the bills listed an IP number and a provider company that were not mine, and did not know my name--just my e-mail address, and I supposedly joined at a time early Monday evening, when I wasn't even home from work--which I could prove. I pointed this all out to DTI to no avail. Since the spammer/scammer was using the same valid return address, I simply had my computer's security system block it. But I did follow this scam on some blogs and found out that people were getting the bills until about mid-October, by which point the scammer lowered the demand to about half the original amount, as a charge for supposedly "quitting the porn club."

That is fortunate - they stuck with the scam line and didn't switch to extortion mode ("We will contact your spouse/parents in order to obtain resolution ..."). I suppose that would be a step too far into criminality to be stomached, even by their complicit hosts.

Anyway, spam is illegal in China but, as you infer, that presumably is enforced only for offenses against Chinese nationals (if at all). Maybe Japan shares the West's 'special treatment' at the hands of Chinese spammers and their associates. It is hard to tell without input from more of the world. Eastern Europe seems to treat some of what we would term spam as fairly much a legitimate business approach.

Interesting comment about Poland and Israel - unexpected (but very welcome) to hear of them being apparently responsive. A cynic might say "autoresponder" but one must live in hope

Actually the scammer-spammer did make threats at first to take legal action if the bill for supposedly joining the porn video club was not deposited right away. I suppose some victims, frightened by the words "legal action," paid up. I, of course, was aware that the criminals had no legal case against me, as I could prove I wasn't home at the time--that the IP number listed was not mine, etc. In a way, I was almost hoping they would take legal action against me, as I would clearly win. I think they lowered the price demanded merely in the hope that they could still get some money out of people who still refused to pay their bogus bill after at least six weeks.
A rapid response, which was definitely catered to me, from Israel did not surprise me, as that country has advanced security in various areas. The rapid response from Poland, saying that the account had been closed, did surprise me a bit, however the content of the spam concerned was not for a dubious product but a banking scam, along the line of the infamous Nigerian fraud--only this time it supposedly involved an Iraqi general who had deposited millions of dollars in a Japanese bank and who had been killed, along with his family, in the bombing of Fallujah. The message was written in poor English and came from Poland, and the Polish provider apparently closed the account within 90 minutes.
I've been to China several times, including in the 1980s, when it was first opening up to tourism from non-Communist countries, and twice last year. While I am glad in general that the Chinese people have more freedom than in the past, the flouting of the law has become quite conspicuous. For example, on a main street in Xian not far from four and five-star hotels, I spotted what was obviously a brothel, with scantily clad women in the window, and, if you passed by just at the right time, you could see one of them going off into a back room with a male client. Prostitution is supposed to be illegal in China, but this place was not even hidden in an obscure alley. Also, in Guangdong, just as I was leaving a popular restaurant a man came by on a bicycle carrying several Louis Vuitton rip-offs, which he offered for 100 yuan. (I forget the exchange rate, but I'm sure that would have amounted to less than US$100.)
Anyway, I would say that China regards spam to Japan in the same way it does for that to Europe and North America--in other words, they're capitalist countries that it's alright to exploit and annoy.

I've never received responses to spam complaints to the Far East either, but I do receive legitimate mail now and then from China and Korea, usually in English (or broken English) and sometimes with the line "On <year> <month> <day>, Tony Mechelynck wrote" in Chinese or Korean at the top. I get these on the peer-help mailing list about the Vim text editor, and their existence is one reason why I don't block China and Korea — or any individual country for that matter. And I'm not even in Eastern Europe (but in Belgium) but Vim is a very "international" software package, used all over the world on Windows, Linux, Mac and other personal computers, and even on IBM mainframes.

Like everyone (apparently), I do get quite a lot of cnc-noc spam, and I faithfully report it, not in the hope of having the spammer's account shut down (I guess the cnc-noc abuse desk, if there is one, understands only Chinese), but of keeping them on the SCBL.

I don't get a lot of spam from cnc-noc.net directly, but I do get a lot from phony drug sites that are hosted on cnc-noc.net addresses.

99% of my spam comes from sites hosted in China. I've had enough.

Lucky you: mine comes from all over the world (France, Brazil, the USA, Russia, Korea, you name it). No easy way for me to get rid of it by blocking just one country.

Back in October 2007 I noted 53 % of spam received had a source reportable to a Chinese ISP (since I use quick reporting I didn't realise this before - I analysed the text of the emails that quick reporting sends).

Since SpamAssassin does an pretty good job I seldom see such. If SA thinks that a site hosted in China ups the score then that's another plus (VBG).

that's the only thing SC can't really stop. and actually that's the only spam i get consistently, others die after a few submits

there's also something like verizon.net, but i get it like once a week or two. and i receive cnc-noc few times per day.