I've sent this query privately to the deputies -- perhaps someone here might also have some insight.

I have been approached by attorneys pursuing a spam-related matter against an online business. I would like to be able to give them information about certain reports I may have filed through SpamCop during August 2005 through January 2006. Would SpamCop have retained such elderly records? If so, is there an efficient way for me to search for these (e.g., by date or by report-to address)? You will appreciate that the "Past Reports" feature on the website is not ideally suited for this purpose.

-- rick

It's pretty doubtful. The cash infusion and hardware updates from the IronPort acquisition included massive hard-drives that allowed for the Tracking URL scenario. However, that database is basically set to 90 days worth of 'memory' ... There have been others that have asked in the past for a history of 'their' IP Address BL listings and were advised that this data was not available.

Thanks, Wazoo. I'm suspecting as much. Still, I have copies of the spams I got, and of a LART I filed with the upstream, this should make our learned counsel happy.

-- rick

SC has some 'interesting' subdomains which may be used to store older stuff (PW access, can't tell, but there's now a log entry with my IP against it ...), but just a couple of them seem to relate to specific 'persons of interest') and there may be other pages, off-line data, ... but the staff will know. This question has been asked before (as Wazoo says) but I'm darned if I can pull up the topic offhand. Sorry.

Late last year I began working with legal and AG on a suit against certain spammers and ICANN. We became bogged down because of the turnover in spamvertised domains and the authenticity issues surrounding logs and captured data.

So, since January I've been archiving all my captured spam and spamcop reports.

With the proliferation of domain kiting (tasting) used by cybercriminal registrars, the legal issues become much more complicated because of discovery.

I don't believe that data -- even if you could retrieve it -- will do any good in a court of law.

Our legal attack is now focusing on the IP holders of cybercrime spamvertised sites via ICANN and rogue registrars. It's going to get interesting.

If you haven't already read it, spend a few minutes following the articles at:

http://www.knujon.com/news/

After you report your spam to SpamCop ... zip it all and upload it to KnujOn. If you plan any legal action -- or have an interest in jumping on the class action band wagon later, then KEEP those zip files of spam. They will become important.

Thanks. Been there, doing that (as a paid KnujOn member). In the case at hand, the perps are quasi-legit and have been using the same hosting for many years, so there is no question of where they were operating and when.

-- rick