Same ISP has indicated spam will cease -- weekly

[jodell 0]

Am trying to find out is why I receive WEEKLY spams from IP 123.58.178.204 : zyxu[at]corp.netease.com -- but when I report them I get the SpamCop message that "ISP has indicated spam will cease; ISP has resolved this issue....' This has happened EVERY week for two months -- and when I go to check the IP on Senderbase, the IP has been removed from the blacklist. So, I continue to get spammed every week, but no long-term blacklisting seems to occur. Can anyone explain why this cyclic phenomenon occurs?

Thanks,

Jim

[SpamCopAdmin 0]

I removed the flag from the IP and disabled reports to the ISP. That should allow the IP to list as it should.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

[jodell 0]

Thanks, Don.What I don't understand is that

1) I receive (Chinese) multiple spams from this exact same IP EVERY Friday (IP 123.58.178.204 : zyxu[at]corp.netease.com)

2) it gets blacklisted

3) then gets quickly removed with a message: "ISP has indicated spam will cease; ISP has resolved this issue....'

4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday.

So, in conclusion, the spams do not cease, yet they get removed from the blocklist in less than 12 hours.

Could you help me understand why spam continue weekly even though SpamCop indicates "spam will cease".

Thanks.

Regards,

Jim Odell

Edited December 21, 2013 by jodell

[Derek T 0]

4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday.

By SpamCop's time-scale that's perfectly normal. The SCBL is VERY dynamic, quick to list and quick to de-list. A whole week later might as well be a year later. The spam has indeed ceased: for a week! This is a 'by-design' feature of the SCBL. Try using extra lists, less-forgiving ones. There are many lists with many different algorithms and rules. SC aims to list very soon after a spew starts and delist soon after it stops. An IP sending spam spews once a week will repeatedly list and de-list. That's not a problem, that's exactly how it is designed to work.

Come to think of it, why not put the IP on your own personal blacklistt and have done?

Edited December 21, 2013 by Derek T

[jodell 0]

Thanks, Derek, for helping me understand better: the inner workings of SC.

-Jim

Edited December 21, 2013 by jodell

[petzl 0]

Thanks, Derek, for helping me understand better: the inner workings of SC.

-Jim

SpamCop look-up sometimes get abuse address's wrong

I use (windows) look-up programs

http://www.nirsoft.net/utils/ipnetinfo.html

http://www.gena01.com/win32whois/

Both freeware

123.58.178.204

You can manually add reports to

ip[at]cnisp.org.cn

ALSO

Checking IP: 123.58.178.204...

Name: mproxyhzb4.163.com

IP: 123.58.178.204

Domain: 163.com

Querying whois.abuse.net for 163.com...

mailto:spam[at]ccert.edu.cn (for 163.com)

mailto:abuse[at]12321.cn (for 163.com)

mailto:nsadmin[at]corp.netease.com (for 163.com)

in Notes add

http://spamcop.net/w3m?action=checkblock&a...=123.58.178.204

Other hosts in this "neighborhood" with spam reports

123.58.177.208 123.58.178.16 123.58.178.17 123.58.178.18 123.58.178.19 123.58.178.51 123.58.178.52 123.58.178.60 123.58.178.105 123.58.178.116 123.58.178.122 123.58.178.153 123.58.178.154 123.58.178.158 123.58.178.159 123.58.178.160 123.58.178.161 123.58.178.162 123.58.178.240