jodell 0 Posted December 21, 2013 Am trying to find out is why I receive WEEKLY spams from IP 123.58.178.204 : zyxu[at]corp.netease.com -- but when I report them I get the SpamCop message that "ISP has indicated spam will cease; ISP has resolved this issue....' This has happened EVERY week for two months -- and when I go to check the IP on Senderbase, the IP has been removed from the blacklist. So, I continue to get spammed every week, but no long-term blacklisting seems to occur. Can anyone explain why this cyclic phenomenon occurs? Thanks, Jim Share this post Link to post Share on other sites
SpamCopAdmin 0 Posted December 21, 2013 I removed the flag from the IP and disabled reports to the ISP. That should allow the IP to list as it should. - Don D'Minion - SpamCop Admin - - Service[at]Admin.SpamCop.net - Share this post Link to post Share on other sites
jodell 0 Posted December 21, 2013 (edited) Thanks, Don.What I don't understand is that 1) I receive (Chinese) multiple spams from this exact same IP EVERY Friday (IP 123.58.178.204 : zyxu[at]corp.netease.com) 2) it gets blacklisted 3) then gets quickly removed with a message: "ISP has indicated spam will cease; ISP has resolved this issue....' 4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday. So, in conclusion, the spams do not cease, yet they get removed from the blocklist in less than 12 hours. Could you help me understand why spam continue weekly even though SpamCop indicates "spam will cease". Thanks. Regards, Jim Odell Edited December 21, 2013 by jodell Share this post Link to post Share on other sites
Derek T 0 Posted December 21, 2013 (edited) 4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday. By SpamCop's time-scale that's perfectly normal. The SCBL is VERY dynamic, quick to list and quick to de-list. A whole week later might as well be a year later. The spam has indeed ceased: for a week! This is a 'by-design' feature of the SCBL. Try using extra lists, less-forgiving ones. There are many lists with many different algorithms and rules. SC aims to list very soon after a spew starts and delist soon after it stops. An IP sending spam spews once a week will repeatedly list and de-list. That's not a problem, that's exactly how it is designed to work. Come to think of it, why not put the IP on your own personal blacklistt and have done? Edited December 21, 2013 by Derek T Share this post Link to post Share on other sites
jodell 0 Posted December 21, 2013 (edited) Thanks, Derek, for helping me understand better: the inner workings of SC. -Jim Edited December 21, 2013 by jodell Share this post Link to post Share on other sites
petzl 0 Posted December 22, 2013 Thanks, Derek, for helping me understand better: the inner workings of SC. -Jim SpamCop look-up sometimes get abuse address's wrong I use (windows) look-up programs http://www.nirsoft.net/utils/ipnetinfo.html http://www.gena01.com/win32whois/ Both freeware 123.58.178.204 You can manually add reports to ip[at]cnisp.org.cn ALSO Checking IP: 123.58.178.204... Name: mproxyhzb4.163.com IP: 123.58.178.204 Domain: 163.com Querying whois.abuse.net for 163.com... mailto:spam[at]ccert.edu.cn (for 163.com) mailto:abuse[at]12321.cn (for 163.com) mailto:nsadmin[at]corp.netease.com (for 163.com) in Notes add http://spamcop.net/w3m?action=checkblock&a...=123.58.178.204 Other hosts in this "neighborhood" with spam reports 123.58.177.208 123.58.178.16 123.58.178.17 123.58.178.18 123.58.178.19 123.58.178.51 123.58.178.52 123.58.178.60 123.58.178.105 123.58.178.116 123.58.178.122 123.58.178.153 123.58.178.154 123.58.178.158 123.58.178.159 123.58.178.160 123.58.178.161 123.58.178.162 123.58.178.240 Share this post Link to post Share on other sites