Jump to content
Sign in to follow this  
jodell

Same ISP has indicated spam will cease -- weekly

Recommended Posts

Am trying to find out is why I receive WEEKLY spams from IP 123.58.178.204 : zyxu[at]corp.netease.com -- but when I report them I get the SpamCop message that "ISP has indicated spam will cease; ISP has resolved this issue....' This has happened EVERY week for two months -- and when I go to check the IP on Senderbase, the IP has been removed from the blacklist. So, I continue to get spammed every week, but no long-term blacklisting seems to occur. Can anyone explain why this cyclic phenomenon occurs?

Thanks,

Jim

Share this post


Link to post
Share on other sites

I removed the flag from the IP and disabled reports to the ISP. That should allow the IP to list as it should.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

Share this post


Link to post
Share on other sites

Thanks, Don.What I don't understand is that

1) I receive (Chinese) multiple spams from this exact same IP EVERY Friday (IP 123.58.178.204 : zyxu[at]corp.netease.com)

2) it gets blacklisted

3) then gets quickly removed with a message: "ISP has indicated spam will cease; ISP has resolved this issue....'

4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday.

So, in conclusion, the spams do not cease, yet they get removed from the blocklist in less than 12 hours.

Could you help me understand why spam continue weekly even though SpamCop indicates "spam will cease".

Thanks.

Regards,

Jim Odell

Edited by jodell

Share this post


Link to post
Share on other sites

4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday.

By SpamCop's time-scale that's perfectly normal. The SCBL is VERY dynamic, quick to list and quick to de-list. A whole week later might as well be a year later. The spam has indeed ceased: for a week! This is a 'by-design' feature of the SCBL. Try using extra lists, less-forgiving ones. There are many lists with many different algorithms and rules. SC aims to list very soon after a spew starts and delist soon after it stops. An IP sending spam spews once a week will repeatedly list and de-list. That's not a problem, that's exactly how it is designed to work.

Come to think of it, why not put the IP on your own personal blacklistt and have done?

Edited by Derek T

Share this post


Link to post
Share on other sites

Thanks, Derek, for helping me understand better: the inner workings of SC.

-Jim

:D

Edited by jodell

Share this post


Link to post
Share on other sites

Thanks, Derek, for helping me understand better: the inner workings of SC.

-Jim

:D

SpamCop look-up sometimes get abuse address's wrong

I use (windows) look-up programs

http://www.nirsoft.net/utils/ipnetinfo.html

http://www.gena01.com/win32whois/

Both freeware

123.58.178.204

You can manually add reports to

ip[at]cnisp.org.cn

ALSO

Checking IP: 123.58.178.204...

Name: mproxyhzb4.163.com

IP: 123.58.178.204

Domain: 163.com

Querying whois.abuse.net for 163.com...

mailto:spam[at]ccert.edu.cn (for 163.com)

mailto:abuse[at]12321.cn (for 163.com)

mailto:nsadmin[at]corp.netease.com (for 163.com)

in Notes add

http://spamcop.net/w3m?action=checkblock&a...=123.58.178.204

Other hosts in this "neighborhood" with spam reports

123.58.177.208 123.58.178.16 123.58.178.17 123.58.178.18 123.58.178.19 123.58.178.51 123.58.178.52 123.58.178.60 123.58.178.105 123.58.178.116 123.58.178.122 123.58.178.153 123.58.178.154 123.58.178.158 123.58.178.159 123.58.178.160 123.58.178.161 123.58.178.162 123.58.178.240

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×