Jump to content

Is it really doing any good?


wlwesq

Recommended Posts

I agree with Miss Betsy that ISPs should offer a 'fixit' plan. When you suspend customers, they cannot connect to the Internet to download security tools. Therefore it is not surprising that their machines are still infected when they are allowed to reconnect. I think that ISPs should disconnect compromised machines from the public Internet and should connect them to an internal 'fixit' network, where basically all ports are blocked and all http requests are redirected to a site where the customer can download antivirus software, trojan removers, security updates, and so on.

Link to comment
Share on other sites

  • Replies 271
  • Created
  • Last Reply

So, yeah, there's proof that SpamCop is really making a difference....  Keep up the great work. :D

24737[/snapback]

ok, youre ONE ISP. I get spam from 10-15 who are regular offenders. rr.com chinanet.com, cnc-noc.com, kornet.net, hanaro.com, bjtelecom.com, several variations of .cn's and .ru's... the occasional comcast and others I cannot recall at the moment. is it these isp's really don't care or are as porous as a strainer when it comes to preventing spam?

do you reply to reports informing the reporter that you took action? I cannot recall the last time I got a report back saying that.

I just wanna know it's REALLY making a difference, as it sure doesn't feel that way when I don't see a bit of difference in my in baskets...

Link to comment
Share on other sites

I just wanna know it's REALLY making a difference, as it sure doesn't feel that way when I don't see a bit of difference in my in baskets...

24747[/snapback]

I've never been a paid member of spamcop, so I don't know what kinds of reports you recieve in that event.

I have, however, been sending reports out my door to ISPs daily (averaging 50 per day) reports. I recieve about 1-3 replies a week, that don't seem to be automated, regarding my reports.

I rather enjoyed this one:

Bonjour,

Nous contactons actuellement notre client afin qu il

resolve au plus vite le probleme.

Merci de nous avoir signale le probleme.

Cordialement,

-------------

Hello,

We're contacting our customer to resolve the probleme on his

network.

Thank you for reporting to us this problem.

Regards,

-------------------------------------------------------------------------

Type of Abuse: spam Mail,IP=62.23.87.78, 26 Feb 2005 02:38:45 +0400

Offenders IP: 62.23.87.78

Date of Offence: Sat, 26 Feb 2005 02:38:45 +0400

Anti-virus software may help prevent this type of abuse.

Here are a few free anti-virius solutions you may want to

inform your customers:

  AVG 7.0 Free edition (for home users):

  http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

  Microsoft's "Spy-ware" tool:

  http://www.microsoft.com/athome/security/s...re/default.mspx

  Calmwin free anti-virus software for everyone:

  http://www.clamwin.com/

Offending E-mail:

>From - Thu Feb 24 13:45:10 2005

....

Link to comment
Share on other sites

I have never been a paying member because I wanted to see results before I paid. obviously not many people seem all that interested in the ineffectiveness of the system, so either it's working for most everyone else or it's not reallya concern. I noticed that two-three years ago when I signed up for the email newsgroup and made a statement there about it. people said "give it time" and "trust the process" so I have, but its been three years from that point and four years altogether and I still see the same ISP's letting spam thru. am I simply missing the point of reporting ???

Link to comment
Share on other sites

Other, bigger ISPs are coming around... they're finally starting to realize that it's costing them money if they don't act on it... you'll notice some ISPs in the UK are considering charging customers for bandwidth used instead of by speed (1.5Mb, 3Mb, 5Mb, 8Mb, etc). Instead, you'll buy transfer packages of 15Gb, 30 Gb, 80 Gb, etc... The volume of bits being transferred is finally putting a strain on networks, and cutting out the spam will significantly impact ISPs. It's becoming cost effective for ISPs, so that's why it's starting to make a difference.

Link to comment
Share on other sites

does spamcop really work at all unless you subscribe to an email account???

24723[/snapback]

The answer is yes it does work but you need to implement a full process of filtering bassed on the block list and probably several blocklists.

The SpamCop mail account works well for me. I get very few spam messages - perhaps 1 or 2 a month at most - into my mailbox but my filtered mail folder fills on a daily basis.

So just reporting alone helps those who are more pro-active (thanks for doing it) but as you surmise some additional tools make it more effective in the receiving end.

I use the SpamCop Email account because it is cost-effective for me. You could implement the same filtering regime on a server for yourself and achieve a similar result.

If, though, your questions is does the reporting process get rid of spammers then I guess the answer is no, not really. Some go, others come. Some are inconvenienced but kost just make alternative arrangements.

Andrew

Link to comment
Share on other sites

thanks for the reply.

your assumption is correct. submittals alone do not seem to be effective. I was lead to bleiev years ago when I first started to submit, that it would make a difference. I vowed to start supporting SC when I saw a change. but over time, I noticed that all the same ISP continue to allow spam to flow freely from their origins, and web sites hosting links seemingly ignored the fact that spammers were using their sites. well he last was obvious-duh, they're making $$$! and I expected foreign country ISP such as china would ignore the reports as well.

I guess saying "ignore" is too lose a term. nobody replies to my reports anymore. haven't seena report response in at least a year, and I easily report 20-30 pieces of spam a day MINIMUM. most spam goes to a yahoo email account, of which I expected to be a target. sorta like viruses and microsoft. big targets are easy. but the interesting thing was the other accounts. the two excite accounts I report from have a steady stream of spam. a couple of pieces on friday-monday each day and virtually nothing mid week. same with my work email and my home ISP. I pretty much discount what my work ISP allows thru because at least they're using Postini...

it's just frustrating. to volunteer all this time to reporting and to see no results. arg

Link to comment
Share on other sites

Given the amount of spam I report, I tend to not fill in the 'notes' box, especially the ones from China, Korea and S. America.  The only time I do fill it in is to report attempted frauds, such as '419', Phishing and Lotto scams. Does anyone believe a report is taken more seriously if it is?

11911[/snapback]

you are not alone, trisha.

Link to comment
Share on other sites

The only time I do fill it in is to report attempted frauds, such as '419', Phishing and Lotto scams. Does anyone believe a report is taken more seriously if it is?

Probably not. If they are getting lots of spam reports, they probably simply count them - if they do anything.

OTOH, a manual report to the reporting addresses might be taken more seriously - particularly if it is a really timely one.

Miss Betsy

Link to comment
Share on other sites

the irony of all this is, I actually started reporting spam from three other email accounts just to see if SC would make a difference after having this thread discussed on the newsgroup. the newsgroup folks panned the discussion there. nice to see nobody seems to care to hear that reporting may not actually be doing any good. :o

Link to comment
Share on other sites

You might want to identify "your" newsgroup thread ..??? I don'y know what you want at this point. The SpamCop Parsing and Reporting tool is just that, a tool. Having your spam stop after a single complaint would suggest that your complaint went to an ISP that took action, and you had a beginner spammer that learned quickly that this type of "marketing" isn't acceptable. As you've noticed, the majority of spam these days doesn't fit this profile.

For those ISPs that care, your reports count. For those ISPs that don't care, your reports count for the SpamCopDNSbl listing. This list is available for use, by you, by your ISP .... If your ISP isn't using it, if you haven't availed yourself of readily available software (free and/or paid) .. then no, you probably won't see any direct benefit.

I manually report the majority of my spam, going beyond the SpamCop identified targets, but I don't see much more than auto-acks from most ISPs. And even the "we took action" responses seem to be a waste of time and space most days ... a response frm rr.com that they "handled" a previous complaint is totally offset when I'm in the middle of sending off another half-dozen complaints coming from other compromised systems on the rr.com network.

But the most obvious answer to the "is it doing any good" is noting all the work being done to try to outwit the SpamCop toolset. Obviously, if SpamCop had no effect, you wouldn't have spammers reading here and the newsgroups to see what works, what doesn't, and even applying new "solutions" based on the analysis offered up in these discussions.

Link to comment
Share on other sites

Here's a reply I received from Easynet UK, after I queried about my reporting style.

This may shed some light on why reporting is good.

On Sat, Feb 26, 2005 at 05:46:18PM -0500, Joe Brown wrote:

>> Hi,

>>

>> I'm glad you appreciate my reporting.  I hope that my reports are not

>> too excessive and that you find them adequatly informative.

Hi Joe

Your report was excellent, and contained the information needed in

order for us to take effective action.  A worrying trend is that many

Unsolicited Bulk Email recipients appear to no longer report spam

received; this greatly cuts down our and other providers' ability to

identify and deal with abuse related to our networks.

Please keep reporting spam, it really is appreciated.

Kind regards

Anthony Edwards

--

Easynet UK Abuse Team - Easynet Ltd

Link to comment
Share on other sites

You might want to identify "your" newsgroup thread ..???  I don'y know what you want at this point.  The SpamCop Parsing and Reporting tool is just that, a tool.  Having your spam stop after a single complaint would suggest that your complaint went to an ISP that took action, and you had a beginner spammer that learned quickly that this type of "marketing" isn't acceptable.  As you've noticed, the majority of spam these days doesn't fit this profile.

For those ISPs that care, your reports count.  For those ISPs that don't care, your reports count for the SpamCopDNSbl listing.  This list is available for use, by you, by your ISP .... If your ISP isn't using it, if you haven't availed yourself of readily available software (free and/or paid) .. then no, you probably won't see any direct benefit.

I manually report the majority of my spam, going beyond the SpamCop identified targets, but I don't see much more than auto-acks from most ISPs.  And even the "we took action" responses seem to be a waste of time and space most days ... a response frm rr.com that they "handled" a previous complaint is totally offset when I'm in the middle of sending off another half-dozen complaints coming from other compromised systems on the rr.com network.

But the most obvious answer to the "is it doing any good" is noting all the work being done to try to outwit the SpamCop toolset.  Obviously, if SpamCop had no effect, you wouldn't have spammers reading here and the newsgroups to see what works, what doesn't, and even applying new "solutions" based on the analysis offered up in these discussions.

24872[/snapback]

wazoo, thanks for the the reply. I don't know how you find the time to do all the work you do in this forum, I certainly have never seen such a place where an "admin" does so much work to keep the place organized and following the rules.

having said that, my issue is plain and simple: I have been reporting for several years. I added several other email accounts to report simply to see if the level of spam ever drops. it hasn't. in addition, the SAME ISP's are the ones I report to: as I stated in previous portions of this thread. , yeah rr.com is one of them. I don't even get ANY acknolegments back for my spam reports, I cannot recall the last response I received.

I guess the bottom line is SC helps, but it's not the sure fire answer. I am just a bit dismayed by that becase it touts itself as being a way to stop spam. well, only if you pay and get yet another email account from SC.

I am sorry to see that reports obviously go ignored. all those china ISP's, obviously. I guess even legislation in the US won't help that tide of crap from outsie the country.

my problem is it's a time issue. I can continue to spend my "spare" time reporting everything I get in the hopes it helps somehow, but I certainly do not have the time to put in that kind of effort. I actually started submitting manually to see if I could contribute to the cause, but then I noticed it didn't appear to be doing what I thought it was.

as for ID'ing the thread, that would take some time. it was two or so years ago when I asked the same question and all I got back was snide resonses as though I had kicked someone's trike in the mud. there is a fine line between doing a process well and doing a process well and not accepting constructive criticism and being able to rationally discuss something technical with someone who isn't technical. noboy on the thread back then was able to do that, it was as though we'd blasphemed the SC gods that could do no wrong.

I do not profess to understand the ether, I am just one of many who thought doing something might help but simply questioned the value of it all ot the individual. it appears this is a collective effort, which is appreciated, but the majority of the email users in this world simply do not have the time or effort to do manual reports day in and day out. I suspect I spend an hour a day, and I am wondering if I can continue when all it seems to be doing is getting worse.

thanks for YOUR time and effort, when I was younger, I had such energy. now, its family and friends and school that fill my time.

Link to comment
Share on other sites

Maybe by looking at it from another angle might help. Spamcop does reduce the amount of spam greatly for those that run their own mail servers and use the Spamcop blocklist or if their ISP/Email administrator uses the Spamcop blocklist. Each report that causes another spammy IP to get on the blocklist is helping tens of thousands to keep more spam from their inboxes. I believe we must be as persistent in reporting spam as the spammers are in sending it.

Just my 2 cents.

Link to comment
Share on other sites

I don't thing the parsing and reporting portion of spamcop claims to stop spam. If you have reference to that, please point it out to me.

There are three seperate parts to the spamcop "family".

a.The spamcop parsing and reporting service takes spam and finds out where the source is and sends reports to those ISP's that wish to receive those reports. Reporting can be free or paid to get more features.

b.The spamcop blocking list counts those reports and uses that information to list or delist IP addresses currently sending spam as reported by users of a. above and their own spamtrap addresses. This service is free and helps to reduce spam when used to refuse or redirect spam from the end users inbox. This service can be used by servers or end user accounts depending on need.

c.The spamcop email system uses the b. blocking list in addition to other blocking lists and content scanners to redirect spam away from the users inbox. It also makes using a. easier and includes a paid reporting account with the fee.

You are free to use any or all of these but only the use of b. (in some way) will significantly reduce the amount of spam seen in the inbox. Service a. may stop the amature spammer and helps keep the interested ISP's informed, but there is nothing spamcop can do to MAKE the ISP's respond or the professional spammer stop what he is doing.

Link to comment
Share on other sites

Maybe by looking at it from another angle might help.  Spamcop does reduce the amount of spam greatly for those that run their own mail servers and use the Spamcop blocklist or if their ISP/Email administrator uses the Spamcop blocklist. Each report that causes another spammy IP to get on the blocklist is helping tens of thousands to keep more spam from their inboxes. I believe we must be as persistent in reporting spam as the spammers are in sending it.

Just my 2 cents.

25029[/snapback]

that still doesn't help :P

seriously, It is clear that the reports are only as valuable as those recieveing them treat them. it seems pretty obvious to me (as Underwood states) that reporting alone won't do it. I believe underwood has answered my question. it IS a waste of time to report if one simply expects to see some sort of drop in spam at their email box.

"SpamCop is the premier service for reporting spam. SpamCop determines the origin of unwanted email and reports it to the relevant Internet service providers. By reporting spam, you have a positive impact on the problem. Reporting unsolicited email also helps feed spam filtering systems, including, but not limited to, SpamCop's own service. "

When I first saw that statement over 4 years ago, it lead me to BELIEVE it would help. we'll obviously it's helped, but not directly to me. I guess I just need to stop reporting all these ISP's that continually come up as they ignore the reports, or to just stop wasting my time reporting.

Mr. Underwood, the IMPLICATION is there. I guess I'll go with some COTS program to stop spam and keep my existing email accounts. :blink:

Link to comment
Share on other sites

Globally, long-term, reporting spam helps to stop spammers (they certainly won't be stopped if no one reports them), and SpamCop is the best tool I've found to help in that reporting. On the other hand, spam is still on the increase globally because so many don't care to stop it. Use of the SCBL and all the other blocklists and blacklists in the SpamCop Email System (other than Korea) has helped me to keep huge amounts of spam out of my inbox.

Link to comment
Share on other sites

ok, youre ONE ISP.  I get spam from 10-15 who are regular offenders.  rr.com chinanet.com, cnc-noc.com, kornet.net, hanaro.com, bjtelecom.com, several variations of .cn's and .ru's... the occasional comcast and others I cannot recall at the moment.  is it these isp's really don't care or are as porous as a strainer when it comes to preventing spam?

do you reply to reports informing the reporter that you took action?  I cannot recall the last time I got a report back saying that.

I just wanna know it's REALLY making a difference, as it sure doesn't feel that way when I don't see a bit of difference in my in baskets...

24747[/snapback]

I get spam from 10-15 who are regular offenders. rr.com chinanet.com, cnc-noc.com, kornet.net,

Good point - is there another approach SC could take with the frequent offending ISPs?

Link to comment
Share on other sites

I get very little spam at my spamcop address. I have been using it for several years, and it has appeared on the net a *few* times. On my yahoo account, I get 20 to 100 spam a day -- even though I haven't sent a single message from that address in several years.

So, is it correct that users who forward through spamcop or POP-check other accounts with spamcop will continue to have more spam *sent* to their addresses than folk just using a spamcop address alone? If I were economizing my mail lists as a spammer, I would want to remove all addresses with "spam" in the name anywhere. This would weed out spamcop addresses *and* addresses that have had "spam" inserted in the address field somewhere.

If accurate, this would also mean that even if you use spamcop to fetch mail from another mailhost, you will not actually get sent less spam. Reporting spam would simply be a benevolent act that generally cuts spam levels across the net. As an individual user, you might never notice.

Greg Conquest

PS Are our e-mail addresses munged for these posts?

Link to comment
Share on other sites

Are our e-mail addresses munged for these posts?

If placed into the body of the message, they are not and need to be munged by hand. No information (other than screen name) are available to others from your forum configuration. Moderators also have the ability to see the IP address you post from.

Link to comment
Share on other sites

In addition to what StevenUnderwood wrote, Members can send other Members Email using the Forum software (only of the intended recipient hasn't checked "Hide my email address from other members" on the Email Settings Control Panel like you have), but they don't get to know the intended recipient's Email Address or IP Address unless the intended recipient replies.

Link to comment
Share on other sites

  • 2 weeks later...

Archived

This topic is now archived and is closed to further replies.


×
×
  • Create New...