ebizcraftsman Posted October 1, 2004 Share Posted October 1, 2004 Hello, My ip was put on spamcorp... I just want to find out what I can do to remove it.. In the last 24 hours, I have had 3 accounts setup on my server with thieves using stolen paypal accounts... Once the account is setup, the immediately upload the software for spam mail.. I caught two immediately, but the 3rd was able to send out over 65,000 messages... My instant account setup was removed.. So now it will not happen again.. My ip address is 65.254.35.90 .. Please check into this and you will see I am telling the truth.. Spammers are now gone.. Link to comment Share on other sites More sharing options...
dbiel Posted October 1, 2004 Share Posted October 1, 2004 Hello, My ip was put on spamcorp... I just want to find out what I can do to remove it.. In the last 24 hours, I have had 3 accounts setup on my server with thieves using stolen paypal accounts... Once the account is setup, the immediately upload the software for spam mail.. I caught two immediately, but the 3rd was able to send out over 65,000 messages... My instant account setup was removed.. So now it will not happen again.. My ip address is 65.254.35.90 .. Please check into this and you will see I am telling the truth.. Spammers are now gone.. 18074[/snapback] Report on IP address: 65.254.35.90 Volume Statistics for this IP Magnitude Vol Change vs. Average Last day 4.9 34689% Last 30 days 3.4 1135% Average 2.3 Looks like you understated your problem You may want to look a bit deeper Link to comment Share on other sites More sharing options...
StevenUnderwood Posted October 1, 2004 Share Posted October 1, 2004 IF the reports have stopped (which as far as I can see they stopped about 8:30 this morning), the IP will drop off the list within 48 hours of that last report. There is a complex formula used to computer when the IP is released. The deputies<at>spamcop.net can give you an exact time IF no more reports are received for newer spm runs. They can also see the reports in real time which we as ordinary users do not usually see. That being said, thank you for cleaning up the spammers as quickly as possible. And thank you for removing the instant account setup. While I don't run a service like this, I would imagine an automatic throttling of outgoing messages for new accounts would be a good idea until the customer has earned some trust. It would limit the amount of damage a new user could cause and bring your attention to it before 65000 messages hit the internet. Link to comment Share on other sites More sharing options...
Derek T Posted October 1, 2004 Share Posted October 1, 2004 Hello, My ip was put on spamcorp... I just want to find out what I can do to remove it.. In the last 24 hours, I have had 3 accounts setup on my server with thieves using stolen paypal accounts... Once the account is setup, the immediately upload the software for spam mail.. I caught two immediately, but the 3rd was able to send out over 65,000 messages... My instant account setup was removed.. So now it will not happen again.. My ip address is 65.254.35.90 .. Please check into this and you will see I am telling the truth.. Spammers are now gone.. 18074[/snapback] To answer your question (though this information is readily available in the FAQs) both listing and de-listing are entirely automatic. If the spam really has stopped you will be de-listed between 1.5 and 48 hrs after the last report. You need do nothing except secure your server. Link to comment Share on other sites More sharing options...
Merlyn Posted October 1, 2004 Share Posted October 1, 2004 Have you reported these Hijacked/Stolen Pay Pal accounts to the FBI? Identity theft is a federal offense. They could use all the information you have from the sites to the spam. Link to comment Share on other sites More sharing options...
ebizcraftsman Posted October 1, 2004 Author Share Posted October 1, 2004 WAIT... JUST HAD ANOTHER SIGNUP... The instant account feature is turned off, but how do I know if this i legit or not??? Here is the information : Clients Local IP: Ordered from IP: 24.188.65.98 - - Click to Trace only captured on orders that go through order system Clients Local ISP: IP traced back to: ool-18bc4162.dyn.optonline.net anygrillhere.com carluis88uj[at]camklik.com is the signup email... PAYPAL INFORMATION : Mean-Shing Goal just signed up for a subscription to ENTERPRISE SHARED [anygrillhere.com]. casper_goal[at]qwest.net's first subscription payment, for $10.99 USD has already been sent to your PayPal account. The email used to signup does not work.. I think this is a spammer.. Can anyone assist me ASAP so I know if I need to delete or setup Link to comment Share on other sites More sharing options...
louisd Posted October 1, 2004 Share Posted October 1, 2004 WAIT... JUST HAD ANOTHER SIGNUP... The instant account feature is turned off, but how do I know if this i legit or not??? 18099[/snapback] Sorry to be harsh but it sounds to me that you need to reconsider the business that you are in. If you can't discern legitimate customers from scammers, you shouldn't be accepting any customers. Link to comment Share on other sites More sharing options...
DavidT Posted October 1, 2004 Share Posted October 1, 2004 carluis88uj[at]camklik.com is the signup email... That domain doesn't exist, so that should be the end of the story...you don't accept orders from false addresses, do you? Mean-Shing Goal just signed up for a subscription to ENTERPRISE SHARED There's no such name as "Mean-Shing" anywhere in the world, according to my quick searching. casper_goal This person actaully does seem to exist. There's a person using that email id (with a different domain) mentioned at this URL: http://www.freetech.com/u.s.a/1where-to-buy.html He works (or worked) at "EQ PRODUCTS INC." of Phoenix, AZ, which makes his "qwest.net" address logical, in that they're the local telco here. You could write to his Qwest address and to the address found on that page above and find out if the "carluis" address given was a typo...although, if he meant to enter "camclick.com" instead of "camklik.com" then you have a different problem.... DT Link to comment Share on other sites More sharing options...
Merlyn Posted October 1, 2004 Share Posted October 1, 2004 1.) gethostbyname: camklik.com failed.... 2.) 'whois -h whois.internic.net camklik.com' (Whois Error, gethostbyname(whois.internic.net)) That should be your first red flag! If you want to continue to do this then you must be able to verify your new customers. Seems as if you are now marked as an easy target. Good Luck. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.