Jump to content

ISP does not wish to receive reports regarding http://www.


karlisma

Recommended Posts

http://www.spamcop.net/sc?id=z1006867017zd...822cd953b6d246z

spamvertisment and spam is from the same source.... so what do we do now?

You could send manual reports if you are so inclined. It is possible that they are working on this problem and have enough reports, or maybe they do not care.

I would still not cancel the report, like it looks like you did, so it can feed the blocklist.

Link to comment
Share on other sites

...spamvertisment and spam is from the same source.... so what do we do now?
Network reputation currently shows them at an estimated 12.4 million spam per day, not surprising they refuse reports. https://nssg.trendmicro.com/nrs/reports/rank.php?page=3 [No 72 and rising (as CPCHOSTING-NET at the time of post)]. SenderBase gives them a daily magnitude of 6.8 http://www.senderbase.org/search?searchBy=...ng&oaNum=10

They show up as the highest /24 block on http://www.spamcop.net/w3m?action=map;net=...35;sort=spamcnt currently. They don't seem to feature on the spam ratio listings though - SpamCop is seeing about 2/3 non-spam (or not reported) on that block.

If they won't accept SC reports you can send a manual report - there could be some point to it (being charitable about it). Should keep submitting to SC anyway, to keep them on the BL.

[sp]

Link to comment
Share on other sites

Well, don't know if you run your own mail server or not, but in my case, any IP block that refuses reports or has no reporting addresses gets added to the global Deny list. Problem solved.

i do not own a server.

i do not wish to send anyway, as i care not to be listed (listwashed/confirmed.... whatever it's called).

asking same question again: how can I choose to report it to SC but not to "report" to them?

Link to comment
Share on other sites

i do not own a server.

i do not wish to send anyway, as i care not to be listed (listwashed/confirmed.... whatever it's called).

asking same question again: how can I choose to report it to SC but not to "report" to them?

Just hit the send reports button....ISP's that "refuse reports" are sent to the bit bucket automatically but are added to the count.

Link to comment
Share on other sites

Just hit the send reports button....ISP's that "refuse reports" are sent to the bit bucket automatically but are added to the count.

I know:

but this is special situtaion i think - look closely:all three reports (2 for spamvertised site and 1 for e-mail source) are going to ONE SAME address abuse[at]cpchosting.net....

they are not interested that they are being spamvertizers, but they still accept mail abuse report.

So, What to DO? :ph34r: Seems to me .... a bit too scary :)

Link to comment
Share on other sites

I know:

but this is special situtaion i think - look closely:all three reports (2 for spamvertised site and 1 for e-mail source) are going to ONE SAME address abuse[at]cpchosting.net....

they are not interested that they are being spamvertizers, but they still accept mail abuse report.

So, What to DO? :ph34r: Seems to me .... a bit too scary :)

If you are worried about it, uncheck that box. Are you having problems unchecking the boxes and hitting the submit reports button? I just tested and would have been able to hit the button. It was a valid email so I did not.

Link to comment
Share on other sites

...they are not interested that they are being spamvertizers, but they still accept mail abuse report.

So, What to DO? :ph34r: Seems to me .... a bit too scary :)

They know they are are spamvertizers already, no need to be told their spam advertizes their websites. Unlike most, their ownership is there to see and their infrastructure investment is exposed. Your concern about whitelisting is possibly realistic (they may be a litle more concerned about their "reputation" :P than most). If all non-mole reporters refrain from reporting and if cpchosting.net actually do go to the bother of removing reporters as a result of reports they will then only get reported if they hit spamtraps. Just do (or don't) whatever you're comfortable with, you probably have enough opinion (and one or two facts) on which to make a decision.
Link to comment
Share on other sites

Nobody has mentioned 'going up stream' so perhaps that is not an option. I don't know very much about 'upstream' since most of it is beyond my expertise. What it means is finding whoever provides for cphosting.

If the reports are going to devnull, then nobody sees them (except the spamcop bl for the source IP address) so I wouldn't worry about being listwashed.

If the source IP is on the scbl, then no one who uses the scbl will know about the spamvertized site so reports don't need to be sent about the spamvertized site - which, in this case, seems pretty useless anyway.

Miss Betsy

Link to comment
Share on other sites

Nobody has mentioned 'going up stream' so perhaps that is not an option. I don't know very much about 'upstream' since most of it is beyond my expertise. What it means is finding whoever provides for cphosting. ...
I don't know much about it either, but as shown in the SenderBase link I included in my earlier post, the cpchosting.net domain is hosted by CPC Hosting, so the network owner is the same. Contact details are readily found.

Balance of Miss Betsy's post repeated to keep it proximate.

If the reports are going to devnull, then nobody sees them (except the spamcop bl for the source IP address) so I wouldn't worry about being listwashed.

If the source IP is on the scbl, then no one who uses the scbl will know about the spamvertized site so reports don't need to be sent about the spamvertized site - which, in this case, seems pretty useless anyway.

Miss Betsy

Link to comment
Share on other sites

If you are worried about it, uncheck that box. Are you having problems unchecking the boxes and hitting the submit reports button? I just tested and would have been able to hit the button. It was a valid email so I did not.

incomplete test, Steve.

If all boxes are unchecked, of course, I can hit the button.... Only the particular report stays as unreported.

Link to comment
Share on other sites

incomplete test, Steve.

If all boxes are unchecked, of course, I can hit the button.... Only the particular report stays as unreported.

OK. But then in this case you shouldhave been able to leave the check mark on:

Re: 204.11.102.24 (Third party interested in email source)

spamcop[at]imaphost.com

And gotten the report through unless you don't like them either.

If that also does not work, your only option would be mole reporting which is not currently worth too much.

Link to comment
Share on other sites

OK. But then in this case you shouldhave been able to leave the check mark on:And gotten the report through unless you don't like them either.

If that also does not work, your only option would be mole reporting which is not currently worth too much.

http://www.spamcop.net/sc?id=z1011970243zf...9fd7a5c568cb85z

So where is the imaphost now?

And - is it worth to report to "parked hostnames" . You sure know who might own them.... :)

No chekmarks - report stays in queue.

Ok - let there be, i can still try the third party of your's. Good, You have it.

Link to comment
Share on other sites

I think I lost your meaning here but I will answer what I think you are asking. imaphost is a company called CYVEILLANCE that requested a copy of all reports and is paying for the bandwidth to support that request. All of my reports go to them but some people do not trust them. You can search the forums here to get the full story.

Link to comment
Share on other sites

I think I lost your meaning here but I will answer what I think you are asking. imaphost is a company called CYVEILLANCE that requested a copy of all reports and is paying for the bandwidth to support that request. All of my reports go to them but some people do not trust them. You can search the forums here to get the full story.

The meaning is: where and how do i report spam source if:

1. it is the same as spamvertised site (the firs tracking link).

2. it is in my opinion untrusted (this last example being to parked domainname).

so it leaves any trace in blocking list.

P.S. Does reporting to CYVEILLANCE (which many don't trust, he he he:)) mean that report adds any mening for BL?

Link to comment
Share on other sites

The meaning is: where and how do i report spam source if:

1. it is the same as spamvertised site (the firs tracking link).

2. it is in my opinion untrusted (this last example being to parked domainname).

so it leaves any trace in blocking list.

P.S. Does reporting to CYVEILLANCE (which many don't trust, he he he:)) mean that report adds any mening for BL?

As you described earlier, unless you are willing to send the report somewhere, then you can not add the IP to the bl. Users being allowed to add to the bl without sending reports anywhere could be an opening for abuse of the system. The reports are the checks and balances in this system. When addresses bounce, or are found unreliable, the deputies can change those reporting addresses so they are internal only.

Your P.S. It does not add any meaning except you may be able to send the report and add to the BL.

An avenue you may wish to pursue since you seem worried about this is mole reporting. However, as last reported, these reports are given a weight of 0 in the bl formula. Also remember, you are not required to report every spam that you see. Perhaps, if you are worried about a specific spam, you should simply cancel the report.

Link to comment
Share on other sites

As you described earlier, unless you are willing to send the report somewhere, then you can not add the IP to the bl. Users being allowed to add to the bl without sending reports anywhere could be an opening for abuse of the system. The reports are the checks and balances in this system. When addresses bounce, or are found unreliable, the deputies can change those reporting addresses so they are internal only.

Your P.S. It does not add any meaning except you may be able to send the report and add to the BL.

An avenue you may wish to pursue since you seem worried about this is mole reporting. However, as last reported, these reports are given a weight of 0 in the bl formula. Also remember, you are not required to report every spam that you see. Perhaps, if you are worried about a specific spam, you should simply cancel the report.

aha. Clear. Problem solved :)

just-a-quote: I would still not cancel the report, like it looks like you did, so it can feed the blocklist.

(See post #2, same topic)

Link to comment
Share on other sites

aha. Clear. Problem solved :)

just-a-quote: I would still not cancel the report, like it looks like you did, so it can feed the blocklist.

(See post #2, same topic)

Glad we worked through that.

My quote was when I thought you could uncheck the boxes and submit the message without sending reports. You later tested and determined that did not work, leading me to think why it would be set that way. Abuse of the system was the most likely reason I could come up with.

Link to comment
Share on other sites

Glad we worked through that.

My quote was when I thought you could uncheck the boxes and submit the message without sending reports. You later tested and determined that did not work, leading me to think why it would be set that way. Abuse of the system was the most likely reason I could come up with.

:wub:

you really don't think, that I AM an abuser, do You?

Link to comment
Share on other sites

...An avenue you may wish to pursue since you seem worried about this is mole reporting. However, as last reported, these reports are given a weight of 0 in the bl formula. ...
Correct, mole reports have, quite recently, been further devalued. "Fresh" mole reports used to directly extend time in the BL for an IP already listed but not now. This has improved the integrity of the reporting system I am sure - but it makes mole reporting very nearly pointless, except perhaps as a self-imposed learning mode for the timorous (which is a valuable enough aspect, IMO).
Link to comment
Share on other sites

incomplete test, Steve.

If all boxes are unchecked, of course, I can hit the button.... Only the particular report stays as unreported.

If you don't uncheck the box that says the source IP (which is the one that goes to devnull), then it will be an effective report since devnull reports feed the scbl.

You can uncheck the spamvertized site reports that might alert cphosting to listwash you.

Miss Betsy

Link to comment
Share on other sites

If you don't uncheck the box that says the source IP (which is the one that goes to devnull), then it will be an effective report since devnull reports feed the scbl.

You can uncheck the spamvertized site reports that might alert cphosting to listwash you.

repeat the link: http://www.spamcop.net/sc?id=z1006867017zd...822cd953b6d246z

which one, dear Miss, is going to devnull?

I see none. If I press [send spam Reports Now].

If I cancel, it goes to cancelled[at]devnull.spamcop.net. Does this have a meaning? (to BL etc.?)

Link to comment
Share on other sites

... If I cancel, it goes to cancelled[at]devnull.spamcop.net. Does this have a meaning? (to BL etc.?)
No it doesn't, that wasn't the devnull Miss Betsy was talking about (which would be more like postmaster#cpchosting.net[at]devnul.spamcop.net). For the report to count you submit the IP report, refer back
Just hit the send reports button....ISP's that "refuse reports" are sent to the bit bucket automatically but are added to the count.
Check or uncheck as it suits you whichever boxes you have after the first one. But if you cancel the report page all action is concluded, the incident is not counted against the IP. Your link currently says

"If reported today, reports would be sent to:

Re: 204.11.102.24 (Administrator of IP block - statistics only)"

which means if submitted and is clearly not the same as a report to an ISP which accepts reports - but note the statistics are incremented (admittedly only implied by that message but Steven Underwood wouldn't lie to you, now would he?).

Link to comment
Share on other sites

I didn't see the original tracking URL and this one doesn't show anything except that the reports were cancelled.

However, the source IP, if the box is checked and is reported, always is counted on the scbl, no matter where the reports are sent. If the admin has indicated it doesn't want reports, the report will go to 'devnull' (which I understand is, or was, code for delete). Reports to devnull are included on the scbl. (an aside - the comments are generic - there could be many reasons why the admin is not going to get reports)

Reports to Spamvertised sites, if unchecked, go nowhere.

(an aside, there is an interesting thread in the newsgroups about making reports spamvertised sites not the default configuration for reporting. IOW, if you want to report spamvertised sites, you have to check the boxes. The argument for reporting spamvertised sites is that, on rare occasions, the reports do go to a web host who will do something and that reports help feed a blocklist devoted to blocking by spamvertised site.)

I don't have time to go back and read the whole thread, but if the source IP report (the first time you reported it) was not going to 'devnull' and you do not want to report it because it was going to the same address as the spamvertised site, you can call that to the deputies' attention. If they have time to investigate it, they will do something about it. Unfortunately, they usually only have time for those cases where the sender has done all the work (which requires a lot more expertise than I have). (another aside - does anyone know if spamcop.routing is still active?)

If the reports to the source IP were not going to devnull, then you do take a chance on being listwashed if the reports are going to the same source as the spamvertised websites. On the other hand, if it is so totally blackhat, then it will be on the blocklists that are not automatic and will not be coming off those lists. The same for the spamvertised sites (an aside - there is a blocklist totally devoted to spamvertised sites. It does feed from spamcop reports). And many admins will have it on their private blocklists. So it doesn't make much difference in the total scheme of blocking if you are listwashed.

(another aside - there was a news article quoting Julian on 'picture' spam. Picture spam is increasing rapidly - perhaps because the spamvertised site blocklists do work? It is a constant battle of wits. If the picture spam starts to get past filters, then perhaps more admins will start blocking on IP addresses or, more probably, it will be more difficult for legitimate users to send pictures by email).

HTH

Miss Betsy

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...