MrT Posted October 4, 2006 Share Posted October 4, 2006 I just tried to report spam received just this minute and got a message on the spamcop reporting page that said in part (and in context): --------------- Tracking message source: 210.141.40.227: Routing details for 210.141.40.227 [refresh/show] Cached whois for 210.141.40.227 : ike[at]enjoy.ad.jp murakami[at]enjoy.ad.jp Using last resort contacts ike[at]enjoy.ad.jp murakami[at]enjoy.ad.jp ISP has indicated spam will cease; ISP resolved this issue sometime after Wednesday, 4 October 2006 8:50:29 PM +1000 Message is 0 hours old 210.141.40.227 not listed in dnsbl.njabl.org 210.141.40.227 not listed in dnsbl.njabl.org 210.141.40.227 not listed in cbl.abuseat.org 210.141.40.227 listed in dnsbl.sorbs.net ( 127.0.0.2 ) 210.141.40.227 is an open proxy 210.141.40.227 not listed in accredit.habeas.com 210.141.40.227 not listed in plus.bondedsender.org 210.141.40.227 not listed in iadb.isipp.com ========== I looked up the ip address and it's not listed in spamcop and only listed in dnsbl.sorbs.net on the ironport page. How long do they give the ISP to respond. Obviously the spammer is still operating but I can't report it to spamcop. Any ideas - or am I missing something? Link to comment Share on other sites More sharing options...
Farelf Posted October 4, 2006 Share Posted October 4, 2006 ...How long do they give the ISP to respond. Obviously the spammer is still operating but I can't report it to spamcop. Any ideas - or am I missing something? If you search on the "ISP has indicated spam will cease" phrase you will find a heap of prior discussion. Here's one http://forum.spamcop.net/forums/index.php?...ost&p=26015 - usually it boils down to the spam being sent before the promised action date - but if they're fudging and you have a paid account you may appeal, as said in the referenced post by StevenUnderwood. Link to comment Share on other sites More sharing options...
MrT Posted October 5, 2006 Author Share Posted October 5, 2006 Thanks, Farelf. I should have done a search first Link to comment Share on other sites More sharing options...
Farelf Posted December 27, 2006 Share Posted December 27, 2006 I am growing uneasy over the answer I supplied. For instance http://www.spamcop.net/sc?id=z1177639898z4...847b39ef68f70cz where the spam originated well after the nominated "sometime after ..." date-time, the IP address still had an hour to run and apparently delisted right on schedule. Reports were blocked in this instance yet (a little while after delisting) Report on IP address: 208.111.64.50 Volume Statistics for this IP Magnitude Vol Change vs. Average Last day 4.2 4838% Last 30 days 3.2 389% Average 2.5 Okay, there is some lag in the SenderBase stats but even when (fresh) reports are accepted and a spamrun is in process and the IP address is timing down, those fresh reports appear not to make a skerrick of difference to the timedown. I can imagine some delay has been built into the whole process but if (free) reporters are so little trusted ....? Anyway, I repudiate the answer I gave and am calling the topic unresolved. The original query remains How long do they give the ISP to respond. Obviously the spammer is still operating but I can't report it to spamcop. Link to comment Share on other sites More sharing options...
Wazoo Posted December 27, 2006 Share Posted December 27, 2006 Ancient dialog with Ellen about this ... the "ISP has handled it" flag on a spam-source IP address would turn off the report-sending function for 24 hours. The next spam submittal that was recognized as being sent after that window would start the re-sending of the reports. The 'ancient' part of this actually has me wondering if this conversation took place before the SpamCopDNSBL existed ??? Looking at your sample, the 24 hours wasn't quite met ... so still within the 24 hour window. On the other hand, the "would send" comments include the remarks "statistics only" so the appearance would be that the SpamCopDNSBL would still have been fed. Of course, those 'new' numbers/reports would be offset by the folks that didn't see/report the spam sent/received while the IP address was listed (which also may feed back into why the IP address now shows as not listed ....????) One could expect that with the SenderBase numbers still so high, not listed now, your sample arriving on the cusp of the 24-window, this IP address will get re-listed pretty quickly. Sorry I couldn't send you to the FAQ, but .. this is non-published information. Oh well. Link to comment Share on other sites More sharing options...
Farelf Posted December 27, 2006 Share Posted December 27, 2006 ... Sorry I couldn't send you to the FAQ, but .. this is non-published information. Oh well. Link to comment Share on other sites More sharing options...
StevenUnderwood Posted June 15, 2007 Share Posted June 15, 2007 http://www.spamcop.net/sc?id=z1327257923z7...8755b18611a574z Another example of a report where I am unable to report or request a review (which I usually do not do anyway. Link to comment Share on other sites More sharing options...
Wazoo Posted June 15, 2007 Share Posted June 15, 2007 http://www.spamcop.net/sc?id=z1327257923z7...8755b18611a574z Another example of a report where I am unable to report or request a review (which I usually do not do anyway. Could go with an active abuse desk on this one ...???? only one report showing in history; Submitted: Friday, June 15, 2007 7:07:35 AM -0500: Re: HEY 2335503045 ( 208.187.165.26 ) To: postmaster[at]lanset.com 2335503039 ( 208.187.165.26 ) To: abuse[at]lanset.com 2335503016 ( 208.187.165.26 ) To: abuse[at]support.eli.net which does fit wih the Parsing output detail of; ISP has indicated spam will cease; ISP resolved this issue sometime after Friday, June 15, 2007 11:19:04 AM -0500 Going with the "24 hour" flag setting anyway ... Link to comment Share on other sites More sharing options...
StevenUnderwood Posted June 15, 2007 Share Posted June 15, 2007 I agree and was only posting to include some newer data. Too sad this is a rare occurance Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.