jodell Posted December 21, 2013 Share Posted December 21, 2013 Am trying to find out is why I receive WEEKLY spams from IP 123.58.178.204 : zyxu[at]corp.netease.com -- but when I report them I get the SpamCop message that "ISP has indicated spam will cease; ISP has resolved this issue....' This has happened EVERY week for two months -- and when I go to check the IP on Senderbase, the IP has been removed from the blacklist. So, I continue to get spammed every week, but no long-term blacklisting seems to occur. Can anyone explain why this cyclic phenomenon occurs? Thanks, Jim Link to comment Share on other sites More sharing options...
SpamCopAdmin Posted December 21, 2013 Share Posted December 21, 2013 I removed the flag from the IP and disabled reports to the ISP. That should allow the IP to list as it should. - Don D'Minion - SpamCop Admin - - Service[at]Admin.SpamCop.net - Link to comment Share on other sites More sharing options...
jodell Posted December 21, 2013 Author Share Posted December 21, 2013 Thanks, Don.What I don't understand is that 1) I receive (Chinese) multiple spams from this exact same IP EVERY Friday (IP 123.58.178.204 : zyxu[at]corp.netease.com) 2) it gets blacklisted 3) then gets quickly removed with a message: "ISP has indicated spam will cease; ISP has resolved this issue....' 4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday. So, in conclusion, the spams do not cease, yet they get removed from the blocklist in less than 12 hours. Could you help me understand why spam continue weekly even though SpamCop indicates "spam will cease". Thanks. Regards, Jim Odell Link to comment Share on other sites More sharing options...
Derek T Posted December 21, 2013 Share Posted December 21, 2013 4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday. By SpamCop's time-scale that's perfectly normal. The SCBL is VERY dynamic, quick to list and quick to de-list. A whole week later might as well be a year later. The spam has indeed ceased: for a week! This is a 'by-design' feature of the SCBL. Try using extra lists, less-forgiving ones. There are many lists with many different algorithms and rules. SC aims to list very soon after a spew starts and delist soon after it stops. An IP sending spam spews once a week will repeatedly list and de-list. That's not a problem, that's exactly how it is designed to work. Come to think of it, why not put the IP on your own personal blacklistt and have done? Link to comment Share on other sites More sharing options...
jodell Posted December 21, 2013 Author Share Posted December 21, 2013 Thanks, Derek, for helping me understand better: the inner workings of SC. -Jim Link to comment Share on other sites More sharing options...
petzl Posted December 22, 2013 Share Posted December 22, 2013 Thanks, Derek, for helping me understand better: the inner workings of SC. -Jim SpamCop look-up sometimes get abuse address's wrong I use (windows) look-up programs http://www.nirsoft.net/utils/ipnetinfo.html http://www.gena01.com/win32whois/ Both freeware 123.58.178.204 You can manually add reports to ip[at]cnisp.org.cn ALSO Checking IP: 123.58.178.204... Name: mproxyhzb4.163.com IP: 123.58.178.204 Domain: 163.com Querying whois.abuse.net for 163.com... mailto:spam[at]ccert.edu.cn (for 163.com) mailto:abuse[at]12321.cn (for 163.com) mailto:nsadmin[at]corp.netease.com (for 163.com) in Notes add http://spamcop.net/w3m?action=checkblock&a...=123.58.178.204 Other hosts in this "neighborhood" with spam reports 123.58.177.208 123.58.178.16 123.58.178.17 123.58.178.18 123.58.178.19 123.58.178.51 123.58.178.52 123.58.178.60 123.58.178.105 123.58.178.116 123.58.178.122 123.58.178.153 123.58.178.154 123.58.178.158 123.58.178.159 123.58.178.160 123.58.178.161 123.58.178.162 123.58.178.240 Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.