Jump to content

Same ISP has indicated spam will cease -- weekly


jodell
 Share

Recommended Posts

Am trying to find out is why I receive WEEKLY spams from IP 123.58.178.204 : zyxu[at]corp.netease.com -- but when I report them I get the SpamCop message that "ISP has indicated spam will cease; ISP has resolved this issue....' This has happened EVERY week for two months -- and when I go to check the IP on Senderbase, the IP has been removed from the blacklist. So, I continue to get spammed every week, but no long-term blacklisting seems to occur. Can anyone explain why this cyclic phenomenon occurs?

Thanks,

Jim

Link to comment
Share on other sites

Thanks, Don.What I don't understand is that

1) I receive (Chinese) multiple spams from this exact same IP EVERY Friday (IP 123.58.178.204 : zyxu[at]corp.netease.com)

2) it gets blacklisted

3) then gets quickly removed with a message: "ISP has indicated spam will cease; ISP has resolved this issue....'

4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday.

So, in conclusion, the spams do not cease, yet they get removed from the blocklist in less than 12 hours.

Could you help me understand why spam continue weekly even though SpamCop indicates "spam will cease".

Thanks.

Regards,

Jim Odell

Edited by jodell
Link to comment
Share on other sites

4) but the spam does not cease, because I will receive more Chinese spams from the same IP on the following Friday.

By SpamCop's time-scale that's perfectly normal. The SCBL is VERY dynamic, quick to list and quick to de-list. A whole week later might as well be a year later. The spam has indeed ceased: for a week! This is a 'by-design' feature of the SCBL. Try using extra lists, less-forgiving ones. There are many lists with many different algorithms and rules. SC aims to list very soon after a spew starts and delist soon after it stops. An IP sending spam spews once a week will repeatedly list and de-list. That's not a problem, that's exactly how it is designed to work.

Come to think of it, why not put the IP on your own personal blacklistt and have done?

Edited by Derek T
Link to comment
Share on other sites

Thanks, Derek, for helping me understand better: the inner workings of SC.

-Jim

:D

SpamCop look-up sometimes get abuse address's wrong

I use (windows) look-up programs

http://www.nirsoft.net/utils/ipnetinfo.html

http://www.gena01.com/win32whois/

Both freeware

123.58.178.204

You can manually add reports to

ip[at]cnisp.org.cn

ALSO

Checking IP: 123.58.178.204...

Name: mproxyhzb4.163.com

IP: 123.58.178.204

Domain: 163.com

Querying whois.abuse.net for 163.com...

mailto:spam[at]ccert.edu.cn (for 163.com)

mailto:abuse[at]12321.cn (for 163.com)

mailto:nsadmin[at]corp.netease.com (for 163.com)

in Notes add

http://spamcop.net/w3m?action=checkblock&a...=123.58.178.204

Other hosts in this "neighborhood" with spam reports

123.58.177.208 123.58.178.16 123.58.178.17 123.58.178.18 123.58.178.19 123.58.178.51 123.58.178.52 123.58.178.60 123.58.178.105 123.58.178.116 123.58.178.122 123.58.178.153 123.58.178.154 123.58.178.158 123.58.178.159 123.58.178.160 123.58.178.161 123.58.178.162 123.58.178.240

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...