Jump to content

Spamcop report response


Recommended Posts

Just got the following from a report I sent out. Supposedly, the ticket was open for only about 1.25 hours before resolution.

The server in question was hosting a user that unfortunately had an old formmail scri_pt that was exploited by a formmail attack. The scripts have been removed, the IP's blocked from the server and a filter has been put in place to drop these messages in the future. Thank you for notifying us of this problem.

It's nice getting these. Not only a response on what happened, but how they cleaned up, and an actual thanks on helping to point out the problem. If this is genuine (and I have no reason to suspect otherwise, I wish more companies were like this.


Link to comment
Share on other sites

Looks like the IP was  The tracking URL looks to be http://www.spamcop.net/sc?id=z673911137zd1...971da3351078d6z.

Sorry for the lag in response (it's been a busy day) and not including that info in the first place (no real excuse for that :)).



I'm also far behind in my abuse tasks. I think the abuse desk for liquidweb.com should be noticed:

Parsing input:

host = underworld.liquidweb.com. (cached)

Reporting addresses:


Well done!

Link to comment
Share on other sites

Well, it looks like even our famous kornet may eventually take some action:

This is Kornet Abuse Operating Center.

In response of your request, we inform you that Kornet has solved the problem of suspicious activity from our network.

we informed our customer of his illegal activity and requested to fixing a this problem.

In future if it will try again, we will not service to this customer from our network.

Related IP :

If you have any further question,

please contact us kams-3522956-1-rep[at]abuse.kornet.net or http://abuse.kornet.net/

Thank you.

Link to comment
Share on other sites

It's nice getting these.  Not only a response on what happened, but how they cleaned up, and an actual thanks on helping to point out the problem.  If this is genuine (and I have no reason to suspect otherwise, I wish more companies were like this.

We always acknowledge reports for the domains we manage. I consider it a common courtesy to let a reporter know what is happening.

Thankfully, our customers don't spam - or at least any that do are quickly dealt with. The reports we receive are therefore few and far between and invariably innocent bystander type reports where a spammer has taken a domain and included it within their Email to tie up the rporting processes.

So it isn't a major effort to acknowledge and thank for the reports we receive. I can imagine, though, that a large ISP hosting many domains might find the task rather overwhelming :blink:


Link to comment
Share on other sites

PS. Can someone correct <<resonce>> in the title of this thread?

PS2. Thanks Wazoo for the prompt action!  ;)


Eh, like I said, it was a busy day. (And right before vacation -- just got back! :)) Normally I'm a bit better on the spell checking though...

Add another thanks for the spelling correction.


Link to comment
Share on other sites

  • 1 year later...
wow... that's something I never thought I'd see. I wonder if we'll be seeing more of these.
Well, nearly - a mere 2 years later, it was addressed to me but seems to be directed to a spamvertizer(?) and I didn't send this particular complaint to Kornet in the first place, as far as I can tell (I have sent manual reports to them but none with these particular referrents). Maybe they're just telling me it is not a valid complaint, but they tried (the Korean text could be interpreted that way, going by BabelFish). Well, I didn't make the complaint anyway.
From: kams-15-20060901157640-1-rep[at]abusemail.kornet.net

Subject: 민원 반송 처리 메일


내용이 불충분하여 반송 처리되었습니다.

http://abuse.kornet.net으로 접속하시면 웹으로 신고하실 수 있습니다.

원문 : Dear ISP

This is an unwanted email from IP:

Please take appropriate actions to stop it.

If this mail is a legal newsletter ,

please help to remove the recipient from your mailing list .

If this spam report has any problem , please DO NOT reply directly , and

use this page to tell us



Best Regards,

AntiSpam Team in Taiwan - softworking


The information below should be all you need.

X-POP3-Rcpt: backup[at]leadcorp.com.tw

Received: from ([])

by host102.apollohosting.com ( with SMTP id k7RAw4jQ024036

for ; Sun, 27 Aug 2006 06:58:15 -0400

Message-Id: <200608271058.k7RAw4jQ024036[at]host102.apollohosting.com>

From: "¸¨??¤F¡I"

Subject: ²{?b°_¡A§A?i?H¨M?w??¤vªº??¤J,,??¿?¾???¤vªº¤u§[at]??¶¡?a?I.........................?uªº???²³æ

Date: Sun, 27 Aug 2006 18:58:07 +0800

MIME-Version: 1.0

Content-Type: multipart/alternative;



Content-Type: text/html;

Content-Transfer-Encoding: quoted-printable


[lots of whitespace]







Anyway, it is not so nice to invite listwashing instead of taking the big stick to the perpetrators (I would like to see their foetid remains strewn in pliable strands over several acres of the mosses and brackens of the tundra, but that's just me). Maybe "legal newsletters" just means complaint from valid but forgetful subscribers. They munge when they provide enough detail to stipulate the sender anyway (msg ID) which seems a little strange. Or maybe it was (poorly) munged before they got it.
Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Create New...