Jump to content

ISP has indicated spam will cease?


MrT
 Share

Recommended Posts

I just tried to report spam received just this minute and got a message on the spamcop reporting page that said in part (and in context):

---------------

Tracking message source: 210.141.40.227:

Routing details for 210.141.40.227

[refresh/show] Cached whois for 210.141.40.227 : ike[at]enjoy.ad.jp murakami[at]enjoy.ad.jp

Using last resort contacts ike[at]enjoy.ad.jp murakami[at]enjoy.ad.jp

ISP has indicated spam will cease; ISP resolved this issue sometime after Wednesday, 4 October 2006 8:50:29 PM +1000

Message is 0 hours old

210.141.40.227 not listed in dnsbl.njabl.org

210.141.40.227 not listed in dnsbl.njabl.org

210.141.40.227 not listed in cbl.abuseat.org

210.141.40.227 listed in dnsbl.sorbs.net ( 127.0.0.2 )

210.141.40.227 is an open proxy

210.141.40.227 not listed in accredit.habeas.com

210.141.40.227 not listed in plus.bondedsender.org

210.141.40.227 not listed in iadb.isipp.com

==========

I looked up the ip address and it's not listed in spamcop and only listed in dnsbl.sorbs.net on the ironport page.

How long do they give the ISP to respond. Obviously the spammer is still operating but I can't report it to spamcop.

Any ideas - or am I missing something?

Link to comment
Share on other sites

...How long do they give the ISP to respond. Obviously the spammer is still operating but I can't report it to spamcop.

Any ideas - or am I missing something?

If you search on the "ISP has indicated spam will cease" phrase you will find a heap of prior discussion. Here's one http://forum.spamcop.net/forums/index.php?...ost&p=26015 - usually it boils down to the spam being sent before the promised action date - but if they're fudging and you have a paid account you may appeal, as said in the referenced post by StevenUnderwood.
Link to comment
Share on other sites

  • 2 months later...

I am growing uneasy over the answer I supplied. For instance http://www.spamcop.net/sc?id=z1177639898z4...847b39ef68f70cz where the spam originated well after the nominated "sometime after ..." date-time, the IP address still had an hour to run and apparently delisted right on schedule. Reports were blocked in this instance yet (a little while after delisting)

Report on IP address: 208.111.64.50

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day 4.2 4838%

Last 30 days 3.2 389%

Average 2.5

Okay, there is some lag in the SenderBase stats but even when (fresh) reports are accepted and a spamrun is in process and the IP address is timing down, those fresh reports appear not to make a skerrick of difference to the timedown. I can imagine some delay has been built into the whole process but if (free) reporters are so little trusted ....?

Anyway, I repudiate the answer I gave and am calling the topic unresolved. The original query remains

How long do they give the ISP to respond. Obviously the spammer is still operating but I can't report it to spamcop.
Link to comment
Share on other sites

Ancient dialog with Ellen about this ... the "ISP has handled it" flag on a spam-source IP address would turn off the report-sending function for 24 hours. The next spam submittal that was recognized as being sent after that window would start the re-sending of the reports.

The 'ancient' part of this actually has me wondering if this conversation took place before the SpamCopDNSBL existed ???

Looking at your sample, the 24 hours wasn't quite met ... so still within the 24 hour window. On the other hand, the "would send" comments include the remarks "statistics only" so the appearance would be that the SpamCopDNSBL would still have been fed. Of course, those 'new' numbers/reports would be offset by the folks that didn't see/report the spam sent/received while the IP address was listed (which also may feed back into why the IP address now shows as not listed ....????) One could expect that with the SenderBase numbers still so high, not listed now, your sample arriving on the cusp of the 24-window, this IP address will get re-listed pretty quickly.

Sorry I couldn't send you to the FAQ, but .. this is non-published information. Oh well.

Link to comment
Share on other sites

  • 5 months later...
http://www.spamcop.net/sc?id=z1327257923z7...8755b18611a574z

Another example of a report where I am unable to report or request a review (which I usually do not do anyway.

Could go with an active abuse desk on this one ...???? only one report showing in history;

Submitted: Friday, June 15, 2007 7:07:35 AM -0500:

Re: HEY

2335503045 ( 208.187.165.26 ) To: postmaster[at]lanset.com

2335503039 ( 208.187.165.26 ) To: abuse[at]lanset.com

2335503016 ( 208.187.165.26 ) To: abuse[at]support.eli.net

which does fit wih the Parsing output detail of;

ISP has indicated spam will cease; ISP resolved this issue sometime after Friday, June 15, 2007 11:19:04 AM -0500

Going with the "24 hour" flag setting anyway ...

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...