Jump to content

Report spam from blacklisted origins?


flipper
 Share

Recommended Posts

I don't think it quite works that way - but another take on the situation is that fresh reports (age at time of reporting) help keep the offending IP address on the BL for as long as the spam spew continues. Otherwise it might keep dropping out to annoy the "community" for as long as it takes to get relisted.

Link to comment
Share on other sites

I don't think mail admins pay any attention to volume. Either they are whitehat and react immediately to a spamcop report or they ignore them totally. I imagine that while several spamcop reports in a row might get attention quicker, the odds of your sending those is probably not good.

As Farelf says the blocklist needs feeding to keep a spewing source blocked. I don't know how much volume counts in the algorithym for listing time. It certainly doesn't hurt to report.

It does take time to report spam. People have various techniques to keep the time reasonable. Some people only report the most recent 10 (the highest likelihood of being unreported by others and also the highest likelihood of extending listing time by showing spew is still coming) Some don't bother with anything over 4 hours old since it is the time the spam was sent that is counted by the blocklist as when the spew has stopped. Some only report pump and dump. Some only report those not caught by the filter(s).

Basically whatever criteria keeps you reporting and not giving up because it takes too long is the best criteria. It is impossible to know whether the spam you report is the first or last. I did a manual notify once where I was the first and wasn't believed that something was compromised until there were several other people also notifying. That did something for my morale that reporting really does work, but that's once out of how many hundreds, thousands?

Miss Betsy

Link to comment
Share on other sites

volume counts in the algorithym for listing time. It certainly doesn't hurt to report.

"volume" contribures to one factor in the ration of traffic seen/reported ....

reporting stops, the ratio changes, the tippong pont to delisting is reached, IP address falls off the list, spew (could) starts flowing again ... then the tipping point for listing has to be reached again ...

If spew is continuing, then continued reporting will 'keep' the IP address listed

... (within the limits of the ratio again)

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...