gary856 Posted April 18, 2007 Share Posted April 18, 2007 I've received the same spam from a particular ip on 3/27/07, 4/10/07, 4/11/07, and again today. Every time I submit it to Spamcop, I always get the same message, "ISP has indicated spam will cease", each time with a different date. It is the same message from the same spammer going out through the same IP address each time. Here's the latest: http://www.spamcop.net/sc?id=z1281589625zc...82bd942906e000z Unfortunately I don't have report id's for the older ones, since no reports were filed: Submitted: Wednesday, April 11, 2007 11:37:09 -0700: Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY) No reports filed Submitted: Tuesday, April 10, 2007 19:49:50 -0700: Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY) No reports filed Submitted: Tuesday, April 10, 2007 11:34:31 -0700: Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY) No reports filed How many chances does SC give an ISP? If an ISP gets relisted within a certain period of time, doesn't that count against them with a heavier weight? Shouldn't SC handle subsequent delisting requests wth a certain amount of skepticism? Link to comment Share on other sites More sharing options...
Wazoo Posted April 18, 2007 Share Posted April 18, 2007 Each Report has a set of options for the ISP/Host/whoever to select from in response to that Report. In the scenario of the complaint being about an spew from an IP address, there is the 'OK, it's going to stop' checkbox, which then basically sets a 24 hour clock on receivng more Reports ... the point being, that id this ISP is now aware of the issue, has taken steps, why continue to bombard them? Looking at SenderBase data at http://www.senderbase.org/search?searchBy=...g=204.15.74.178 there is the appearance that something has in fact happened .... (thought there might be other reasons ..???) Volume Statistics for this IP Magnitude Vol Change vs. Average Last day ......... 1.6 .. -100% Last 30 days ... 3.7 ... 343% Average ......... 3.1 On the other hand, even your "no reports sent" scenario feeds into setting of that background data (for Reputation Points), not generating enough statistics for a SpamCopDNSBL listing, and even notfication of that ISP/Host ... 90 day history on "that same IP address" ... 3 reports sent on 11 April 1 on 14 April 1 on 17 Apr The 'action taken' seems to have happened within three hours of that first (and only) Report .... Link to comment Share on other sites More sharing options...
gary856 Posted April 18, 2007 Author Share Posted April 18, 2007 I'm not "bombarding" them, we are only talking about less than a dozen messages. But, they keep coming back. And this is happening over a period of several weeks, not just several hours. Again today I got another one: http://www.spamcop.net/sc?id=z1282131773z5...de0e9243acd5daz Looks like they are now getting picked up by other blacklists: http://psbl.surriel.com/listing?ip=204.15.74.178 http://www.spamcannibal.org/cannibal.cgi?p...p=204.15.74.178 http://www.sorbs.net/lookup.shtml?204.15.74.178 http://www.emailbasura.org/cgi-bin/consult...l?204.15.74.178 Link to comment Share on other sites More sharing options...
Telarin Posted April 18, 2007 Share Posted April 18, 2007 Looks like they are now getting picked up by other blacklists: http://psbl.surriel.com/listing?ip=204.15.74.178 http://www.spamcannibal.org/cannibal.cgi?p...p=204.15.74.178 http://www.sorbs.net/lookup.shtml?204.15.74.178 http://www.emailbasura.org/cgi-bin/consult...l?204.15.74.178 Yep, thats what happens when an ISP ignores the early warning lists like spamcop. Some of those are going to be MUCH harder to get off than if they had really fixed their problem when spamcop sent the first reports. Link to comment Share on other sites More sharing options...
Wazoo Posted April 18, 2007 Share Posted April 18, 2007 18 APR 2007 1443 GMT-5 http://www.senderbase.org/search?searchBy=...g=204.15.74.178 Volume Statistics for this IP Magnitude Vol Change vs. Average Last day ........ 4.8 .. 4757% Last 30 days .. 3.8 .... 346% Average ........ 3.1 Yep, must have been something else ... Link to comment Share on other sites More sharing options...
daveyrosen Posted October 3, 2008 Share Posted October 3, 2008 Never saw this before: For the past month whenever I report a longtime spammer, Spamcop doesn't accept it. Instead it says: "ISP has indicated spam will cease; ISP resolved this issue sometime after <Fri Oct 3 14:44:02 2008 -0700>" -- The date it was "resolved" always is the same date the spam was received. Has this spammer somehow found a way to trick Spamcop into no longer accepting reports against him? He's actually been increasing the frequency of his spams. Link to comment Share on other sites More sharing options...
turetzsr Posted October 3, 2008 Share Posted October 3, 2008 Hi, daveyrosen, ...When I went to the top of the page and entered "ISP has indicated spam will cease" into the text box between the "Search for -->" button and the blue "GO" button and then clicked on one of those buttons, I got several hits, including for SpamCop Forum thread "ISP has indicated spam will cease?." Have you read that thread? Does it help? Edit: Former post number 9810 was moved here by the Forum administrator after I replied to daveyrosen's original post. Link to comment Share on other sites More sharing options...
Wazoo Posted October 3, 2008 Share Posted October 3, 2008 Never saw this before: This post merged into just one of many existing Topics/Discussion about the same subject. As Steven mentions, there is a reason those mulyiple Search tools are right at the top of the screen. PM sent to advise of the actions taken on this "new" post. Link to comment Share on other sites More sharing options...
monty python Posted November 19, 2008 Share Posted November 19, 2008 How many times does an ISP get to say that spam will stop before it becomes clear the ISP is the spammer. I report them - they say they will stop it starts again - here is a little collection since I started noticing this behavior: postmaster[at]thecolosite.com bounces (165 sent : 83 bounces) Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking. ISP has indicated spam will cease; ISP resolved this issue sometime after Tuesday, November 18, 2008 5:48:54 PM -0500 Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking. ISP has indicated spam will cease; ISP resolved this issue sometime after Wednesday, November 12, 2008 10:02:38 AM -0500 Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking. ISP has indicated spam will cease; ISP resolved this issue sometime after Sunday, November 09, 2008 1:07:35 PM -0500 Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking. ISP has indicated spam will cease; ISP resolved this issue sometime after Thursday, October 23, 2008 7:49:53 PM -0400 Link to comment Share on other sites More sharing options...
Farelf Posted November 19, 2008 Share Posted November 19, 2008 How many times does an ISP get to say that spam will stop before it becomes clear the ISP is the spammer....A fraught subject - the SC staff 'keep an eye' on ISP claims and I guess it depends on the volumes seen thereafter (and some UBErs perhaps 'snowshoe' to avoid trip points). What is/are the IP address(s)? That ISP has just the one which is apparently/clearly disreputable: http://www.robtex.com/ip/67.209.135.230.html [on edit] Hmmm ... and a couple of SpamCannibal hits: http://www.robtex.com/ip/208.76.97.129.html http://www.robtex.com/ip/208.76.102.95.html All of those are low volume, hard to get listed unless they hit a spamtrap. [on further edit] And ... it looks like many of the rest are on spam.dnsbl.sorbs.net though SenderBase sees no volume from them at all. That list is sort of like a spamtrap-triggered hit but listings are long-term. Link to comment Share on other sites More sharing options...
monty python Posted November 19, 2008 Share Posted November 19, 2008 Thanks - they are all in the 208.76.97.xxx range Link to comment Share on other sites More sharing options...
Farelf Posted November 19, 2008 Share Posted November 19, 2008 Thanks - they are all in the 208.76.97.xxx rangeOkay, (low) volume is what's working against listing, even without the "spam will cease" intervention. Reputation score filtering would probably pick them up but they sneak under the radar for most other methodologies, by the look of it. Except for the fearsome sorbs spam list (though that is supposedly configurable for those not wanting to filter out quite the whole internet). Anyway, the IP range seems quite limited so I suppose most could filter on that. The full list seen by SenderBase is at http://www.senderbase.org/senderbase_queri...thecolosite.com - just 25 addresses. Unless whoever is using that network to spam becomes more ambitious, I don't think they are ever going to come on the radar, generally. Probably the 'snowshoe' thing. Another approach would be to send manual reports but it looks like those might bounce a bit. And the ISP might be complicit anyway. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.