Jump to content

ISP has indicated spam will cease, again


gary856
 Share

Recommended Posts

I've received the same spam from a particular ip on 3/27/07, 4/10/07, 4/11/07, and again today. Every time I submit it to Spamcop, I always get the same message, "ISP has indicated spam will cease", each time with a different date. It is the same message from the same spammer going out through the same IP address each time.

Here's the latest:

http://www.spamcop.net/sc?id=z1281589625zc...82bd942906e000z

Unfortunately I don't have report id's for the older ones, since no reports were filed:

Submitted: Wednesday, April 11, 2007 11:37:09 -0700:

Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY)

No reports filed

Submitted: Tuesday, April 10, 2007 19:49:50 -0700:

Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY)

No reports filed

Submitted: Tuesday, April 10, 2007 11:34:31 -0700:

Get Ink For Your Printer For Less (HURRY - LIMITED TIME ONLY)

No reports filed

How many chances does SC give an ISP? If an ISP gets relisted within a certain period of time, doesn't that count against them with a heavier weight? Shouldn't SC handle subsequent delisting requests wth a certain amount of skepticism?

Link to comment
Share on other sites

Each Report has a set of options for the ISP/Host/whoever to select from in response to that Report. In the scenario of the complaint being about an spew from an IP address, there is the 'OK, it's going to stop' checkbox, which then basically sets a 24 hour clock on receivng more Reports ... the point being, that id this ISP is now aware of the issue, has taken steps, why continue to bombard them?

Looking at SenderBase data at http://www.senderbase.org/search?searchBy=...g=204.15.74.178 there is the appearance that something has in fact happened .... (thought there might be other reasons ..???)

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ......... 1.6 .. -100%

Last 30 days ... 3.7 ... 343%

Average ......... 3.1

On the other hand, even your "no reports sent" scenario feeds into setting of that background data (for Reputation Points), not generating enough statistics for a SpamCopDNSBL listing, and even notfication of that ISP/Host ...

90 day history on "that same IP address" ...

3 reports sent on 11 April

1 on 14 April

1 on 17 Apr

The 'action taken' seems to have happened within three hours of that first (and only) Report ....

Link to comment
Share on other sites

I'm not "bombarding" them, we are only talking about less than a dozen messages. But, they keep coming back. And this is happening over a period of several weeks, not just several hours. Again today I got another one:

http://www.spamcop.net/sc?id=z1282131773z5...de0e9243acd5daz

Looks like they are now getting picked up by other blacklists:

http://psbl.surriel.com/listing?ip=204.15.74.178

http://www.spamcannibal.org/cannibal.cgi?p...p=204.15.74.178

http://www.sorbs.net/lookup.shtml?204.15.74.178

http://www.emailbasura.org/cgi-bin/consult...l?204.15.74.178

Link to comment
Share on other sites

Yep, thats what happens when an ISP ignores the early warning lists like spamcop. Some of those are going to be MUCH harder to get off than if they had really fixed their problem when spamcop sent the first reports.

Link to comment
Share on other sites

  • 1 year later...

Never saw this before: For the past month whenever I report a longtime spammer, Spamcop doesn't accept it. Instead it says:

"ISP has indicated spam will cease; ISP resolved this issue sometime after <Fri Oct 3 14:44:02 2008 -0700>"

-- The date it was "resolved" always is the same date the spam was received.

Has this spammer somehow found a way to trick Spamcop into no longer accepting reports against him? He's actually been increasing the frequency of his spams.

Link to comment
Share on other sites

Hi, daveyrosen,

...When I went to the top of the page and entered "ISP has indicated spam will cease" into the text box between the "Search for -->" button and the blue "GO" button and then clicked on one of those buttons, I got several hits, including for SpamCop Forum thread "ISP has indicated spam will cease?." Have you read that thread? Does it help?

Edit: Former post number 9810 was moved here by the Forum administrator after I replied to daveyrosen's original post.

Edited by turetzsr
Link to comment
Share on other sites

Never saw this before:

This post merged into just one of many existing Topics/Discussion about the same subject. As Steven mentions, there is a reason those mulyiple Search tools are right at the top of the screen.

PM sent to advise of the actions taken on this "new" post.

Link to comment
Share on other sites

  • 1 month later...

How many times does an ISP get to say that spam will stop before it becomes clear the ISP is the spammer.

I report them - they say they will stop it starts again - here is a little collection since I started noticing this behavior:

postmaster[at]thecolosite.com bounces (165 sent : 83 bounces)

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.

ISP has indicated spam will cease; ISP resolved this issue sometime after

Tuesday, November 18, 2008 5:48:54 PM -0500

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.

ISP has indicated spam will cease; ISP resolved this issue sometime after

Wednesday, November 12, 2008 10:02:38 AM -0500

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.

ISP has indicated spam will cease; ISP resolved this issue sometime after

Sunday, November 09, 2008 1:07:35 PM -0500

Using postmaster#thecolosite.com[at]devnull.spamcop.net for statistical tracking.

ISP has indicated spam will cease; ISP resolved this issue sometime after

Thursday, October 23, 2008 7:49:53 PM -0400

Link to comment
Share on other sites

How many times does an ISP get to say that spam will stop before it becomes clear the ISP is the spammer....
A fraught subject - the SC staff 'keep an eye' on ISP claims and I guess it depends on the volumes seen thereafter (and some UBErs perhaps 'snowshoe' to avoid trip points). What is/are the IP address(s)? That ISP has just the one which is apparently/clearly disreputable:

http://www.robtex.com/ip/67.209.135.230.html

[on edit] Hmmm ... and a couple of SpamCannibal hits:

http://www.robtex.com/ip/208.76.97.129.html

http://www.robtex.com/ip/208.76.102.95.html

All of those are low volume, hard to get listed unless they hit a spamtrap.

[on further edit] And ... it looks like many of the rest are on spam.dnsbl.sorbs.net though SenderBase sees no volume from them at all. That list is sort of like a spamtrap-triggered hit but listings are long-term.

Link to comment
Share on other sites

Thanks - they are all in the 208.76.97.xxx range
Okay, (low) volume is what's working against listing, even without the "spam will cease" intervention. Reputation score filtering would probably pick them up but they sneak under the radar for most other methodologies, by the look of it. Except for the fearsome sorbs spam list (though that is supposedly configurable for those not wanting to filter out quite the whole internet).

Anyway, the IP range seems quite limited so I suppose most could filter on that. The full list seen by SenderBase is at http://www.senderbase.org/senderbase_queri...thecolosite.com - just 25 addresses. Unless whoever is using that network to spam becomes more ambitious, I don't think they are ever going to come on the radar, generally. Probably the 'snowshoe' thing.

Another approach would be to send manual reports but it looks like those might bounce a bit. And the ISP might be complicit anyway.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...