Annibal Posted June 1, 2007 Share Posted June 1, 2007 Yes, i'm quite frustrated. Weeks reporting the same spammer to different hosting company taking care also that the reporting address were correct and no one, NO ONE of the website has been shuted down. Have a look at my collection: hXXp://eforclass.org:8088/cg/ hXXp://formoree.org:8088/cg/ hXXp://morepher.org:8088/cg/ hXXp://theefors.org:8088/cg/ hXXp://breakerclip.org:8088/cg/ hXXp://aaahgh.org hXXp://medspro.org hXXp://instantrx.org hXXp://rxmap.org hXXp://rxbrands.org hXXp://rx24.org hXXp://rxuwant.org hXXp://rxuniverse.org hXXp://rx321.org There are company in US, Mexico, France...No one made something. Is quite sad, so what? i have to give up? Link to comment Share on other sites More sharing options...
Farelf Posted June 2, 2007 Share Posted June 2, 2007 Yes, i'm quite frustrated. Weeks reporting the same spammer to different hosting company taking care also that the reporting address were correct and no one, NO ONE of the website has been shuted down. ... There are company in US, Mexico, France...No one made something. Is quite sad, so what? i have to give up? SpamCop's BL works "as advertized" by blocking serial offenders using the same IP addresses. This doesn't do much in the case of those spammers who hop around botnets for their sending and it takes no direct action against 'blackhat' hosts of spamvertized websites and it is, unfortunately, quite ineffectual against those sites that are, themselves hosted on botnets. An approach - the only real approach - in those cases is to complain to the registrars of spam domains. See the discussion at Complainterator V5 Announcement, Automated complaints to registrars, noting that there are successive releases after V5, as you go through the topic and the latest version of that tool is available through the links given. TerryNZ stepped through the manual equivalent of the function in a post in 'BotNet scenario' Link to comment Share on other sites More sharing options...
kamaraju Posted June 3, 2007 Share Posted June 3, 2007 Yes, i'm quite frustrated. Weeks reporting the same spammer to different hosting company taking care also that the reporting address were correct and no one, NO ONE of the website has been shuted down. There are company in US, Mexico, France...No one made something. Is quite sad, so what? i have to give up? If you want the websites to be shutdown, I suggest you forward your spam to knujon (www.knujon.com) instead of spamcop. Spamcop's focus is not shutting down the spammy websites, while knujon's focus is just that. I am having positive results with them. My spam has not reduced to zero, but the numbers have definitely dwindled down since I started reporting to them. raju Link to comment Share on other sites More sharing options...
Wazoo Posted June 3, 2007 Share Posted June 3, 2007 Why your complaints to "one" ISP doesn't result in "the" web page being shut down ..... 06/03/07 00:24:46 dns aaahgh.org Canonical name: aaahgh.org Addresses: 71.130.204.142 84.60.6.152 217.211.55.49 218.255.192.106 221.126.148.233 24.152.128.81 65.24.187.23 66.177.73.244 67.173.173.182 69.156.106.97 The basic / infamous rotating DNS mode, where the actual site 'location' changes every few minutes to another compromised computer somewhere else in the world. See all the other world-wide discussions about BotNets, idiot users that don't secure their systems, ISPs that refuse to cut off these idiot users, etc. etc. etc. ..... Also see TerryNZ's post about his Complainerator tool in the Suggested Tools and Applications Forum section. 06/03/07 00:26:56 dns medspro.org Canonical name: medspro.org Addresses: 81.93.17.122 Trace medspro.org (81.93.17.122) ... 06/03/07 00:27:26 dns instantrx.org Canonical name: instantrx.org Addresses: 81.93.17.122 Trace instantrx.org (81.93.17.122) ... 06/03/07 00:28:21 dns rxmap.org Canonical name: rxmap.org Addresses: 81.93.17.122 Trace rxmap.org (81.93.17.122) ... 06/03/07 00:28:58 dns rxbrands.org Canonical name: rxbrands.org Addresses: 81.93.17.122 Trace rxbrands.org (81.93.17.122) ... Fetching http://rxbrands.org/ ... Content-Location: http://rxbrands.org/Default.htm <title>Welcome</title> <scri_pt LANGUAGE="java scri_pt"> <!-- ev al(un esca pe("\x76\x61\x72\x25\x32\ <edited and snipped> Bottom line here, a passle of sites all 'located' at the same server, all 'web-pages' being re-directs to somewhere else .... Bottom line, an ISP that apparently does not pay attention to things ... or that folks are not directly complaining to about this crap ..... whois -h whois.ripe.net 81.93.17.122 ... inetnum: 81.93.0.0 - 81.93.31.255 org: ORG-OS2-RIPE netname: FR-ORNIS-20020805 descr: ORNIS S.A. country: FR admin-c: JML8-RIPE tech-c: SM492-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: ORNIS-MNT mnt-routes: ORNIS-MNT source: RIPE # Filtered organisation: ORG-OS2-RIPE org-name: ORNIS S.A. org-type: LIR address: Energy Park 5, 130 Bd de Verdun address: 92400 address: Courbevoie address: France phone: +33 1 56 37 73 73 fax-no: +33 1 56 37 73 00 e-mail: lir[at]ornis.com admin-c: DL6381-RIPE admin-c: SM492-RIPE mnt-ref: ORNIS-MNT mnt-ref: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT source: RIPE # Filtered person: Jean-Marie Labeyrie address: ORNIS address: Energy Park 5, address: 130 Bd de Verdun address: 92400 Courbevoie, France phone: +33 1 56 37 73 73 fax-no: +33 1 56 37 73 00 e-mail: noc[at]ornis.net nic-hdl: JML8-RIPE source: RIPE # Filtered mnt-by: ORNIS-MNT person: Sylvain Mouly address: ORNIS address: Energy Park 5, address: 130 Bd de Verdun address: 92400 Courbevoie, France phone: +33 1 56 37 73 73 fax-no: +33 1 56 37 73 00 e-mail: sylvain.mouly[at]ornis.com nic-hdl: SM492-RIPE source: RIPE # Filtered mnt-by: ORNIS-MNT % Information related to '81.93.0.0/19AS8399' route: 81.93.0.0/19 descr: ORNIS S.A origin: AS8399 source: RIPE # Filtered mnt-by: ORNIS-MNT There's data if you want to follow up on some of those repeat/continuous offenders .... Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.