Re: How come couple of Chinese ISPs not getting blocked yet?

On 2006-01-08 00:33:25 +0200, "Mike Easter" <[email protected]> said:

> Ilgaz Ocal wrote:
> 
>> I get spam mainly from 2 ISPs in China.
> 
> There are some very non-responsive .cn and .kr and other providers.
> 
>> Based on what I know, system
>> works as follows:
> 
> You are not correct in your understanding.
> 
>> 1) User reports spam
> 
> A spamcop reporter, quick reporter, or spamtrap submits a spam to the
> parser.  The parser determine the spamsource on all 3 types of
> submissions.  The spamvertisers are handled differently than the
> spamsources for reporters vs other..
> 
>> 2) As postmaster/admin you get a spam report telling you must fix the
>> issue in 48 hours and tell what you have done
> 
> No.  A spamsource pm/admin can refuse all SC reports, accept all reports
> and do whatever such as devnull them, or accept reports and act against
> the spamsource or secure it.  There is no requirement for reporting
> back.  Whatever the pm/admin does, the spamsource counts toward the SCbl
> unless the parse is a mistake and convincingly rebutted by the admin.
> 
> SC is a parsing reporting system and a spamsource blocklisting system.
> SC is not a 'policeman' that some admin answers to.

That is a problem for me than...

> 
> SC's only power is in the popularity of its blocklist with those who use
> it as a part of a spam defense plan.  The notification process is a
> courtesy to spamvertiser providers - spamveriders - and spamsources.

You can't imagine how many spam any spamcop user would get if 
spamassasin stops working than. I see only a dozen spam blocked by 
spamcop blocking list.

Don't misunderstand. I see couple of Chinese ISP's keeping open proxies 
on purpose or not closing them down as if they are bribed by spammers.

As China is a huge customer for IT World, they get some "special" 
treatment from large companies like Yahoo for instance. I started to 
wonder if parent of Spamcop has a policy like that.

> 
>> 3) If you ignore that message or lie to Spamcop that it is fixed, you
>> get blocked.
> 
> What happens as a consequence of a spamsource being reported is
> mathematical.  If a sufficiently high number of spamsource reports are
> made compared to the 'traffic' or reputation of an IP address, the IP
> will be listed, regardless of whether an admin accepts or answers
> reports or not.  Accepting and/or answering are immaterial.  All that
> matters is how many spamsource reports there are compared to the traffic
> or non-spam activity of the IP.

I have seen amazing numbers of spam coming from a single chinese ISP 
advertising single domain.

> 
>> So, how come these 2 open proxy heavens which I highly suspect that
>> are open on purpose doesn't get blocked by Spamcop?
> 
> Your tracker showed a source 221.195.98.111 no rDNS of CNCGROUP Hebei
> Province which IP is CBL listed as an open proxy.  SC doesn't provide us
> with the information about reports on unlisted IPs, but I can see at
> senderbase that the IP is usually not active, that it has been more
> active in the past month, and that its current activity over the last
> day is about zero.  So, my guess would be that it might have been SC
> listed in the past month, but not necessarily, and that there aren't too
> many reports on it.  It has been listed at CBL since yesterday.
> 
>> I mean, is there anything special? Also will there be a filtering
>> system in future that will check spam sites in mail too?
> 
> I don't know what that sentence means.

In future someone could implement a filter to block mail if it contains 
certain top 10 spamvertized URLs (spamcop has them) . It would be 
opt-in scheme of course. Nobody would want anyone jumping up and down 
saying "spamcop reads my mail"

> 
>> Here, just a random example.
>> 
> www.spamcop.net/sc?id=z853256549zda560ff3f051cd753253384280f95733z
>> 
>> As I said, 90% of spam to my account is from China.
> 
> With my spamfilter, I could filter out all of my spam from .cn IPs, and
> I could whitelist any known goodmail from .cn IPs I was going to get.
> 
> Your tracker also shows that the item was recognized as spam by your SC
> filtering.

It is spamassasin, not spamcop block list. I can't understand why I do 
report spam if there is no effect at all... Well, I'll keep reporting, 
including my native language spams in other accounts too but there is 
something changed I believe.

I am supposed to be blocking whole China and Korea but they don't work too.

Ilgaz