[Scspamcop] Re: Persistent Loan Spammer at Moneynett

[Mike Easter]

Michael Brennan wrote:
Subject: Persistent Loan Spammer at Moneynett

IMO Spammer is not a particularly useful term to use in discussing spam,
as it is ambiguous.

Spam typically has a spamsource or 'source', and frequently has a
'spamvertised site'.  You get the spam because it was injected at a
spamsource.  The spamvertised is termed 'spam support' -- as there is no
evidence that the spamvertiser injected the spam - the assumption is
'guilt' (of being associated with the spam) by implication.

In some special circumstances, a spamvertised has/had nothing to do with
the spam.

The point of making the distinctions is that spamcop only has some little
teeth in making a blocklist of spamsources -- spamcop has zero teeth in
terms of motivating a spamvertiser provider to do anything about a
spamvertiser.

And your favorite legislators such as those who make laws about CANSPAM
are only interested in making the DMA Direct Marketing Association happy.
Our legislators and postal service are more or less in bed with the DMA -
which has some important influence, which spamreporters do not.  Not very
many people care about what spamfighters think.

> Does anyone know why this guy is still spamming?  He's violating
> U-CAN-SPAM for months now.

And your point is?

>
http://www.spamcop.net/sc?id=z2054282445z84f1fe3cfe1f7fd4b613882672c0c093z
>
> More to the point, why is the spammer the only notify?  Fat lot of good
> notifying HIM will do!

Let's don't use that term 'spammer'.  SC notifies the providers for the
spamsource and the spamvertiser.

SC determines the spamsource to be 213.181.87.140 no rDNS which is not
only listed in spamcop's blocklist, but is also listed in the spamhaus SBL
indicating nonresponsiveness and progression to blocklisting as the /29.

SC does not determine the spamvertiser, because the payload is an gmail
address

> I'm hugely annoyed to find this clown still up and running, when he has
> littered the known limits of the universe.

Specifically which clown do you have in mind?

The source provider which is blocklisted in spamhaus?  Spamhaus lists 17
listings under what it characterizes as 'newskies.net' of which one of
those listings is a ROKSO Yambo financials and the other 16 are not
characterized as ROKSOs.  Personally I'm not entirely sure how spamhaus
decided to call this block as belonging to newskies.

Hopefully that spam isn't getting into your inbox, but instead is being
diverted to the Junk folder from which it can be reported.  If you are
configured for quick reporting, you wouldn't be spending your time waiting
for the parse to approve of a notify of an unresponsive spamhaus listed
provider, but instead you would be quick reporting the IP to the SCbl.

--
Mike Easter
kibitzer, not SC admin