[Scspamcop] Re: SpamCop still reports finding no abuse address when there's a - in the domain

[mr206]

The problem with that is that many of the ISPs will just ignore it if 
they only see one instance.  I don't know if you've noticed, but many 
upstreams of hosts and ISPs track the amount of complaints/reports they 
receive... if I'm Joe Q Host and I get one SC report, I may disregard it 
and assume it's a n00b reporter.  However, if I get crapflooded with 
reports from various users, I will know there's an issue and I'll deal 
with it.

I think CNC, Kornet and others simply are overwhelmed with exploited IPs 
and they don't properly resolve the issues, so hackers/spammers just 
re-exploit those addresses.

It does, however, annoy me that certain hosts and ISPs refuse SpamCop 
reports.... they're streamlined and easy to read; when I see someone 
refuse them, I personally think their 'hat' colour is no longer white, 
but starting to darken. <eg>

bar0 wrote:

> I think only one report shoulld be ever sent to an ISP or abuse address, 
> along with a "subscribe" option. If the abuse address doesn't bother to 
> subscribe then all reports should be henceforth dev-nulled. If they do 
> subscribe, but the reproting address is a free e-mail service yahoo and 
> variants like rocketmail netscape excite, hotmail live (not free) , a .cn, 
> .kr, .br, .ru .ua  or .ro address it should be likewise devnulled. in fact 
> any ISP hosting a ROKSO, or who has in the past year should be devnulled 
> also. 
> 
>