[Dshield] mail1.giac.net spamcop listed]

Brian Dessent brian at dessent.net
Sun Dec 14 18:09:55 GMT 2003


Kenneth Coney wrote:

> similar.  We all know ISPs keep logs.  So what's happening on the
> investigation into the actual origination place of Blaster and Nachia?  Is
> anyone even trying to track the first instances of those viruses down and
> identify who?  Probably not.  Easier and cheaper to say "here's a patch and
> buy/get this software if you are infected."


Riiiight.  People have been sending LARTs to the abuse desks of dozens
of negligent ISPs in China, Korea, Brazil, Argentina, etc. for YEARS and
it has resulted in absolutely zero action on the part of those
companies.  And in the US/Europe there are still tons of ISPs in denial
that refuse to admit they host spammers, even after receiving complaint
after complaint.  They want you to listwash, or they issue a meaningless
warning, or move the client to another IP address, or just pipe the
abuse address to the desk of Dave Null.  Sometimes they play the game of
"We talked to the client and he said he was doing 100% opt-in, that's
good enough for us."  Spammers often pay good money to an ISP and it
usually takes being listed in a blocklist to get anyone actually booted
from some ISPs.    (Note: "some" ISPs, not all.  There are lots of
whitehat hosts that give the boot upon sight.  But you're probably not
receiving spam from these netblocks...)

There are thousands and thousands of open proxies out there that are
constantly spewing out spam and their netblock owners have been informed
countless times.  If LARTing worked then there would be no need for
Spamcop, SPEWS, and blocklists in general.  But we tried that first and
it was a joke.  The blocklists are a direct consequence of the plan that
you describe failing horribly.  That you find blocklist administrators
that are certifiably insane and vindictive is precisely because these
people are tired of sending hundreds of well-documented LARTs to abuse
desks and being routinely ignored for years and years.

Brian




More information about the list mailing list