[SC-Help] Re: ISP has already taken action against the account...

[Mike Easter]

Alan Harper wrote:
> What is the proper thing to do when Spamcop reports "ISP has already
> taken action against the account" and it is clear that they have not?

I don't think that language necessarily reflects what is going on - if
you interpret it as meaning that the spamvertisers webspace access has
been squashed.

This instance is about this line:

ISP has already taken action against the
account:http://www.armadacable.ru/cables.html

so we will talk about what just that means.  In the faq^1 it sez to an
admin that

SpamCop reports include a URL that allows you to register an issue
(IP/datestamp or website) as "resolved." For a website, you even have
the option of registering as an "innocent bystander." In either case,
anyone who tries to report the same issue through SpamCop in the future
will receive a message stating what action you have taken and they will
be prevented from filing a report on the same issue. This keeps your
workload to a minimum and lets spam fighters know you are helping wipe
out spam! ^1 http://www.spamcop.net/fom-serve/cache/117.html

That means to me that the admin who receives a notification of a
spamvertisement can
 - do nothing
 - claim 'resolved' meaning whatever
 - claim IB

Here's an example of a link associated with a notify to an admin of a
spamvertised site [this is about creativevenue.nl posted here recently]

spamcop.net/w3m?i=z1102382077z1b1561164ffa4e80dbf371992569df6az

If you follow the sublinks around to see what the admin can do about the
notify, you can easily imagine that the admin who doesn't want to be
hearing about that site anymore would check 'resolved' - because
 - it isn't an IB
 - they don't want to hear anymore about that link, but don't want to
cancel all future spamcop reports, so they don't want to do 'nothing'

"Resolved" then, is the 'best' choice for an admin who is notified about
a site and has looked into it and wants to say "Okay, I've heard about
that issue;  I don't really need to hear about it anymore."  Of course,
that 'resolved' would also be used by a provider who /had/ squashed an
account.

SC wants to be 'cooperative' with the spamvertiser provider - especially
considering that there is very little 'fallout' from a SC report of a
spamvertisement ^2 - so not sending anymore reports is cooperative.
Which leads us to what Ellen sez about what can change that condition of
not sending any more reports.

Ellen wrote:
> For spamvertized urls: ISP has taken action means that the ISP/report
> recipient has clicked a button saying spam will cease. Reports stop
> until a paid user files an appeal using the appeal popup during a
> parse. This is based on the url not the underlying IP.

She sez the report recipient has sed 'spam will cease' - possibly that
means = 'resolved' - clearly it isn't saying IB and it isn't doing
'nothing'.  And she is also saying what has to happen for the
spamvertiser provider to begin to receive reports again.

The business of receiving or not receiving reports doesn't actually
change anything about what 'happens' about there being a report
generated - either in the case of the spamsource /or/ in the case of the
spamvertiser.  A spamsource still counts toward the SCbl whether or not
the provider gets a report - and a spamvertiser report still 'doesn't do
anything' ^2 whether or not the provider gets a notify.

^2 /doesn't do anything/ about such as the SCbl.  There is some
consequence to being named as spamvertiser as a result of the surbl - an
'external' list of spamvertisers fetched from the SC statistics page.
There can also be other consequences to spamvertisers from listing db/s
outside of SC such as spamhaus and spews.

-- 
Mike Easter
kibitzer, not SC admin