[SC-Help] Re: roving.com spammers stay out of spamcop

[D.Diaz]

"McWebber" <mcwebber at my-deja.com> wrote in
news:cs0tlo$14g$1 at news.spamcop.net: 

> What is the deal with Spamcop and roving.com? It seems they are listed
> everywhere except Spamcop. I find it hard to believe since my
> spamtraps, and apparently lots of other spamtraps, are being hit by
> them that no Spamcop spamtraps are hit. Is it because they cut some
> kind of deal with Ironport that keeps them out of Spamcop? I got
> spammed by them recently because they allow customers to use very
> dirty lists. 
> 
> http://www.senderbase.org/search?searchBy=ipaddress&searchString=63.251
> .135.96 
> 
> http://us.openrbl.org/ip/63/251/135/96.htm
> 
> Even 63.251.135.74 which isn't in the "Bonded Sender" program is
> listed everywhere else but somehow manages to stay out of Spamcop.
> http://us.openrbl.org/ip/63/251/135/74.htm
> 


No deal, but just the way the weighting algorithm works, I think.

http://www.spamcop.net/fom-serve/cache/297.html

[quoting relevant part: "How the SCBL Works"]

The SCBL weights the number of reports referencing an IP against a
sample of the total amount of email sent by that IP. This method is not
perfect. For example, some IPs which send a significant amount of
reported mail may rarely or never be listed in the SCBL because those
IPs also send a lot of non-reported mail. 

[/quote]


Let's have a look at the SenderBase stats for the 63.251.135.0/24 block:

http://www.spamcop.net/w3m?action=map;mask=65535;net=1073414144;sort=ipsort

At the time I'm seeing the stats page, there are 15 hosts in that block,
sending a mail volume of 311319.00, and there are only 42 spam reports
for 3 of those 15 hosts. 

Also, a Google search in NANAS for 63.251.135.74 (the SBL listing you
mentioned) gives a total amount of only 11 sightings reported in the
year 2004, and none at all this month:

http://www.google.com/groups?as_ugroup=news.admin.net-abuse.sightings&as_scoring=d&num=100&as_q=63.251.135.74

Of course, still remains the question about the SpamCop spamtraps... 
How many hits are they receiving? Is that number so small to not trigger
a listing, given their "multiplicative" effect in the weighting
algorithm? 

It's also a pity to not have access anymore to the "history of
previous listings" for an IP address.  It would be interesting to dig in
there the past history of those IP addresses... 


-- 
Daniel Diaz
SpamCop User