Random brain drops
I want to be a big ISP and ignore the world
I, like the entire rest of the world, get a good amount of spam. The vast majority of it comes from some compromised machine. Most of it also contains one or more links to a real website.
Unless the web site advertised is a .ru or .hk or some other top level domain where I'm more likely to get more spam after reporting it than less I almost always report it to SpamCop.net. They remove at least some personally identifiable information and find out the abuse contact for both the sending email IP and, if there are links in the email, to the abuse contact of any websites listed in the email.
Today I got a spam disguised to look like a message from LinkedIn. No big deal, that has become pretty common. When I reported it to SpamCop though I was very surprised to see
Tracking link: http://m i m a r t a r.com/1.html
[report history]
ISP does not wish to receive report regarding http://m i m a r t a r.com/1.html
Resolves to 74.86.183.194
Routing details for 74.86.183.194
[refresh/show] Cached whois for 74.86.183.194 : abuse@softlayer.com
Using abuse net on abuse@softlayer.com
abuse net softlayer.com = abuse@softlayer.com
Using best contacts abuse@softlayer.com
ISP does not wish to receive reports regarding http://m i m a r t a r.com/1.html - no date available
http://m i m a r t a r.com/1.html has been appealed previously.
Note that the offending website has had spaces put into the name to prevent search engines from picking it up. So SoftLayer, a pretty large ISP, doesn't care that if you visit that page you get a giant malware warning from both Firefox and Chrome. Not only that but they've apparently know about it for some time as SpamCop has already appealed to them once to allow it to be reported.
Way to go SoftLayer - you're helping spread spam and malware one site at a time. Morons.
Posted at 05:06PM Sep 24, 2010 by Scott Dunbar in General | Comments[0]