Chris wrote: > Since about the 22nd or 23nd I've been getting virus laden (Sober.U) spam > from an address at twtelecom.net (66.162.83.190). All my spam reporting > is done via two scripts, one is reporter.pl which runs sa-learn and > reports to Razor, Pyzor and DCC. The other script, which was written by > Karsten Self, called Spam Tools, actually reports the spam to the abuse > addresses(s) and to NANAS. After getting a couple of hundred infected > message I wrote a nice email to one of the contacts, he replied:
I know some ip-addresses here that try to send me viruses for over a year! Posting this to the abuse I did once or twice and indeed doesn't help always but I also block the ip at the MTA level (postfix) and that does help ;-) Some I have even blocked at the firewall because they wasted too much of precious cpu-time. Countries like TW, CN, KR I have blocked at the MTA level, although only in big (/16) ip-ranges and domain-names, this tiny TW ip-range you mentioned here I have not blocked. By the way, I wouldn't report spam to the abuse-addresses, the reports are often forwarded to the spammer. It is often only used as a confirmation that the spammer has found a working mail-address and you will get more spam. Spamcop offers an option to report the spam without sending mails to the abuse addressess. Regards Menno van Bennekom
