Error in recipient address, Might not be a SpamCop problem Options

[qjvgpuryy]

I think this is the right forum for this, but maybe not. (If not, I'm sure the moderators, who are on top of things, will move it.)

SpamCop tried to send a message to 'abuse[at]arcor' (no .com, .net or .anything).

Here is the Tracking URL.

[Wazoo]

I think this is the right forum for this, but maybe not. (If not, I'm sure the moderators, who are on top of things, will move it.)

Yes, this is a Reporting issue.

From: "Wazoo"
To: "SpamCop Deputies"
Subject: RIPE look-up result bad
Date: Tue, 6 May 2008 09:50:37 -0500

"-ip.de" dropped from data found in the lookup, thereby generating a
bad e-mail address ....

Question asked at;
http://forum.spamcop.net/forums/index.php?showtopic=9419

Tracking URL provided;
http://www.spamcop.net/sc?id=z1862908910z8...6efc751426d09fz

Results of the attempted Refresh Cache;
http://www.spamcop.net/sc?action=rcache;ip=88.76.236.245
Removing old cache entries.

Tracking details
Display data:
"whois 88.76.236.245[at]whois.ripe.net" (Getting contact from
whois.ripe.net)
Abuse address in 'remarks' field: abuse[at]arcor-ip.de
whois.ripe.net found abuse contacts for 88.76.236.245 = abuse[at]arcor
whois: 88.76.0.0 - 88.77.95.255 = abuse[at]arcor
Routing details for 88.76.236.245
Using abuse net on abuse[at]arcor
Using best contacts abuse[at]arcor

[Wazoo]

Ok I fixed it.

Ellen
SpamCop

[qjvgpuryy]

Is there any way to resend the notification that arcor-ip.de should have gotten? I can't submit the spam again.

[Farelf]

...Is there any way to resend the notification that arcor-ip.de should have gotten? I can't submit the spam again.

I think/fear it would have to be manual David (retrieve the spam from your past reports and compose a covering "note" to send it). You would need to be sure they're fairly white hat or use a disposable address. I guess you're concerned they're being deprived of the opportunity to do something about the abuse in a timely manner. They may be receiving more recent reports from others already - and since there were spam trap hits to tip them into the SCbl relatively quickly - and they're on a heap of other bls - I don't really think it would make much difference now. Note, from SenderBase, they have a large increase in mail and taken together with their "Poor" reputation that means the increase was almost surely all spam.

[btech]

I found 2 more of these errors, should the reports be forwarded to deputies or posted in this forum?

[Telarin]

I usually just send a note to the deputies when I find errors like that, they usually take care of them pretty quickly and the next round of reports go through where they should.

[Wazoo]

I found 2 more of these errors, should the reports be forwarded to deputies or posted in this forum?

In theory, see SpamCop Newsgroups .. the spamcop.routing newsgroup specifically.

Posting the data to the Forum does bring it to light, but .... paid staff doesn't spend much time here, and certainly does not peruse each and every posting here. That's why you'll see that someone has made a note about sending it upstream.

Mailing the data directly .. that's one of those things hard to simply say yes to. There is still only the small handful of people that receive those e-mails, once described as three people trying to handle 800-1800 e-mails a day (though allegedly there have been more people hired.) If all data is presented, all research done, and correct actions recommended, probably no big deal. However, if someone else reads this and figures that simply sending in a complaint about the bad condition ... well, that probably won't be received well, possibly not acted on immediately, etc. As I stated in the Wiki description, it boils down to doing the homework first.

[btech]

Wazoo-

Can you post this to the newsgroup for me? I'm at work and can't subscrbe to them here. I emailed the deputies, but I'd like to submit the more effective way..

http://www.spamcop.net/sc?id=z1867618095z5...933f03e30c9fcaz

Tracking link: dachsteinbande[dot]at/redir.html
Resolves to 195.137.213.130
Routing details for 195.137.213.130
[refresh/show] Cached whois for 195.137.213.130 : abuse[at]server
Using abuse net on abuse[at]server
Using best contacts abuse[at]server
abuse[at]server bounces (13 sent : 7 bounces)

Using abuse#server[at]devnull.spamcop.net for statistical tracking.

It should be abuse[at]server-home.net

This post has been edited by btech: May 9 2008, 12:17 PM

[qjvgpuryy]

It's starting to look like a problem with hyphens.

[Farelf]

...Can you post this to the newsgroup for me? I'm at work and can't subscrbe to them here. I emailed the deputies, but I'd like to submit the more effective way..
It should be abuse[at]server-home.net

Path: news.spamcop.net!not-for-mail
From: Farelf <user[at]domain.invalid>
Newsgroups: spamcop.routing
Subject: Broken address for server-home.net
Date: Sat, 10 May 2008 04:32:59 +0800
Message-ID: <g02cdp$2c8$1[at]news.spamcop.net>
NNTP-Posting-Date: Fri, 9 May 2008 20:32:57 +0000 (UTC)
Xref: news.spamcop.net spamcop.routing:9490

http://www.spamcop.net/sc?action=rcache;ip=195.137.213.130
Removing old cache entries.
Tracking details
Display data:
"whois 195.137.213.130[at]whois.ripe.net" (Getting contact from whois.ripe.net)
Abuse address in 'remarks' field: abuse[at]server-home.net
whois.ripe.net found abuse contacts for 195.137.213.130 = abuse[at]server
whois: 195.137.212.0 - 195.137.213.255 = abuse[at]server
Routing details for 195.137.213.130
Using abuse net on abuse[at]server
Using best contacts abuse[at]server
abuse[at]server bounces (13 sent : 7 bounces)
Using abuse#server[at]devnull.spamcop.net for statistical tracking.

Well, yes abuse[at]server would bounce. abuse[at]server-home.net requested.

http://www.abuse.net/lookup.phtml?domain=server-home.net says

abuse[at]de.colt.net (for server-home.net)
abuse[at]server-home.net (for server-home.net)

Sorry Brandon, I neglected to attribute to you, but posted anyway after confirming broken address still current.

[Farelf]

It's starting to look like a problem with hyphens.

Yes, it's a common factor - I posted the above before I picked up what you were talking about. I will add to my thread 'over there'. Maybe Ellen will get/has got it anyway. If so, yet another "little" fix ticketed, but it would be nice to know.

[Wazoo]

Wazoo-

Can you post this to the newsgroup for me? I'm at work and can't subscrbe to them here. I emailed the deputies, but I'd like to submit the more effective way..

Read this earlier in the day, but the phone rang and real-life commanded me to be elsewhere. Came back and see that Farelf picked up the slack. The "more effective way" description is really up for grabs. As I understand it, the Deputies focus on their e-mail first, perusing newsgroup traffic as time allows. The Forum rates basically zilch, though pointing out that RW has made a post or two, Don has appeared in response to most of my queries, although sometimes finding time to make an appearance for other purposes <G>

So though it has been posted to the newsgroups as suggested, I also chose to make it a follow-up to my previous e-mail about the previous issue.

From: "Wazoo"
To: "SpamCop/Ellen"
References: <040e01c8af88$8cddac50$6401a8c0[at]HPorGateway> <482074CB.4060203[at]admin.spamcop.net>
Subject: Re: RIPE look-up result bad
Date: Fri, 9 May 2008 20:43:38 -0500

Appearances would be that there is a coding problem in interpreting
results that have a hyphen in the Domain part of the target e-mail
address. Yet another one has been identified/queried about at
http://forum.spamcop.net/forums/index.php?showtopic=9419 This one;

http://www.spamcop.net/sc?id=z1867618095z5...933f03e30c9fcaz

http://www.spamcop.net/sc?action=showroute...30;typecodes=17
Reports routes for 195.137.213.130:
routeid:39304043 195.137.212.0 - 195.137.213.255 to:abuse[at]server
Administrator found from whois records

http://www.spamcop.net/sc?action=rcache;ip=195.137.213.130
Removing old cache entries.

Tracking details
"whois 195.137.213.130[at]whois.ripe.net" (Getting contact from
whois.ripe.net)
Abuse address in 'remarks' field: abuse[at]server-home.net
whois.ripe.net found abuse contacts for 195.137.213.130 =
abuse[at]server
whois: 195.137.212.0 - 195.137.213.255 = abuse[at]server
Routing details for 195.137.213.130
Using abuse net on abuse[at]server
Using best contacts abuse[at]server
abuse[at]server bounces (13 sent : 7 bounces)

Using abuse#server[at]devnull.spamcop.net for statistical tracking.

Sent:Bounces statistics seem very odd in this case ...????

Data / query has also been posted to the routing newsgroup.

<previous e-mail and Reply snipped>

[btech]

No worries Farelf.. so long as they get fixed.

I cam across another one:

http://www.spamcop.net/sc?id=z1879876604z6...447a50db34b245z

CODE

Tracking message source: 78.99.140.50:
Routing details for 78.99.140.50
[refresh/show] Cached whois for 78.99.140.50 : abuse[at]ip.t
Using abuse net on abuse[at]ip.t
No abuse net record for ip.t
Using best contacts abuse[at]ip.t
Message is 6 hours old
78.99.140.50 not listed in dnsbl.njabl.org
78.99.140.50 not listed in dnsbl.njabl.org
78.99.140.50 listed in cbl.abuseat.org ( 127.0.0.2 )
78.99.140.50 is an open proxy
78.99.140.50 not listed in accredit.habeas.com
78.99.140.50 not listed in plus.bondedsender.org
78.99.140.50 not listed in iadb.isipp.com

Should be abuse[at]ip.t-com.sk

... I think it looks like a problem with the hyphen (not sure who stated that earlier)

This post has been edited by btech: May 12 2008, 12:40 PM

[SpamCopAdmin]

Reporting problems with abuse addresses directly to deputies[at]admin.spamcop.net via email is far and away the most effective route to a solution.

Please use a descriptive subject line:
such as: Bad Abuse Address

Please be clear and concise.

Please include a Tracking URL.

Please do NOT simply point us to a forum topic. We have some pretty good skills, but divining your intentions is not one of them. :-)

- Don D'Minion - SpamCop Admin -

.

[dbiel]

Wiki FAQ entry created at ReportsToBadAbuseAddress

[Wazoo]

Reporting problems with abuse addresses directly to deputies[at]admin.spamcop.net via email is far and away the most effective route to a solution.

Have a note to myself that the FAQ entries, the Wiki entries, and all responses in the future need to reflect this 'new' preference in handling routing issues. The follow-on question then would be whether the spamcop.routing newsgroup needs to continue its existence ...????

Edit: OK, having to admit that I hadn't noticed that this newsgroup was actually removed from the http://www.spamcop.net/help.shtml web page, having to assume now that this was done a long time ago.

Please use a descriptive subject line:
such as: Bad Abuse Address

Please be clear and concise.

Please include a Tracking URL.

Please do NOT simply point us to a forum topic. We have some pretty good skills, but divining your intentions is not one of them. :-)

I'm thinking that you could have possibly pointed to the copy of the e-mail I submitted and provided a copy of in this very Topic, perhaps even pointing out what was wrong with that e-mail .... although I'd have to note that there has been no reply to the follow-up e-mail as shown here, in addition to several other Don/Deputies e-mails. So just as folks complain about a lack of response / action seen in the newsgroups, one might not see anything from an e-mail submittal either. It is probably best described the same way changes to the parsing code is found to be 'fixed' ... whatever was broken just starts working ...????

SpamCop Newsgroups Wiki page updated.
SpamCop Newsgroups - How to access and use Wiki page updated.
SpamCop Newsgroups FAQ entry 'here' updated.

[SpamCopAdmin]

one might not see anything from an e-mail submittal either.

Looking at posts #2 and #3 in this thread...

You posted your message to Ellen, and then posted her response 35 minutes later, and now you're warning people that email submittals might be ignored.

I can't help but think that your warning is contradicted by the facts.

- Don -

.

[Wazoo]

Looking at posts #2 and #3 in this thread...

You posted your message to Ellen, and then posted her response 35 minutes later, and now you're warning people that email submittals might be ignored.

I can't help but think that your warning is contradicted by the facts.

I specifically said "follow-up e-mail", which is seen at Linear Post #13. The commentary also mentioned several other e-mails on different subjects. I've even resent one of them (again to both you and Deputies) on the apparent premise that somehow a spamcop.net to spamcop.net e-mail was somehow lost.

[SpamCopAdmin]

I specifically said "follow-up e-mail"

Ah! My mistake.

I thought you were warning users that if they send in information by email it might be ignored.

I didn't realize that when you said, "one might not see anything from an e-mail submittal either," you were actually talking about follow-up emails and not first report emails.

- Don -

.