I think this is the right forum for this, but maybe not. (If not, I'm sure the moderators, who are on top of things, will move it.)

SpamCop tried to send a message to 'abuse[at]arcor' (no .com, .net or .anything).

Here is the Tracking URL.

Yes, this is a Reporting issue.

Is there any way to resend the notification that arcor-ip.de should have gotten? I can't submit the spam again.

I think/fear it would have to be manual David (retrieve the spam from your past reports and compose a covering "note" to send it). You would need to be sure they're fairly white hat or use a disposable address. I guess you're concerned they're being deprived of the opportunity to do something about the abuse in a timely manner. They may be receiving more recent reports from others already - and since there were spam trap hits to tip them into the SCbl relatively quickly - and they're on a heap of other bls - I don't really think it would make much difference now. Note, from SenderBase, they have a large increase in mail and taken together with their "Poor" reputation that means the increase was almost surely all spam.

I found 2 more of these errors, should the reports be forwarded to deputies or posted in this forum?

I usually just send a note to the deputies when I find errors like that, they usually take care of them pretty quickly and the next round of reports go through where they should.

In theory, see SpamCop Newsgroups .. the spamcop.routing newsgroup specifically.

Posting the data to the Forum does bring it to light, but .... paid staff doesn't spend much time here, and certainly does not peruse each and every posting here. That's why you'll see that someone has made a note about sending it upstream.

Mailing the data directly .. that's one of those things hard to simply say yes to. There is still only the small handful of people that receive those e-mails, once described as three people trying to handle 800-1800 e-mails a day (though allegedly there have been more people hired.) If all data is presented, all research done, and correct actions recommended, probably no big deal. However, if someone else reads this and figures that simply sending in a complaint about the bad condition ... well, that probably won't be received well, possibly not acted on immediately, etc. As I stated in the Wiki description, it boils down to doing the homework first.

Wazoo-

Can you post this to the newsgroup for me? I'm at work and can't subscrbe to them here. I emailed the deputies, but I'd like to submit the more effective way..

http://www.spamcop.net/sc?id=z1867618095z5...933f03e30c9fcaz

Tracking link: dachsteinbande[dot]at/redir.html
Resolves to 195.137.213.130
Routing details for 195.137.213.130
[refresh/show] Cached whois for 195.137.213.130 : abuse[at]server
Using abuse net on abuse[at]server
Using best contacts abuse[at]server
abuse[at]server bounces (13 sent : 7 bounces)

Using abuse#server[at]devnull.spamcop.net for statistical tracking.

It should be abuse[at]server-home.net

It's starting to look like a problem with hyphens.

Sorry Brandon, I neglected to attribute to you, but posted anyway after confirming broken address still current.

Yes, it's a common factor - I posted the above before I picked up what you were talking about. I will add to my thread 'over there'. Maybe Ellen will get/has got it anyway. If so, yet another "little" fix ticketed, but it would be nice to know.

Read this earlier in the day, but the phone rang and real-life commanded me to be elsewhere. Came back and see that Farelf picked up the slack. The "more effective way" description is really up for grabs. As I understand it, the Deputies focus on their e-mail first, perusing newsgroup traffic as time allows. The Forum rates basically zilch, though pointing out that RW has made a post or two, Don has appeared in response to most of my queries, although sometimes finding time to make an appearance for other purposes <G>

So though it has been posted to the newsgroups as suggested, I also chose to make it a follow-up to my previous e-mail about the previous issue.

No worries Farelf.. so long as they get fixed.

I cam across another one:

http://www.spamcop.net/sc?id=z1879876604z6...447a50db34b245z



Should be abuse[at]ip.t-com.sk

... I think it looks like a problem with the hyphen (not sure who stated that earlier)

Reporting problems with abuse addresses directly to deputies[at]admin.spamcop.net via email is far and away the most effective route to a solution.

Please use a descriptive subject line:
such as: Bad Abuse Address

Please be clear and concise.

Please include a Tracking URL.

Please do NOT simply point us to a forum topic. We have some pretty good skills, but divining your intentions is not one of them. :-)

- Don D'Minion - SpamCop Admin -

.

Wiki FAQ entry created at ReportsToBadAbuseAddress

Have a note to myself that the FAQ entries, the Wiki entries, and all responses in the future need to reflect this 'new' preference in handling routing issues. The follow-on question then would be whether the spamcop.routing newsgroup needs to continue its existence ...????

Edit: OK, having to admit that I hadn't noticed that this newsgroup was actually removed from the http://www.spamcop.net/help.shtml web page, having to assume now that this was done a long time ago.

I'm thinking that you could have possibly pointed to the copy of the e-mail I submitted and provided a copy of in this very Topic, perhaps even pointing out what was wrong with that e-mail .... although I'd have to note that there has been no reply to the follow-up e-mail as shown here, in addition to several other Don/Deputies e-mails. So just as folks complain about a lack of response / action seen in the newsgroups, one might not see anything from an e-mail submittal either. It is probably best described the same way changes to the parsing code is found to be 'fixed' ... whatever was broken just starts working ...????

SpamCop Newsgroups Wiki page updated.
SpamCop Newsgroups - How to access and use Wiki page updated.
SpamCop Newsgroups FAQ entry 'here' updated.

Looking at posts #2 and #3 in this thread...

You posted your message to Ellen, and then posted her response 35 minutes later, and now you're warning people that email submittals might be ignored.

I can't help but think that your warning is contradicted by the facts.

- Don -

.

I specifically said "follow-up e-mail", which is seen at Linear Post #13. The commentary also mentioned several other e-mails on different subjects. I've even resent one of them (again to both you and Deputies) on the apparent premise that somehow a spamcop.net to spamcop.net e-mail was somehow lost.

Ah! My mistake.

I thought you were warning users that if they send in information by email it might be ignored.

I didn't realize that when you said, "one might not see anything from an e-mail submittal either," you were actually talking about follow-up emails and not first report emails.

- Don -

.

I did not use any words close to ignored.

Interpretation involved apparently. My first e-mail dealt with the apparent bad look-up. My follow-up extended that to an apparent issue with the parser code, based on the additional samples of bad lookup returns. There is/was the assumption that the Reply would be of the 'ticket has been opened' type. Pretty much my same expectation with my write-up on the XSS / scri_pt insertion exploit.

I guess I don't understand.

If you weren't warning the folks in the forum that if they write to the Deputies, they might not get a reply, which implies that their email will be ignored, what were you warning them against?

- Don D'Minion - SpamCop Admin -

.

You know . stuff happens when you start reading things with a certain mind-set already in place, then choose to only read selected words and phrases, then pull them out of context to make some off the wall point.

I repeat, I said nothing close to the word, definition, or scenario of 'ignored' ... only you have used this word. In fact, doesn't the following statement that you ignored in the same paragraph state just the opposite? It is probably best described the same way changes to the parsing code is found to be 'fixed' ... whatever was broken just starts working ...????

This Forum, the newsgroups, both contain numerous complaints, remarks, pointers about non-response to both postings and e-mails. There is nothing new in this.

On this specific Topic and data presented, I note that Dbiel made a new Wiki page, in which he states that the three examples of a hypenated Domain name have all been fixed and seems to suggest that the parser code may have been fixed. I'm not sure where that data came from, as the only response thus far seems to be Ellen's reply to my first e-mail, which appears to be a fix based on her manually manipulating the database. Nothing else stated in this Topic, no response seen in the spamcop.routing newsgroup to the same thread started on the same subject (hypenated Domain names) ..... Yet again, I am not using anything close to the word "ignored" .. only pointing out the lack of a response from those that can change things.

To answer your question directly, I was not making a warning. I was simply pointing out that the lack of a Reply may not necessarily mean that nothing was being done. However, I must note that without feedback, it is hard to tell what the status might actually be. Note the continued posting of more and more examples in this Topic. Feedback from 'above' that the programming staff were in fact working on a fix would short-circuit these additional posts.

I tried not to imply that the parser code had been fixed, but only that the 3 examples had been fixed. I also concluded from the common problem of the domain having a hyphen, that the hyphen might be the problem. But that was just a logical guess. Sorry if it reads incorrectly. The link to the Wiki page is http://forum.spamcop.net/scwik/ReportsToBadAbuseAddress

What I want to know is who sends the deputies just a link to forum topic?

I am trying to remember if I ever did. I might have since a topic like this is not easy for me to summarize since it is getting a little detailed and I think it would be obvious if they read the topic what input was needed. But, I very rarely email the deputies about anything and can't say that I was ever ignored when I did.

Yet every once in a while we get a topic started by someone who hasn't gotten a response from a deputy. Usually, it seems obvious that the reason is that they haven't given enough information so they get the old Socrates routine from Wazoo (and I don't remember ever seeing a complaint from a deputy then).

As Wazoo says, there are ways and there are ways to experience a response. If the problem gets fixed, that's a response, right?

And who sends the deputies a link to a forum topic?

Miss Betsy

I have, in the context of "such and such is seen", being some sort of description/summary of the problem and "see [link] for more detail" OWTTE, a shorthand way to cover all of the content placed on the table. But never "just a link", I'm sure. But, in retrospect, it would have been helpful, as requested, to pull any tracking urls from the forum discussion and include them right there in the email. Not that I send many. "We" try to keep the workload off them, not add to it.

I guess I just assumed any action by staff would involve prudent review of the precursory materials (anamnesis) once the problem was nominated. And I have advised others they could point to the forum topic when contacting deputies as a way to avoid a lengthy email, particularly (but not exclusively) if they seemed to struggle a little in initially expressing/defining the matter. Same logic.

Well, Don has provided a preferred template but I would still recommend, in addition, including a link to the forum topic in most cases as a matter of prudence so Don/the deputies don't get blindsided/waste time through any omissions in the email description. To turn around Don's phrase (re the skills of himself & deputies), a supplicant's knowledge/skills do not approach those of the paid staff concerning these problems and (logically) they cannot be expected to always mention all matters of significance - or necessarily to even use 'proper' terminology. If Don and (him speaking for them) the deputies have no confidence in the forums to assist in that regard, that is of course their call - but he has not actually said that.

Bottom line, as a minimum, we must all be sure the email nominates the specific problem in the title, gives concise detail in the body and includes an illustrative tracking URL where appropriate, which will be most times.

Not to change the subject, but I see the same reporting address errors still exist.

http://www.spamcop.net/sc?id=z1886567770z4...c4a69b58a3ab52z
.sk error.


-----
http://www.spamcop.net/sc?id=z1886678724z1...54f398f040b8ffz

Resolves to 85.13.132.92
Routing details for 85.13.132.92
[refresh/show] Cached whois for 85.13.132.92 : ip[at]all
Using last resort contacts ip[at]all
ip[at]all bounces (7 sent : 7 bounces)

I should be ip[at]all-inkl.com

Argh! More hyphenated address errors.

I fixed the top one but couldn't fix the bottom one, so I turned them over to Ellen, who is our routing guru.

- Don D'Minion - SpamCop Admin -

this one seems to have been fixed sent email to deputies on this one
edit: this one also seems to have been "fixed" but - reports to the reporting address have been disabled

edit: this was started prior to Don post that proceeds it but posted after it.

The main problem apprears to be the fact that the WhoIs lookup is broken. Any domain name that contains a hyphen get truncated at the hyphen. It appears that deputies are fixing each domain individually to obtain a correct reorting address, while the Whois information continues to be wrong.
Hopefully the Whois function can be fix which should then fix the problem for all domains rather than having to deal with each domain individually

So here's something I've wondered about these reporting addresses.... why does SpamCop not use the cached WHOIS information in some instances and instead use the postmaster address?

Example: http://www.spamcop.net/sc?id=z1886567134za...a738152ece2d5dz

I don't see notes that show attempts to send to the cached addresses are turned off or bounced, so doesn't sending to the 'postmaster' address actually reduce the effectivness of the report system?

FYI, this one is still not resolving correctly:

http://www.spamcop.net/sc?id=z1886995648z6...74e0064216c708z

Resolves to 195.137.213.130
Routing details for 195.137.213.130
[refresh/show] Cached whois for 195.137.213.130 : abuse[at]server
Using abuse net on abuse[at]server
Using best contacts abuse[at]server
abuse[at]server bounces (13 sent : 7 bounces)

Should be abuse[at]server-home.net

It seems strange that the system would even attempt to send email to a total bogus address.

This was also noted in my "follow-up" e-mail. As you note, the abuse[at]server bounces (13 sent : 7 bounces) seems very suspect.

Again, this is obviously a coding issue that needs the programming staff to get involved, which is what my "follow-up" e-mail stated. You know, after all this discussion and the repeated references, I am finally willing to agree with Don's word of ignored.

Trouble is, both Don and Ellen have said before, IIRC, they hold no sway with Engineering. Which has to be at least as frustrating for them as it is for the users affected. Defective (non)cycle IMO (no closed system remains in control without modifying feedback). We can only wonder about priorities ... well, it's evidently not a closed cycle. There's those pesky spammers constantly permeating the membrane, for a start.

Ellen sent me an e-mail yesterday advising that a ticket/bug report was opened up on this.

For the information of SC admins, see tracking link.

SC seems to get an incomplete reporting address ("abuse[at]btc") out of the WHOIS data for the IP address in question. I think this may have happened some time back, perhaps to the same contact.

-- rick

Moderator Edit: merged this new Topic into the existing Discussion about the same subject. PM sent to advise of the movement.

Yep, obviously the Ticket that Ellen submitted has yet to closed. In this case, the problem is shown at;

Tracking details
Display data:
"whois 79.100.44.177[at]whois.arin.net" (Getting contact from whois.arin.net )
Redirect to ripe
Display data:
"whois 79.100.44.177[at]whois.ripe.net" (Getting contact from whois.ripe.net)
Abuse address in 'remarks' field: abuse[at]btc-net.bg
whois.ripe.net found abuse contacts for 79.100.44.177 = abuse[at]btc
whois: 79.100.0.0 - 79.100.255.255 = abuse[at]btc
Routing details for 79.100.44.177
Using abuse net on abuse[at]btc
Using best contacts abuse[at]btc

Another hyphenated Domain name that gets broken by the parser's "tageting" routine.

Thanks for the archaeology, Wazoo. Yes, this is the thread I recalled. And, yes, the problem appears to be the same (pesky hyphens).

-- rick

I'm going ight now with that Don said he monitors this Forum section, did in fact apply at least one fix in the previous part of the Discussion ... if he doesn't say anything in a while, then an e-mail will be sent to request a manual update to that database ....

The best way to report problems involving goofy reporting addresses is to send the information, including a "TRACKING URL," to the deputies at deputies[at]admin.spamcop.net

- Don D'Minion - SpamCop Admin -
.

Thanks Don, email sent.

Acknowledgement from Richard that the fault is with engineering for attention. No mention of manual over-ride for this specific case but it appears it has been done:

http://www.spamcop.net/sc?action=rcache;ip=79.100.44.177

Traffic in the spamcop.routing newsgroup today shows that this problem still isn't yet fixed.

K... so someone please riddle me this:

Why does SpamCop choose the 'catch all' of postmaster[at]onet.ru for this report, when the cached email address is valid? I see this quite often.

http://www.spamcop.net/sc?id=z2141145199z7...13e30a17cf68d8z

SC appears to use the abuse.net result which you can see by hitting the [refresh/show] link in the parse - http://www.spamcop.net/sc?action=rcache;ip=91.189.242.249 (no record, using default).
Yeah, seems a bit wacky, the routing details show noc[at]onet.ru too - http://www.spamcop.net/sc?action=showroute...49;typecodes=17 - noting that is an admin address, not abuse as such.

If the admin address is more responsive the deputies should be alerted to change it, otherwise the default is postmaster when there's no abuse[at] I guess.

See, that's what I don't understand. If there's no abuse.net address, shouldn't the system send to the admins or NOC addresses? I'm not sure what the figures are, but it seems to me SC would get a faster response (if any) compared to sending to the catch-alls that may never be checked.

Maybe. Postmaster has a certain degree of functionality assumed, SC reports are intended to be helpful, not abusive, but just how they might be regarded by other registered addresses (when there is no registered abuse address) I have no idea - they are, after all and in this circumstance, unsolicited.

The system (at about 750 million reports a year) has to be largely automated and I'm guessing it needs to be conservative for that reason. I know that alternative report routing will always be considered - it just has to be justified/demonstrated as being 'better' than the existing/default where 'better' includes some assurance of acceptability to the ISP/network (who always has the option of refusing reports anyway - per http://www.spamcop.net/fom-serve/cache/92.html ).

See, I think that's counterproductive. If the listed people are the NOCs and/or the Admin for the ISPs/Hosts, they are responsible for the ISP/Host, so we should send that notification of abuse to all involved and let THEM say whether or not they want it.

Maybe I'm being overzealous on this and maybe people are checking the catch-alls, but I really think the admins/NOCs should be notified of abuse on the IPs they administer. Otherwise, they're not really deserving of the title, are they?

Couldn't agree more on what/how Admins/NOC *should* do/act Brandon - perhaps we're in a minority, but that wouldn't make us wrong. I wonder how many paying users add such addresses. It is a bit hard to get away from the dead hand of the default determination though, that will always be the overwhelming influence on report routing.

It would be good to know the official take on all of this, to be assured that this stuff is considered and reviewed and isn't just on 'autopilot'. Well, we know Ellen and Richard (for two) are flat out on monitoring stuff and inserting over-rides as required, generally providing intervention as required so it's not exactly a matter of being stuck on autopilot. But I just don't know enough.