Jump to content


  • Content Count

  • Joined

  • Last visited

Community Reputation

0 Neutral

About driehuis

  • Rank
  1. driehuis

    RIPE changing WHOIS output

    I just had an interesting conversation with a German ISP about why they refuse Spamcop reports. As it turns out, they're upstream to the spam source, but the Spamcop WHOIS parser appears not to deal with the new RIPE "abuse-mailbox:" record. As a result, they get their downstream's complaints. They don't feel like developing a parser for Spamcop reports to auto-forward reports, but they do want to be informed when their downstream ignores complaints. I can sort of sympathize with that sentiment. I tried hunting this topic down in the forums, but found no resolution. Is Spamcop supposed to honor the "abuse-mailbox:" record? In my innocence, I would expect the RIPE database to trump the convoluted logic that currently seems to determine the reporting address for http://mailsc.spamcop.net/sc?action=rcache;ip= currently points to info[at]internet-total.net, which is an improvement over defaulting to their upstream, but the "abuse-mailbox:" record for PP1350-RIPE appears to be totally ignored (even though RIPE's WHOIS server spits it out as part of the reply for, in other words: it doesn't take any work to come by, and Spamcop does appear to have fresh WHOIS data for this IP). Just curious... I do not mind piling a bit of pressure on an upstream when their downstream hides behind them, but I don't want to complain to an upstream when the options with the registered owner of the netspace haven't been exhausted yet. Or abused for that matter -- if the problem turns out to be that lambdanet.net allowed their customers to move around their netspace to avoid blocking, the picture would look different (but the way it appears to me now is that lambdanet.net wants to do the right thing but somehow tickled someone the wrong way). The "abuse-mailbox:" WHOIS record looks like a good idea, but it only helps if it is being used...