marc1

ah, sorry missed that. So this IP block falls under RIPE NCC. I did a database lookup at RIPE.net and found an email address for the block. turetzsr, thanks for the reply.

Tracking URL: http://www.spamcop.net/sc?id=z5373351730zb...bde8765873ee04z Tracking message source: 37.246.35.109: Display data: "whois 37.246.35.109[at]whois.arin.net" (Getting contact from whois.arin.net ) Redirect to ripe Display data: "whois 37.246.35.109[at]whois.ripe.net" (Getting contact from whois.ripe.net) Lookup irt-shatrans[at]whois.ripe.net Display data: "whois irt-shatrans[at]whois.ripe.net" (Getting contact from whois.ripe.net) irt-shatrans = Lookup sph11-ripe[at]whois.ripe.net Display data: "whois sph11-ripe[at]whois.ripe.net" (Getting contact from whois.ripe.net) sph11-ripe = whois.ripe.net 37.246.35.109 (nothing found) No reporting addresses found for 37.246.35.109, using devnull for tracking. SpamCop reports sph11-ripe to be null, but I looked up sph11 on RIPE.NET and got: person: Serghei Petrovici Holicin address: Molodova MD-2064, Chisnau, str. Ion Pelivan 13, ap. 32 phone: +37379549229 e-mail: sholichin[at]shatrans.md nic-hdl: SPH11-RIPE mnt-by: SHA-MNT changed: sholichin at shatrans.md 20120326 source: RIPE And sph11 is responsible for the IP 37.246.35.109 as you can see here. So sholichin at shatrans.md should be listed for IPs 37.246.1.0-37.246.255.255

The good news is that SingleHop is no longer hosting the websites, but I continue to get a lot of spam from the same group of IPs. I have been reporting the IPs for months, but SpamCop continues to send the reports to nomaster which I realize is good for the database, but how can I get the notifications sent out to the proper contact as well? Just in the past 24 hours, the following IPs have been used: 37.246.35.109 37.246.35.135 37.246.35.25 How can I figure out the upstream provider?

d'oh. excellent point.

A question I have wondered for a long time and never found the answer...how to deal with unique URLs when reporting spam? These days a good amount of the spam I get use unique/tracking URLs. I assume some spam complaints eventually make it back to the spammer, so reporting these emails with the unique URLs intact allow the spammer to know exactly who reported them. This seems like a bad idea. Any suggestions on how to deal with this? Put another way, if SpamCop munges our email address, why not munge unique/tracking URLs as well?

singlehop.com is back at it. According to Spamcop, singlehop.com is hosting mynewfall.com. This site is referenced in a lot of the spam I get. Interestingly these emails originate from IPs with no contact info, such as: 37.246.10.200 37.246.11.149 37.246.9.94 37.246.10.43 37.246.11.244 Complaints to SingleHop are clearly having no impact as this has been going on for years (see previous comments in thread). Any idea who the upstream provider is for either the originating IPs or for SingleHop? Any other suggestions for getting this resolved? :angry:

Sent via PM. I should clarify that I don't know reports are going directly to the spammer, but I also haven't seen any progress in weeks of reporting. I am familiar enough with Spamcop to know that usually after a report or two, things typically get resolved. In this case nothing seems to be happening after many reports.

For the past few weeks I have been getting spam from the same two hosting providers. They use a pool of IP addresses. I report each incident, but nothing happens -- still getting spam from them. They seem to be both sending the spam and getting the abuse reports. At what point and how do I report the abuse upstream? Thanks.

d'oh. i missed the part of the email from SpamCop Admin that said: Problem has been resolved.

I reported my mail hosts and my account is still disabled. Before I bug the admins, wondering if I am missing something. Any suggestions?

it seems to me there are two ways that spamcop works. one is the blacklist, the second is notifying the ISP that they are sending spam. What is the point of sending abuse notifications if the ISP doesn't address the issue? Does it make sense in those cases to alert the upstream provider?

I started getting bunch of spam on a daily basis that originates from IPs owned by singlehop.com. Reports are being sent to abuse[at]singlehop.com, but the spam keeps coming. The IPs are never the same. Also seeing similar situation from from softlayer.com and cologuys.com. What is the best way to deal with this. Seems like the ISP has no interest in stopping spam being sent via their servers.

How do I lookup this information myself? Hate to keep troubling the community for this info.

Hey Steve. I don't. Is LogicWeb their upstream provider? I am not sure how to find out.

Similar to another a previous topic I started about another IP, this IP seems to report the wrong person. It lists alexgarcia.solutions at gmail. That doesn't sound right. I am also having the same problem where I am getting spam from a range of IP addresses: 173.244.51.248 173.244.50.217 173.244.44.16 173.244.45.239 173.244.45.159 173.244.45.166 How can I tell who is the upstream provider? Or who should these reports be going to? Thanks in advance.