Jump to content

Spamcop still using tanetadm#moe.edu.tw[at]devnull.spamcop.net


Recommended Posts

The correct reporting address is abuse[at]ntu.edu.tw for

inetnum: 140.112.0.0 - 140.112.255.255

netname: TANET

descr: Taiwan Academic Network

descr: Ministry of Education computer Center

descr: 12F, No 106, Sec. 2, Heping E. Rd., Taipei

country: TW

admin-c: TA61-AP

tech-c: TA61-AP

mnt-by: MAINT-TW-TWNIC

changed: hostmaster[at]twnic.net.tw 20030908

changed: hm-changed[at]apnic.net 20040926

status: ALLOCATED PORTABLE

source: APNIC

person: TANET ADMIN

nic-hdl: TA61-AP

e-mail: tanetadm[at]moe.edu.tw

address: 12F, No 106, Sec. 2, Heping E. Rd., Taipei

address: Taipei, 106, R.O.C

phone: +886-2-2737-7044

fax-no: +886-2-2737-7043

country: TW

changed: hostmaster[at]twnic.net.tw 20090212

mnt-by: MAINT-TW-TWNIC

source: APNIC

inetnum: 140.112.0.0 - 140.112.255.255

netname: T-NTU.EDU.TW-NET

descr: National Taiwan University

descr: Taipei Taiwan

country: TW

admin-c: AN187-TW

tech-c: AN187-TW

mnt-by: MAINT-TW-TWNIC

remarks: This information has been partially mirrored by APNIC from

remarks: TWNIC. To obtain more specific information, please use the

remarks: TWNIC whois server at whois.twnic.net.

changed: chuang[at]mail.moe.gov.tw 19900324

status: ASSIGNED NON-PORTABLE

source: TWNIC

person: ADMIN NTU

address: National Taiwan University

address: Taipei Taiwan

e-mail: abuse[at]ntu.edu.tw

nic-hdl: AN187-TW

changed: hostmaster[at]twnic.net.tw20090116

source: TWNIC

Link to comment
Share on other sites

  • 11 months later...
oitc.com' post='71640' date='May 25 2009, 10:12 AM']The correct reporting address is abuse[at]ntu.edu.tw...

Spamcop is still forwarding complaints to tanetadm[at]moe.edu.tw

Submitted: Sunday, May 09, 2010 7:19:48 PM -0500:

ATM Card Value is $1,000,000,00 Million USD

* 4939297280 ( 210.59.14.2 ) To: tanetadm#moe.edu.tw[at]devnull.spamcop.net

Apparently not enough spam coming from Taiwanese sources for Spamcop to bother fixing this, even

after over a year?

Link to comment
Share on other sites

tanetadm#moe.edu.tw[at]devnull.spamcop.net
Notice the "devnull" part of that address.

We don't send reports to tanetadm[at]moe.edu.tw because they feed the "From" address of our report to a spam list and start sending to it.

oitc.com' post='71640' date='May 25 2009, 09:12 AM']The correct reporting address is abuse[at]ntu.edu.tw for

inetnum: 140.112.0.0 - 140.112.255.255

We are currently sending reports for 140.112.0.0 - 140.112.255.255 to abuse[at]ntu.edu.tw, and have been for some time.

- Don D'Minion - SpamCop Admin -

.

Link to comment
Share on other sites

Notice the "devnull" part of that address.

Noted, and noted the rationale for this. However, unlike almost every other Spamcop reporting

breakout I've seen, no mention is made in the report that reports are being forwarded to

abuse[at]ntu.edu.tw.

Here's the breakout of the response I received:

Tracking message source: 210.59.14.2:

Routing details for 210.59.14.2

[refresh/show] Cached whois for 210.59.14.2 : tanetadm[at]moe.edu.tw

Using best contacts tanetadm#moe.edu.tw[at]devnull.spamcop.net

Message is 35 hours old

210.59.14.2 not listed in dnsbl.njabl.org ( 127.0.0.8 )

210.59.14.2 not listed in dnsbl.njabl.org ( 127.0.0.9 )

210.59.14.2 not listed in cbl.abuseat.org

210.59.14.2 not listed in dnsbl.sorbs.net

210.59.14.2 not listed in accredit.habeas.com

210.59.14.2 not listed in plus.bondedsender.org

210.59.14.2 not listed in iadb.isipp.com

Finding links in message body

Parsing text part

no links found

Reports regarding this spam have already been sent:

Re: 210.59.14.2 (Administrator of network where email originates)

Reportid: 4939297280 To: tanetadm#moe.edu.tw[at]devnull.spamcop.net

If reported today, reports would be sent to:

Re: 210.59.14.2 (Administrator of network where email originates)

tanetadm#moe.edu.tw[at]devnull.spamcop.net

Nowhere in the above report does it indicate that the report was forwarded

to abuse[at]ntu.edu.tw. In other words, there is no way I could have known

that the report was being forwarded to abuse[at]ntu.edu.tw if you hadn't told me here.

Link to comment
Share on other sites

If reported today, reports would be sent to:

Re: 210.59.14.2 (Administrator of network where email originates)

tanetadm#moe.edu.tw[at]devnull.spamcop.net[/i]

Nowhere in the above report does it indicate that the report was forwarded

to abuse[at]ntu.edu.tw. In other words, there is no way I could have known

that the report was being forwarded to abuse[at]ntu.edu.tw if you hadn't told me here.

210.59.14.2 is not a part of the 140.112.0.0 - 140.112.255.255 network so this report was NOT sent to abuse[at]ntu.edu.tw

C:\Documents and Settings\sunderwood>whois 210.59.14.2

% [whois.apnic.net node-2]

% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnum: 210.59.0.0 - 210.59.127.255

netname: TANET

descr: Taiwan Academic Network

country: TW

admin-c: TA61-AP

tech-c: TA61-AP

mnt-by: MAINT-TW-TWNIC

changed: snw[at]www.edu.tw 19980908

status: ALLOCATED PORTABLE

source: APNIC

person: TANET ADMIN

nic-hdl: TA61-AP

e-mail: tanetadm[at]moe.edu.tw

address: 12F, No 106, Sec. 2, Heping E. Rd., Taipei

address: Taipei, 106, R.O.C

phone: +886-2-2737-7044

fax-no: +886-2-2737-7043

country: TW

changed: hostmaster[at]twnic.net.tw 20090212

mnt-by: MAINT-TW-TWNIC

source: APNIC

inetnum: 210.59.14.0 - 210.59.14.255

netname: T-LHVS.TN.EDU.TW-NET

descr: LIU HSIN HOME ECONOMIC AND COMMERCIAL VOCATION SENIOR HIGH SCHOOL

descr: TAINAN Taiwan

country: TW

admin-c: CNH-TW

tech-c: CNH-TW

mnt-by: MAINT-TW-TWNIC

remarks: This information has been partially mirrored by APNIC from

remarks: TWNIC. To obtain more specific information, please use the

remarks: TWNIC whois server at whois.twnic.net.

changed: chuang[at]mail.moe.gov.tw 19990921

status: ASSIGNED NON-PORTABLE

source: TWNIC

person: CHING-NII HSIEH

address: LIU HSIN HOME ECONOMIC AND COMMERCIAL VOCATION SENIOR HIGH SCHOOL

address: TAINAN Taiwan

e-mail: TCNH1[at]maillhvs.tn.edu.tw

nic-hdl: CNH-TW

changed: hostmaster[at]twnic.net.tw19991015

source: TWNIC

C:\Documents and Settings\sunderwood>

Link to comment
Share on other sites

  • 2 weeks later...

When digging into this, I found that to get the proper abuse report to address, this whole block (140.117.0.0 - 140.138.255.255) needs to be interrogated against:

whois.twnic.net

And not whois.apnic.net

That returns an email address which returns a valid abuse.net lookup.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...