Jump to content
Sign in to follow this  
wkrick

BUG: Reporting tool cannot resolve Russian domain names

Recommended Posts

The reporting tool is having issues resolving Russian domain names.

This is a problem for me because the majority of spam I get these days is in Russian.

I think it's ultimately a character set/encoding problem that's faking out the reporting tool.

For example, when I mouse over the link in the Russian spam in Firefox, the domain looks like the screenshot below...

screencapo.jpg

But when I submit it through the SpamCop Reporting tool, I get this error...


Cannot resolve http://àëüôà-ãðóï.com.ua/kvoliti/

When I examine the source of the email, it appears that the email is using...

charset="windows-1251"

...and here's how the URL is actually encoded...

 

<DIV><A href=3D"http://=E0=EB=FC=F4=E0-=E3=F0=F3=EF.com.ua/kvoliti/"><FON=
T color=3D#0000ff size=3D4 
face=3DVerdana><B><U>=C1=EE=EB=FC=F8=E5 =E8=ED=F4=EE=F0=EC=E0=F6=E8=E8 =ED=
=E0 =F1=E0=E9=F2=E5 
>>></U></B></FONT></A></DIV>

Edited by wkrick

Share this post


Link to post
Share on other sites

Hi, wkrick,

...While the SpamCop parser does make an attempt to report spamvertized links, that is not at all an important consideration. There are other tools, such as Knujon and Complainterator, that are more appropriate for that purpose.

...The error wasn't fatal, was it (the parse results still enabled you to send complaints to the spam source abuse addresses, right?)?

Share this post


Link to post
Share on other sites
...The error wasn't fatal, was it (the parse results still enabled you to send complaints to the spam source abuse addresses, right?)?

Unfortunately, the source is bouncing abuse reports so the report gets devnulled...

Tracking message source: 79.99.130.226:

Routing details for 79.99.130.226

[refresh/show] Cached whois for 79.99.130.226 : abuse[at]troublefree.nl

Using abuse net on abuse[at]troublefree.nl

No abuse net record for troublefree.nl

Using best contacts abuse[at]troublefree.nl

abuse[at]troublefree.nl bounces (15 sent : 8 bounces)

Using abuse#troublefree.nl[at]devnull.spamcop.net for statistical tracking.

...and I get tons of email from these jerks daily. I just want it to stop.

Share this post


Link to post
Share on other sites
Unfortunately, the source is bouncing abuse reports so the report gets devnulled...
...But that's a separate issue from resolving spamvertized links. Please bear in mind that the principal purpose of SpamCop is to manage the SpamCop Blocklist (messages to abuse desks is a secondary, albeit useful, feature) and devnulling doesn't have an affect on whether your spam contributes to the BL.
...and I get tons of email from these jerks daily. I just want it to stop.
...Again, a separate issue from resolving spamvertized links. And you can always complain directly to whomever you can find to accomplish the goal of stopping the spam, if you can find the appropriate people/ organizations. And if these sources (IP addresses from which the spams originate) do wind up on the SCBL, the SCBL can be used to get them from falling into your Inbox.

Share this post


Link to post
Share on other sites
Unfortunately, the source is bouncing abuse reports so the report gets devnulled...

...and I get tons of email from these jerks daily. I just want it to stop.

...And you can always complain directly to whomever you can find to accomplish the goal of stopping the spam, if you can find the appropriate people/ organizations. ...
Sounds like a job for RIPE abuse-finder, brought to attention by cwg in http://forum.spamcop.net/forums/index.php?showtopic=11957

http://apps.db.ripe.net/dbweb/search/abuse-finder.html suggests two abuse addresses for 79.99.130.226 -

abuse[at]troublefree.nl

abuse[at]pcextreme.nl

The first one bounces, the second one is worth a try. Note it is not uncommon for abuse addresses to bounce SpamCop reports but accept private (manual) reports. The fact they bounce SC reports is not a good indication about their preparedness to address spam issues however.

Cross-reference added in the "routing" forum http://forum.spamcop.net/forums/index.php?showtopic=11969

Share this post


Link to post
Share on other sites

I am starting to see a good number of these and wondered if there were any plans to add detection and reporting for URLs using the international character encoding?

	Òåë.:   +7-911-959-89-48,	 
	ýë.ïî÷òà :  mail[at]sensorus.ru
	www.áåñêîíòà êòíûå-òåõíîëîãèè.ðô  

http://www.spamcop.net/mcgi?action=gettrac...rtid=5720953763

If I understand things properly I might as well do a quick report on these for now since the web link is being ignored by the full reporting. Is that the best solution?

Share this post


Link to post
Share on other sites
...Thank you for trying to provide the full parse for us, Stan_qaz, but unfortunately you and SpamCop staff are the only ones who can access that link. Please see information regarding the "Tracking link" for a link that most of us will be able to see.
If I understand things properly I might as well do a quick report on these for now since the web link is being ignored by the full reporting. Is that the best solution?
...You should be able to use any reporting method available to you, all will report the spam (if possible) and ignore the links that it can not interpret.

...Side note: quick reporting is a little (or very, for some) dangerous: please see the "WARNING" in the body of SpamCop FAQ entry "What Is Quick Reporting?"

Share this post


Link to post
Share on other sites

Thanks for the tip on the tracking URL, I have so few problems I don't post here often and messed that up. If I'm reading your link correctly there is no way to get a sharable link unless I keep the one on the reporting page as it isn't available elsewhere / later. Keeping a few more tabs available when I'm having a problem won't be much of a burden so I'll do that next time I have an issue.

I'll just filter these messages out and do quick reports on them, no sense wasting fuel on full reports if the links won't be used. So far I haven't has any major problems with quick reporting but keep an close eye on what is being done so if something does come up I'll catch it early.

Thanks.

Share this post


Link to post
Share on other sites

You can retrieve the tracking link/URL from within the "Past Reports" tab in your member account Stan (hit the "Parse" link in the selected and displayed report to get to it, near the top of the resulting page). It looks like

http://www.spamcop.net/sc?id=z5266044301z87c91e752269c0b484e02c9e60ebdba9z

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×