Jump to content
Sign in to follow this  
ArtmakersWorlds

nomaster devnull

Recommended Posts

Hope I put this in the right place.

Why do I keep getting this?

No reporting addresses found for 5.101.40.80, using devnull for tracking.

No reporting address? It came to me from somewhere. Why is it I can't seem to report these?

Share this post


Link to post
Share on other sites
No reporting address? It came to me from somewhere. Why is it I can't seem to report these?
The party that "owns" this IP address is supposed to register one or more contact addresses with the registry that issued the address, so (for example) they can be reached in cases of abuse of the address. In this case, they failed to do so, so SpamCop can't send a report to them. The IP address is retained by SpamCop, however, and may go onto (or remain on) a blocking list if the spamming continues.

-- rick

Share this post


Link to post
Share on other sites

Interesting case. That network:

inetnum: 5.101.0.0 - 5.101.95.255

netname: antoss-net

descr: net for ISP Antoss ltd.

country: RU

org: ORG-Al246-RIPE

(unusual scope - smaller than a /17, larger than a /18)

... doesn't rate highly in the spam stakes at all:

... doesn't bother the radar in http://www.spamcop.net/w3m?action=map;mask...cnt;sort=ipsort

... and I only see one SC report in the last 90 days (if you have a reporting credit/are a paying member you can retrieve that information).

... Senderbase - http://www.senderbase.org/ - finds nothing at all for the IP address or even for 5.101.40.0/24 (5.101.40.0 - 5.101.40.255).

Yes, yes ArtmakersWorlds, you are "privileged" ;) As Rick says, if the spam continues (and it is reported) it will, at least, keep accruing data for the SCbl but it would need to be hitting other reporters as well before it might be listed.

On current indications there's no need to do more about this one. The RIPE record shows only an organization address (antoss[at]gmail.com) which is not an abuse address and not worth bothering at this point. All "no master" cases will have some sort of a story behind them and, generally, no sleep should be lost over that. Where there's substantial spamming and the parser fails to find an evident/likely reporting address or a no-report over-ride is possibly outdated, that's another story and there's a sub-forum for that (http://forum.spamcop.net/forums/index.php?showforum=39).

Share this post


Link to post
Share on other sites

Interesting case. That network:

inetnum: 5.101.0.0 - 5.101.95.255

netname: antoss-net

descr: net for ISP Antoss ltd.

country: RU

org: ORG-Al246-RIPE

(unusual scope - smaller than a /17, larger than a /18)

Spammers often get into IP hopping to avoid blocklists

Share this post


Link to post
Share on other sites

I just don't understand half of what you folks talk about. I guess I'll keep on hitting send even if it says devnull. Hope that's good enough.

Share this post


Link to post
Share on other sites

Hi, ArtmakersWorlds,

...The quick, simplified answer to your original question is that the SpamCop parser (which provided the message about which you are asking) isn't looking for the e-mail address that sent the message, it is looking for an "official" address to send a complaint but can't find one.

Share this post


Link to post
Share on other sites

Hello,

I'm chiming in because I've been receiving academic spams (promotion of conferences) out of a Jordanian university using a dirty list for some time. The parses always get a nomaster at devnull for the sending host mail1.just.edu.jo whose IP is 87.236.232.130.

Here are examples: [edited to provide proper tracking links]

https://www.spamcop.net/sc?id=z6024914306ze257ce5d677054e5ca27c8613c3b4074z

https://www.spamcop.net/sc?id=z6034533535z3caace670fe85aa1999af4182a003d4fz

https://www.spamcop.net/sc?id=z6032268933zec6ff5cebc9582e426c400d05bcb3c1fz

https://www.spamcop.net/sc?id=z6025536261z292043ba8f3b15572f5f8ce5b1cec804z

https://www.spamcop.net/sc?id=z6033078631zf3c93670b9d6c39976520477bb952c44z

I'm willing to do the legwork to fix the problem, but want some advice on how to proceed. Do I need to contact an admin at mail1.just.edu.jo to point out that their RIPE info is wrong? Do I have a snowball's chance in Hades of making a difference?

I'm getting pings back from semi-innocent bystanders whose URLs are spamvertized, but I realize the real force of SC is not being properly applied.

Thanks for your advice in advance.

EDIT:

According to https://who.is/whois-ip/ip-address/87.236.232.130 :

% Abuse contact for '87.236.232.0 - 87.236.233.255' is 'mayyad[at]junet.edu.jo'
Edited by lartingyou

Share this post


Link to post
Share on other sites

Hello lartingyou. Unfortunately many users of this forum won't be able to view the reports you linked to, I was given "Sorry, you are not authorized to view this message."

What some of us would find more useful are the tracking links that are shown when manually reporting spam rather than links to the actual reports.

Share this post


Link to post
Share on other sites

What some of us would find more useful are the tracking links...

My bad! I've been away too long and made a "beginner" mistake. I edited the original post above to fix this.

Come to think of it, so many people make this mistake that perhaps the "past reports" UI could also provide tracking links. Engineers can recognize a bad design when enough people are making the same mistake.

Edited by lartingyou

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×