Jump to content
Sign in to follow this  
mrmaxx

No reporting addresses found for 193.19.77.73

Recommended Posts

Doesn't affect the found abuse address at all, but has routing changed since you reported? Can't see that IP address in the report linked.

Share this post


Link to post
Share on other sites

Doesn't affect the found abuse address at all, but has routing changed since you reported? Can't see that IP address in the report linked.

Probably has, based on the new parse.

Share this post


Link to post
Share on other sites

Tracking URL: http://www.spamcop.net/sc?id=z5632489121z1...7f605f99d45803z

SpamCop appears not to be able to talk to RipeStat and get the abuse contact information. For 193.19.76.0/23, the abuse contact is abuse[at]completel.fr

I beg to differ: % Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net'

% This query was served by the RIPE Database Query Service version 1.70.1 (ld 274) per SmartWhois®, Copyright © 1998-2013 TamoSoft, Version 5.1 (Build 274)

Share this post


Link to post
Share on other sites

I beg to differ: % Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net'

% This query was served by the RIPE Database Query Service version 1.70.1 (ld 274) per SmartWhois®, Copyright © 1998-2013 TamoSoft, Version 5.1 (Build 274)

I've noticed that sometimes the "abuse" address in the whois info and the abuse contact provided by RipeStat are different. Not sure if this is the case, but I was going directly to RIPE's website, so that would seem to be the "authoritative" person, unless the IP address is portable and has a new host.

Share this post


Link to post
Share on other sites

I've noticed that sometimes the "abuse" address in the whois info and the abuse contact provided by RipeStat are different. Not sure if this is the case, but I was going directly to RIPE's website, so that would seem to be the "authoritative" person, unless the IP address is portable and has a new host.

Agreed that abuse contacts vary, but not sure if you mean any whois or RIPE Whois, compared to RipeStat. I was not so clear myself: Smart Whois does not show an ABUSE contact in this instance; rather, only ADMIN & TECH, noc[at]ddo.net & support[at]ddo.net, respectively. So, I clicked View Source, which opens a new window, where the footnote is '% This query was served by the RIPE Database Query Service version 1.70.1 (WHOIS1),' which has always seemed authoritative enough.

Looking for a good address

In the latter RIPE query. a new heading appears for the range within which the query exists, either '% Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net,' as in this case, or '% No Abuse contact registered for [n.n.n.n. - n.n.n.n].' However, a different contact may sometimes appear further down on an 'abuse-mailbox:' line, such that RIPE may be inconsistent within itself, aside from any possible difference with x-whois. The usually-present line, 'e-mail:,' and often-present line, 'notify:,' are worth a look & comparison, especially in the absence of an abuse contact, though an ADMIN or TECH role may be indicated. Sometimes, there is a 'remarks:' line, usually about using only a certain address. I find myself clicking on View Source for so many reasons, suffice it to say most of the time, without getting into a flow-chart situation now. I suppose that this is the RIPE mess currently being programmed.

Share this post


Link to post
Share on other sites

Agreed that abuse contacts vary, but not sure if you mean any whois or RIPE Whois, compared to RipeStat. I was not so clear myself: Smart Whois does not show an ABUSE contact in this instance; rather, only ADMIN & TECH, noc[at]ddo.net & support[at]ddo.net, respectively. So, I clicked View Source, which opens a new window, where the footnote is '% This query was served by the RIPE Database Query Service version 1.70.1 (WHOIS1),' which has always seemed authoritative enough.

Looking for a good address

In the latter RIPE query. a new heading appears for the range within which the query exists, either '% Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net,' as in this case, or '% No Abuse contact registered for [n.n.n.n. - n.n.n.n].' However, a different contact may sometimes appear further down on an 'abuse-mailbox:' line, such that RIPE may be inconsistent within itself, aside from any possible difference with x-whois. The usually-present line, 'e-mail:,' and often-present line, 'notify:,' are worth a look & comparison, especially in the absence of an abuse contact, though an ADMIN or TECH role may be indicated. Sometimes, there is a 'remarks:' line, usually about using only a certain address. I find myself clicking on View Source for so many reasons, suffice it to say most of the time, without getting into a flow-chart situation now. I suppose that this is the RIPE mess currently being programmed.

Yeah. I usually check RIPE whois and RIPESTAT both. Sometimes even if there is an abuse contact in the RIPE whois, they will show a different abuse contact in RIPESTAT, which I find interesting. If neither of those works, or if the suggested RIPE/RIPESTAT contact is no good to SpamCop, I'll often do a traceroute and try to find the first hop above the host and complain to them. There's been a couple times I"d have to go three or four hops upstream to report and I figure by that time, there's no use reporting and I'll just have to let SC report to /DEV/NULL

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×