mrmaxx Posted February 4, 2014 Share Posted February 4, 2014 Tracking URL: http://www.spamcop.net/sc?id=z5711879852z5...add1d86052829cz Per RIPE, this is registered to ATMAN.PL. They have no contact information, however abuse.net recommends abuse[at]atman.pl and noc[at]atm.com.pl. Netblock: 91.240.160.0-91.240.163.255 Link to comment Share on other sites More sharing options...
petzl Posted February 5, 2014 Share Posted February 5, 2014 Tracking URL: http://www.spamcop.net/sc?id=z5711879852z5...add1d86052829cz Per RIPE, this is registered to ATMAN.PL. They have no contact information, however abuse.net recommends abuse[at]atman.pl and noc[at]atm.com.pl. Netblock: 91.240.160.0-91.240.163.255 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? Link to comment Share on other sites More sharing options...
mrmaxx Posted February 5, 2014 Author Share Posted February 5, 2014 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? The track is correct, however, SpamCop says "No reporting address found" for the spamvertised site, http://firearm[dot]incla[dot]ru/ Link to comment Share on other sites More sharing options...
petzl Posted February 5, 2014 Share Posted February 5, 2014 The track is correct, however, SpamCop says "No reporting address found" for the spamvertised site, http://firearm[dot]incla[dot]ru/ Resolves to 91.204.162.129 abuse[at]ncgroup.pl Yes http://www.spamhaus.org/sbl/query/SBL202505 Botnet spamming illegal drugs - web server hosting. IMO cert[at]cert.pl needs including the poles watching the abuse address are asleep at the wheel http://www.spamhaus.org/sbl/query/SBL188672 Link to comment Share on other sites More sharing options...
mrmaxx Posted February 5, 2014 Author Share Posted February 5, 2014 Resolves to 91.204.162.129 abuse[at]ncgroup.pl Yes http://www.spamhaus.org/sbl/query/SBL202505 Botnet spamming illegal drugs - web server hosting. IMO cert[at]cert.pl needs including the poles watching the abuse address are asleep at the wheel http://www.spamhaus.org/sbl/query/SBL188672 That works. I just wanna make sure someone is notified. Link to comment Share on other sites More sharing options...
Richard7310 Posted February 11, 2014 Share Posted February 11, 2014 Tracking URL: http://www.spamcop.net/sc?id=z5711879852z5...add1d86052829cz Per RIPE, this is registered to ATMAN.PL. They have no contact information, however abuse.net recommends abuse[at]atman.pl and noc[at]atm.com.pl. Netblock: 91.240.160.0-91.240.163.255 No contacts? e-mail: kscheuermann[at]kzvnr.de notify: auftrag[at]nic.telekom.de % This query was served by the RIPE Database Query Service version 1.71 (WHOIS4) Link to comment Share on other sites More sharing options...
Richard7310 Posted February 11, 2014 Share Posted February 11, 2014 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? Yes, abuse.net will display abuse[at]domain.com by default, in the ABSENCE of any other contact(s), but NOT in this case. When a default contact is displayed, it is followed by "(default, no info)." Link to comment Share on other sites More sharing options...
Richard7310 Posted February 12, 2014 Share Posted February 12, 2014 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? P.S. If an abuse.net address is bad, please share information with the abuse.net robot, update[at]abuse.net, using their standard format, or else postmaster[at]abuse.net, who would want evidence that an address is bad. Format sounds daunting, but can be simple. For address bad[at]example.com, send a plain-text e-mail... example.com: good[at]example.com For complete details, see http://www.abuse.net/addnew.phtml Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.