mrmaxx 0 Posted February 4, 2014 (edited) Tracking URL: http://www.spamcop.net/sc?id=z5711879852z5...add1d86052829cz Per RIPE, this is registered to ATMAN.PL. They have no contact information, however abuse.net recommends abuse[at]atman.pl and noc[at]atm.com.pl. Netblock: 91.240.160.0-91.240.163.255 Edited February 4, 2014 by mrmaxx Share this post Link to post Share on other sites
petzl 0 Posted February 5, 2014 Tracking URL: http://www.spamcop.net/sc?id=z5711879852z5...add1d86052829cz Per RIPE, this is registered to ATMAN.PL. They have no contact information, however abuse.net recommends abuse[at]atman.pl and noc[at]atm.com.pl. Netblock: 91.240.160.0-91.240.163.255 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? Share this post Link to post Share on other sites
mrmaxx 0 Posted February 5, 2014 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? The track is correct, however, SpamCop says "No reporting address found" for the spamvertised site, http://firearm[dot]incla[dot]ru/ Share this post Link to post Share on other sites
petzl 0 Posted February 5, 2014 The track is correct, however, SpamCop says "No reporting address found" for the spamvertised site, http://firearm[dot]incla[dot]ru/ Resolves to 91.204.162.129 abuse[at]ncgroup.pl Yes http://www.spamhaus.org/sbl/query/SBL202505 Botnet spamming illegal drugs - web server hosting. IMO cert[at]cert.pl needs including the poles watching the abuse address are asleep at the wheel http://www.spamhaus.org/sbl/query/SBL188672 Share this post Link to post Share on other sites
mrmaxx 0 Posted February 5, 2014 Resolves to 91.204.162.129 abuse[at]ncgroup.pl Yes http://www.spamhaus.org/sbl/query/SBL202505 Botnet spamming illegal drugs - web server hosting. IMO cert[at]cert.pl needs including the poles watching the abuse address are asleep at the wheel http://www.spamhaus.org/sbl/query/SBL188672 That works. I just wanna make sure someone is notified. Share this post Link to post Share on other sites
Richard7310 0 Posted February 11, 2014 Tracking URL: http://www.spamcop.net/sc?id=z5711879852z5...add1d86052829cz Per RIPE, this is registered to ATMAN.PL. They have no contact information, however abuse.net recommends abuse[at]atman.pl and noc[at]atm.com.pl. Netblock: 91.240.160.0-91.240.163.255 No contacts? e-mail: kscheuermann[at]kzvnr.de notify: auftrag[at]nic.telekom.de % This query was served by the RIPE Database Query Service version 1.71 (WHOIS4) Share this post Link to post Share on other sites
Richard7310 0 Posted February 11, 2014 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? Yes, abuse.net will display abuse[at]domain.com by default, in the ABSENCE of any other contact(s), but NOT in this case. When a default contact is displayed, it is followed by "(default, no info)." Share this post Link to post Share on other sites
Richard7310 0 Posted February 12, 2014 That track correct? Abuse net will by default use abuse[at]domian by default even if it bounces 91.240.160.0-91.240.163.255 is Germany not Poland? P.S. If an abuse.net address is bad, please share information with the abuse.net robot, update[at]abuse.net, using their standard format, or else postmaster[at]abuse.net, who would want evidence that an address is bad. Format sounds daunting, but can be simple. For address bad[at]example.com, send a plain-text e-mail... example.com: good[at]example.com For complete details, see http://www.abuse.net/addnew.phtml Share this post Link to post Share on other sites
