Jump to content
Sign in to follow this  
mMerlin

Parser lookup choked

Recommended Posts

Tracking URL: http://www.spamcop.net/sc?id=z5726040040z8...91cfb6d00e5bb8z

whois.ripe.net 212.28.246.106 (nothing found)

Display Data

%ERROR:201: access denied for 184.94.240.90

%

% Sorry, access from your host has been permanently

% denied because of a repeated excessive querying.

Looks like spamcop needs to spread the load better across multiple query sources.

Manual lookup through http://apps.db.ripe.net/search/abuse-finder.html says

abuse[at]cyberia.net.lb

Do the reports dev nulled to nomaster[at]devnull.spamcop.net trigger any followup to locate appropriate information for later reports?

Edited by mMerlin

Share this post


Link to post
Share on other sites

Haven't seen that parser error in a good long time mMerlin, this observation deserves its own topic. SC Admin may well be most interested.

If you re-visit your parse (click the link you gave) you will see the report routing is now fine. Can only join you in hoping SC can juggle things somehow to avoid it happening regularly.

Share this post


Link to post
Share on other sites

Can not tell from reviewing the changes through the tracking link if the problem is really fixed or not. The original error was reporting a specific source IP. Due to whatever load balancing is being done, the 'retry' may have used a different host that is not, and never was, blocked.

Share this post


Link to post
Share on other sites

Just got another one:

No reporting addresses found for 81.19.135.139, using devnull for tracking.

with details of:

$ whois 81.19.135.139[at]whois.ripe.net

[whois.ripe.net]

% This is the RIPE Database query service.

% The objects are in RPSL format.

%

% The RIPE Database is subject to Terms and Conditions.

% See http://www.ripe.net/db/support/db-terms-conditions.pdf

%ERROR:201: access denied for 184.94.240.90

%

% Sorry, access from your host has been permanently

% denied because of a repeated excessive querying.

% For more information, see

% http://www.ripe.net/data-tools/db/faq/faq-...1-access-denied

That is the same IP. Need to either get it allowed again, or take it off the queue so that it is does not keep rejecting reports. User Notification sent to service[at]ivc.nnov.ru, pointed to by ripe abuse-finder

Share this post


Link to post
Share on other sites

This is still happening, (10 minutes ago) with the same [spamcop server] ip (184.94.240.90). REALLY need to get that machine removed from the list that does lookup on ripe. Or convince ripe to add it as an exception for their 'excessive querying' limit.

And spamcop will not let me manually add the correct reporting address :(

auftrag[at]nic.telekom.de according to https://apps.db.ripe.net/search/abuse-finder.html

$ whois 87.184.88.107[at]whois.ripe.net

[whois.ripe.net]

% This is the RIPE Database query service.

% The objects are in RPSL format.

%

% The RIPE Database is subject to Terms and Conditions.

% See http://www.ripe.net/db/support/db-terms-conditions.pdf

%ERROR:201: access denied for 184.94.240.90

%

% Sorry, access from your host has been permanently

% denied because of a repeated excessive querying.

% For more information, see

% http://www.ripe.net/data-tools/db/faq/faq-...1-access-denied

% This query was served by the RIPE Database Query Service version 1.72 (DBC-WHOIS3)

Share this post


Link to post
Share on other sites

RIPE lookups have not worked here since they added the "-B" flag IIRC. I know there were still newsgroups when it first became an issue. See this thread from nine years ago. Frankly I'm surprised sc still tries to whois the RIPE server since it has not been able to parse such results for many years.

OTOH, 87.184.88.107 is listed in bl.spamcop.net as well as cbl.abuseat.org.

Edited by SpamCop 98

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×