Sign in to follow this  
Followers 0
gotitbro

No Reporting Address Spamcop

5 posts in this topic

I got a spam email and when I parsed it through Spamcop it said this when trying to get the WHOIS details for the spam's IP address:

"No reporting addresses found for 5.39.250.190, using devnull for tracking" and gave this email for reporting nomaster@devnull.spamcop.net.

Aren't all IP address owners required to provide an abuse email? What is happening here?

Here is the IP address in question: https://www.whois.com/whois/5.39.250.190 For some reason the abuse contact is visible through the comments line for the IP range but not for this particular IP address in the main WHOIS content. The abuse email is visible in RIPE's own database though https://apps.db.ripe.net/db-web-ui/#/query?searchtext=5.39.250.190

Edited by gotitbro

Share this post


Link to post
Share on other sites

It always help to provide a tracking URL for an example particularly when your question is "What is happening here?"

When you can identify an abuse address that the parser does not, take a look at Routing/Reporting Address Issues and post your suggestion with why.  Look at some of the other post there. I would suggest ones looking at posted by C2H5OH a prolific researcher.

Share this post


Link to post
Share on other sites

@Lking Sorry, here is the report URL for it: https://www.spamcop.net/mcgi?action=gettrack&reportid=6751558359

I am a bit confused as to what the abuse email is for the spam IP address. As I said in the above comment while the abuse email for the IP range is given as info[at]abstation.net in the comments of raw WHOIS. The RIPE database shows the abuse email as abuse[at]abstation.net for that particular IP address.

Share this post


Link to post
Share on other sites
9 hours ago, gotitbro said:

@Lking Sorry, here is the report URL for it: https://www.spamcop.net/mcgi?action=gettrack&reportid=6751558359

I am a bit confused as to what the abuse email is for the spam IP address. As I said in the above comment while the abuse email for the IP range is given as info[at]abstation.net in the comments of raw WHOIS. The RIPE database shows the abuse email as abuse[at]abstation.net for that particular IP address.

That is not a tracking URL it is at top of reporting page before you submit

Here is your TRACKING URL - it may be saved for future reference:
https://www.spamcop.net/sc?id=z6423774938z1bb7a8859051af3f23e16abb4555efb1z

Often SpamCop can't find a report address because there isn't one or the ISP won't accept them
Windows WhoIs program I use  http://www.nirsoft.net/utils/ipnetinfo.html

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0