gotitbro Posted December 6, 2017 Share Posted December 6, 2017 I got a spam email and when I parsed it through Spamcop it said this when trying to get the WHOIS details for the spam's IP address: "No reporting addresses found for 5.39.250.190, using devnull for tracking" and gave this email for reporting nomaster@devnull.spamcop.net. Aren't all IP address owners required to provide an abuse email? What is happening here? Here is the IP address in question: https://www.whois.com/whois/5.39.250.190 For some reason the abuse contact is visible through the comments line for the IP range but not for this particular IP address in the main WHOIS content. The abuse email is visible in RIPE's own database though https://apps.db.ripe.net/db-web-ui/#/query?searchtext=5.39.250.190 Link to comment Share on other sites More sharing options...
Lking Posted December 6, 2017 Share Posted December 6, 2017 It always help to provide a tracking URL for an example particularly when your question is "What is happening here?" When you can identify an abuse address that the parser does not, take a look at Routing/Reporting Address Issues and post your suggestion with why. Look at some of the other post there. I would suggest ones looking at posted by C2H5OH a prolific researcher. Link to comment Share on other sites More sharing options...
gotitbro Posted December 6, 2017 Author Share Posted December 6, 2017 @Lking Sorry, here is the report URL for it: https://www.spamcop.net/mcgi?action=gettrack&reportid=6751558359 I am a bit confused as to what the abuse email is for the spam IP address. As I said in the above comment while the abuse email for the IP range is given as info[at]abstation.net in the comments of raw WHOIS. The RIPE database shows the abuse email as abuse[at]abstation.net for that particular IP address. Link to comment Share on other sites More sharing options...
petzl Posted December 6, 2017 Share Posted December 6, 2017 9 hours ago, gotitbro said: @Lking Sorry, here is the report URL for it: https://www.spamcop.net/mcgi?action=gettrack&reportid=6751558359 I am a bit confused as to what the abuse email is for the spam IP address. As I said in the above comment while the abuse email for the IP range is given as info[at]abstation.net in the comments of raw WHOIS. The RIPE database shows the abuse email as abuse[at]abstation.net for that particular IP address. That is not a tracking URL it is at top of reporting page before you submit Here is your TRACKING URL - it may be saved for future reference:https://www.spamcop.net/sc?id=z6423774938z1bb7a8859051af3f23e16abb4555efb1z Often SpamCop can't find a report address because there isn't one or the ISP won't accept them Windows WhoIs program I use http://www.nirsoft.net/utils/ipnetinfo.html Link to comment Share on other sites More sharing options...
gotitbro Posted December 7, 2017 Author Share Posted December 7, 2017 @petzl Thanks I did not know this about the tracking URL. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.