Jump to content
RobiBue

amazonAWS reports sent to /dev/nul

Recommended Posts

Posted (edited)

Link removed due to giving out private information.... ? Sc admins? 

I was wondering if an admin, or someone with the ability to check the SC address entries can see and post here why the amazonAWS address is devnulled.

When I report manually to abuse amazonaws com I get both sentient and robot replies.

Can the devnull redirection be removed so that reports go again to their abuse desk?

They seem to be taking care of their spammers, but only if the spam can be reported...

I am not sure if abuse reports going to ipmanagement are actually going anywhere. I have seen 3 different abuse addresses listed for amazon aws and ec2, where ipmanagement seems like a fluke that ended up without an abuse address at amazon web services...

Edited by RobiBue
Link removed due to giving out private information.... ? Sc admins?

Share this post


Link to post
Share on other sites

I admit I do not know which of several reasons that amazonAWS reports are being devnulled.  But in general there are several possible reasons a spam report is not sent but directed to devnull.spamcop.net

  1. The intended recipient has ask SC not the send spam reports. (SC does not want to become a "spammer" sending unwanted email)
  2. spam Reports sent to the abuse address have bounced. (a report and bounce would just clutter the bandwidth)
  3. There is evidence that the recipient is in fact the spammer not a responsible ISP. (would serve no purpose)
  4. SC did not find a valid abuse address for the IP. (Record keeping only)

The Tracking URL report section does provide an explanation

Quote
Tracking message source: 50.112.130.188:

Routing details for 50.112.130.188
[refresh/show] Cached whois for 50.112.130.188 : abuse@amazonaws.com
Using abuse net on abuse{AT}amazonaws.com
abuse net amazonaws.com = abuse{AT}amazonaws.com
Using best contacts abuse{AT}amazonaws.com
Reports disabled for abuse{AT}amazonaws.com <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

 

Using abuse#amazonaws.com{AT}devnull.spamcop.net for statistical tracking.

"<<<<<<<<<<<<<<<<<" added

Share this post


Link to post
Share on other sites
On 3/2/2019 at 2:11 PM, Lking said:

I admit I do not know which of several reasons that amazonAWS reports are being devnulled.  But in general there are several possible reasons a spam report is not sent but directed to devnull.spamcop.net

  1. The intended recipient has ask SC not the send spam reports. (SC does not want to become a "spammer" sending unwanted email)
  2. spam Reports sent to the abuse address have bounced. (a report and bounce would just clutter the bandwidth)
  3. There is evidence that the recipient is in fact the spammer not a responsible ISP. (would serve no purpose)
  4. SC did not find a valid abuse address for the IP. (Record keeping only)

The Tracking URL report section does provide an explanation

"<<<<<<<<<<<<<<<<<" added

I just manually report those emails to abuse(at)amazonaws.com and ec2-abuse(at)amazon.com I do get replies back once they've received the spam report and when they've taken action or mitigated the activity of their subscriber/customer.

Share this post


Link to post
Share on other sites
13 minutes ago, Steve said:

I just manually report those emails to abuse(at)amazonaws.com and ec2-abuse(at)amazon.com I do get replies back once they've received the spam report and when they've taken action or mitigated the activity of their subscriber/customer.

They do act but are very bureaucratic. Try to work out where the SpamCop tracking URL is 
Hint it's at top of page BEFORE you submit report

Share this post


Link to post
Share on other sites
Has anyone gotten AmazonAWS spam originating from AAMC.org (American Association of Medical colleges) with the IP address 143.220.15.131?

I've gotten several and when reporting this IP addy through SC, it parses the email and comes back with an abuse address of shammond@aamc.org. But if I perform a whois on the IP address, I get dnsadministrator@aamc.org. shammond@aamc.org does not appear anywhere in a whois query nor did I find it on the AAMC website. 

 

Here's tracking URL for one of those emails:

https://www.spamcop.net/sc?id=z6530651814zff918c1118d7372ee13d0545ccf2e9d3z

 

Reporting it through SC to shammond@aamc.org or manually to dnsadministrator@aamc.org yields no response back that they've received it and/or have taken action against this IP address to stop/mitigate spam being sent from it.

 

Quote
Tracking message source: 143.220.15.131:

Routing details for 143.220.15.131
[refresh/show] Cached whois for 143.220.15.131 : shammond@aamc.org
Using last resort contacts shammond@aamc.org
Message is 12 hours old
143.220.15.131 not listed in cbl.abuseat.org
143.220.15.131 not listed in dnsbl.sorbs.net
143.220.15.131 not listed in accredit.habeas.com
143.220.15.131 not listed in plus.bondedsender.org
143.220.15.131 not listed in iadb.isipp.com

clicking on Routing details for 143.220.15.131
[refresh/show] reveals this info:

Tracking details

Display data:
"whois 143.220.15.131@whois.arin.net" (Getting contact from whois.arin.net )
Found AbuseEmail in whois dnsadministrator@aamc.org
143.220.0.0 - 143.220.255.255:dnsadministrator@aamc.org
Routing details for 143.220.15.131
Using abuse net on dnsadministrator@aamc.org
No abuse net record for aamc.org
Using default postmaster contacts postmaster@aamc.org

 

If that's the case, why doesn't SC send reports to the postmaster address then?

Share this post


Link to post
Share on other sites
Posted (edited)
On 3/17/2019 at 4:21 PM, Steve said:

Routing details for 143.220.15.131
Using abuse net on dnsadministrator@aamc.org
No abuse net record for aamc.org
Using default postmaster contacts postmaster@aamc.org
If that's the case, why doesn't SC send reports to the postmaster address then?

Hey Steve, 

I might be barking up the wrong blade of grass, but, have you tried logging this via:

http://forum.spamcop.net/forum/39-routing-report-address-issues/

Might be worth a shot?

Cheers!

Edited by MIG

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×