Jump to content

[Resolved] Who gets Reports


Lking

Recommended Posts

I admit to being lazy. Because of the time required to track down all the IP addresses, links and proper "postmaster[at]" addresses I let SpamCop do all the work. I check the list befor <send report> to make sure ebay or my ISP, etc. don't get reports, but basicly if SC picks them I send them.

I have noticed that in some cases one domin will get several copies of the report, for example:

http://www.spamcop.net/sc?id=z765826921z98...4cc7e1afcc7299z

Re: http://www.canonicals.donjmdon4.com/?cbep8d6scg... (Administrator of network hosting website referenced in spam)

To: postmaster[at]chinatietong.com (Notes)

To: crnet_mgr[at]chinatietong.com (Notes)

To: crnet_tec[at]chinatietong.com (Notes)

Now chinatietong.com rides close to the bottom of my list of prefered domains along with kornet and comcast. But when I get several emails with the same subject, addressed to lking[at]x.com, webmaster[at]x.com, postmaster[at]x.com etc they go to the trash bin without thought.

How does spam I receive differ from the reports sent to chinatietong?

Link to comment
Share on other sites

Not sure I totally understand the question ... based on what I think you're asking, take a look at http://forum.spamcop.net/forums/index.php?showtopic=4082 ... basically, there is a real issue in attempting to extract "the" appropriate address from the various (WHOIS-type) databases .... in some cases, addresses are known to be bad, someone has done the research, submitted the data to the spamcop.routing newsgroup and a SpamCop internal database was massaged ... maybe I'm close to answering something ..???

Link to comment
Share on other sites

Not sure I totally understand the question ...

The question is (I guess):

When parsing a 'website referenced in spam' is it productive to send the Administrators of the network three emails (postmaster[at] crnet_mgr[at] crnet_tec[at]chinatietong.com) instead of just one?

Jeff G. I tryed to check abuse.net, but of course they were not available when I tried. From what I read the implication is that the abuse.net database suggests sending complaints to the manager (mgr), the techy (tec) and the defalt postmaster. And that then SC follows that advise.

Understanding that the parsing is a machanical process; Maybe my underlying question is "When I see multi-reports going to the same domin, should I un-check some of the report addresses?" and "How should I deside which are (is) the best addresses?"

Link to comment
Share on other sites

When parsing a 'website referenced in spam' is it productive to send the Administrators of the network three emails (postmaster[at] crnet_mgr[at] crnet_tec[at]chinatietong.com) instead of just one?

Technically, one report would be sent to the attention of the address/person that would handle abuse complaints. The 'world' has pretty much standardized on abuse[at] as being that address. Howver, the 'world' is a big place and there are those that ave yet to find theor way to the light. (Actually, there isn't yet a sure standard of Postmaster or Hostmaster .. though perhaps technically two different functions (e-mail admin vice 'net services' admin), most places seem to pick one . the other one bounces ...

Jeff G. I tryed to check abuse.net, but of course they were not available when I tried.  From what I read the implication is that the abuse.net database suggests sending complaints to the manager (mgr), the techy (tec) and the defalt postmaster.  And that then SC follows that advise.

Results at this time are;

05/20/05 18:44:06 Abuse address lookup for www.canonicals.donjmdon4.com

whois -h whois.abuse.net www.canonicals.donjmdon4.com ...

postmaster[at]donjmdon4.com (default, no info)

postmaster[at]canonicals.donjmdon4.com (default, no info)

postmaster[at]www.canonicals.donjmdon4.com (default, no info)

No abuse address is registered with abuse.net

^^^^^^^^^^^^

Reports routes for 222.51.98.245:

routeid:14343488 222.32.0.0 - 222.63.255.255 to:crnet_tec[at]chinatietong.com

Administrator found from whois records

routeid:14343487 222.32.0.0 - 222.63.255.255 to:crnet_mgr[at]chinatietong.com

Administrator found from whois records

05/20/05 18:55:13 Abuse address lookup for chinatietong.com

whois -h whois.abuse.net chinatietong.com ...

crnet_tec[at]chinatietong.com (for chinatietong.com)

postmaster[at]chinatietong.com (for chinatietong.com)

crnet_mgr[at]chinatietong.com (for chinatietong.com)

http://www.spamcop.net/sc?action=rcache;ip=222.51.98.245

Tracking details

"whois 222.51.98.245[at]whois.apnic.net" (Getting contact from whois.apnic.net mirror)

lq112-ap = crnet_mgr[at]chinatietong.com

lm273-ap = crnet_tec[at]chinatietong.com

whois.apnic.net 222.51.98.245 = crnet_mgr[at]chinatietong.com, crnet_tec[at]chinatietong.com

whois: 222.32.0.0 - 222.63.255.255 = crnet_mgr[at]chinatietong.com, crnet_tec[at]chinatietong.com

Using abuse net on crnet_mgr[at]chinatietong.com

abuse net chinatietong.com = postmaster[at]chinatietong.com, crnet_mgr[at]chinatietong.com, crnet_tec[at]chinatietong.com

Using best contacts postmaster[at]chinatietong.com crnet_mgr[at]chinatietong.com crnet_tec[at]chinatietong.com

Understanding that the parsing is a machanical process; Maybe my underlying question is "When I see multi-reports going to the same domin, should I un-check some of the report addresses?" and  "How should I deside which are (is) the best addresses?"

Experience, history, more research, gut feelings, etc. In this case, it hardly matters, as none of these folks are responsive at all .... The original premise was that reports/complaints would go to folks that gave a hoot. As time went on, things changed, thus begat the SCBL as yet another way to get the attention of the folks that did NOT give a hoot.

Link to comment
Share on other sites

Yes looking at what I receive none of the whoEvers[at]chinatieong.com give a hoot. And I guess any domain that did care would have a well established abuse[at] known to others.

I was just looking for a way to maybe reduce the general fodder on the net to make the process better.

<fine>

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...