Error in recipient address

[qjvgpuryy]

I think this is the right forum for this, but maybe not. (If not, I'm sure the moderators, who are on top of things, will move it.)

SpamCop tried to send a message to 'abuse[at]arcor' (no .com, .net or .anything).

Here is the Tracking URL.

[Wazoo]

I think this is the right forum for this, but maybe not. (If not, I'm sure the moderators, who are on top of things, will move it.)

Yes, this is a Reporting issue.

From: "Wazoo"

To: "SpamCop Deputies"

Subject: RIPE look-up result bad

Date: Tue, 6 May 2008 09:50:37 -0500

"-ip.de" dropped from data found in the lookup, thereby generating a

bad e-mail address ....

Question asked at;

http://forum.spamcop.net/forums/index.php?showtopic=9419

Tracking URL provided;

http://www.spamcop.net/sc?id=z1862908910z8...6efc751426d09fz

Results of the attempted Refresh Cache;

http://www.spamcop.net/sc?action=rcache;ip=88.76.236.245

Removing old cache entries.

Tracking details

Display data:

"whois 88.76.236.245[at]whois.ripe.net" (Getting contact from

whois.ripe.net)

Abuse address in 'remarks' field: abuse[at]arcor-ip.de

whois.ripe.net found abuse contacts for 88.76.236.245 = abuse[at]arcor

whois: 88.76.0.0 - 88.77.95.255 = abuse[at]arcor

Routing details for 88.76.236.245

Using abuse net on abuse[at]arcor

Using best contacts abuse[at]arcor

[Wazoo]

Ok I fixed it.

Ellen

SpamCop

[qjvgpuryy]

Is there any way to resend the notification that arcor-ip.de should have gotten? I can't submit the spam again.

[Farelf]

...Is there any way to resend the notification that arcor-ip.de should have gotten? I can't submit the spam again.

I think/fear it would have to be manual David (retrieve the spam from your past reports and compose a covering "note" to send it). You would need to be sure they're fairly white hat or use a disposable address. I guess you're concerned they're being deprived of the opportunity to do something about the abuse in a timely manner. They may be receiving more recent reports from others already - and since there were spam trap hits to tip them into the SCbl relatively quickly - and they're on a heap of other bls - I don't really think it would make much difference now. Note, from SenderBase, they have a large increase in mail and taken together with their "Poor" reputation that means the increase was almost surely all spam.

[btech]

I found 2 more of these errors, should the reports be forwarded to deputies or posted in this forum?

[Telarin]

I usually just send a note to the deputies when I find errors like that, they usually take care of them pretty quickly and the next round of reports go through where they should.

[Wazoo]

I found 2 more of these errors, should the reports be forwarded to deputies or posted in this forum?

In theory, see SpamCop Newsgroups .. the spamcop.routing newsgroup specifically.

Posting the data to the Forum does bring it to light, but .... paid staff doesn't spend much time here, and certainly does not peruse each and every posting here. That's why you'll see that someone has made a note about sending it upstream.

Mailing the data directly .. that's one of those things hard to simply say yes to. There is still only the small handful of people that receive those e-mails, once described as three people trying to handle 800-1800 e-mails a day (though allegedly there have been more people hired.) If all data is presented, all research done, and correct actions recommended, probably no big deal. However, if someone else reads this and figures that simply sending in a complaint about the bad condition ... well, that probably won't be received well, possibly not acted on immediately, etc. As I stated in the Wiki description, it boils down to doing the homework first.

[btech]

Wazoo-

Can you post this to the newsgroup for me? I'm at work and can't subscrbe to them here. I emailed the deputies, but I'd like to submit the more effective way..

http://www.spamcop.net/sc?id=z1867618095z5...933f03e30c9fcaz

Tracking link: dachsteinbande[dot]at/redir.html

Resolves to 195.137.213.130

Routing details for 195.137.213.130

[refresh/show] Cached whois for 195.137.213.130 : abuse[at]server

Using abuse net on abuse[at]server

Using best contacts abuse[at]server

abuse[at]server bounces (13 sent : 7 bounces)

Using abuse#server[at]devnull.spamcop.net for statistical tracking.

It should be abuse[at]server-home.net

[qjvgpuryy]

It's starting to look like a problem with hyphens.

[Farelf]

...Can you post this to the newsgroup for me? I'm at work and can't subscrbe to them here. I emailed the deputies, but I'd like to submit the more effective way..

It should be abuse[at]server-home.net

Path: news.spamcop.net!not-for-mail

From: Farelf <user[at]domain.invalid>

Newsgroups: spamcop.routing

Subject: Broken address for server-home.net

Date: Sat, 10 May 2008 04:32:59 +0800

Message-ID: <g02cdp$2c8$1[at]news.spamcop.net>

NNTP-Posting-Date: Fri, 9 May 2008 20:32:57 +0000 (UTC)

Xref: news.spamcop.net spamcop.routing:9490

http://www.spamcop.net/sc?action=rcache;ip=195.137.213.130

Removing old cache entries.

Tracking details

Display data:

"whois 195.137.213.130[at]whois.ripe.net" (Getting contact from whois.ripe.net)

Abuse address in 'remarks' field: abuse[at]server-home.net

whois.ripe.net found abuse contacts for 195.137.213.130 = abuse[at]server

whois: 195.137.212.0 - 195.137.213.255 = abuse[at]server

Routing details for 195.137.213.130

Using abuse net on abuse[at]server

Using best contacts abuse[at]server

abuse[at]server bounces (13 sent : 7 bounces)

Using abuse#server[at]devnull.spamcop.net for statistical tracking.

Well, yes abuse[at]server would bounce. abuse[at]server-home.net requested.

http://www.abuse.net/lookup.phtml?domain=server-home.net says

abuse[at]de.colt.net (for server-home.net)

abuse[at]server-home.net (for server-home.net)

Sorry Brandon, I neglected to attribute to you, but posted anyway after confirming broken address still current.

[Farelf]

It's starting to look like a problem with hyphens.

Yes, it's a common factor - I posted the above before I picked up what you were talking about. I will add to my thread 'over there'. Maybe Ellen will get/has got it anyway. If so, yet another "little" fix ticketed, but it would be nice to know.

[Wazoo]

Wazoo-

Can you post this to the newsgroup for me? I'm at work and can't subscrbe to them here. I emailed the deputies, but I'd like to submit the more effective way..

Read this earlier in the day, but the phone rang and real-life commanded me to be elsewhere. Came back and see that Farelf picked up the slack. The "more effective way" description is really up for grabs. As I understand it, the Deputies focus on their e-mail first, perusing newsgroup traffic as time allows. The Forum rates basically zilch, though pointing out that RW has made a post or two, Don has appeared in response to most of my queries, although sometimes finding time to make an appearance for other purposes <G>

So though it has been posted to the newsgroups as suggested, I also chose to make it a follow-up to my previous e-mail about the previous issue.

From: "Wazoo"

To: "SpamCop/Ellen"

References: <040e01c8af88$8cddac50$6401a8c0[at]HPorGateway> <482074CB.4060203[at]admin.spamcop.net>

Subject: Re: RIPE look-up result bad

Date: Fri, 9 May 2008 20:43:38 -0500

Appearances would be that there is a coding problem in interpreting

results that have a hyphen in the Domain part of the target e-mail

address. Yet another one has been identified/queried about at

http://forum.spamcop.net/forums/index.php?showtopic=9419 This one;

http://www.spamcop.net/sc?id=z1867618095z5...933f03e30c9fcaz

http://www.spamcop.net/sc?action=showroute...30;typecodes=17

Reports routes for 195.137.213.130:

routeid:39304043 195.137.212.0 - 195.137.213.255 to:abuse[at]server

Administrator found from whois records

http://www.spamcop.net/sc?action=rcache;ip=195.137.213.130

Removing old cache entries.

Tracking details

"whois 195.137.213.130[at]whois.ripe.net" (Getting contact from

whois.ripe.net)

Abuse address in 'remarks' field: abuse[at]server-home.net

whois.ripe.net found abuse contacts for 195.137.213.130 =

abuse[at]server

whois: 195.137.212.0 - 195.137.213.255 = abuse[at]server

Routing details for 195.137.213.130

Using abuse net on abuse[at]server

Using best contacts abuse[at]server

abuse[at]server bounces (13 sent : 7 bounces)

Using abuse#server[at]devnull.spamcop.net for statistical tracking.

Sent:Bounces statistics seem very odd in this case ...????

Data / query has also been posted to the routing newsgroup.

<previous e-mail and Reply snipped>

[btech]

No worries Farelf.. so long as they get fixed.

I cam across another one:

http://www.spamcop.net/sc?id=z1879876604z6...447a50db34b245z

Tracking message source: 78.99.140.50:
Routing details for 78.99.140.50
[refresh/show] Cached whois for 78.99.140.50 : abuse[at]ip.t
Using abuse net on abuse[at]ip.t
No abuse net record for ip.t
Using best contacts abuse[at]ip.t
Message is 6 hours old
78.99.140.50 not listed in dnsbl.njabl.org
78.99.140.50 not listed in dnsbl.njabl.org
78.99.140.50 listed in cbl.abuseat.org ( 127.0.0.2 )
78.99.140.50 is an open proxy
78.99.140.50 not listed in accredit.habeas.com
78.99.140.50 not listed in plus.bondedsender.org
78.99.140.50 not listed in iadb.isipp.com

Should be abuse[at]ip.t-com.sk

... I think it looks like a problem with the hyphen (not sure who stated that earlier)

[SpamCopAdmin]

Reporting problems with abuse addresses directly to deputies[at]admin.spamcop.net via email is far and away the most effective route to a solution.

Please use a descriptive subject line:

such as: Bad Abuse Address

Please be clear and concise.

Please include a Tracking URL.

Please do NOT simply point us to a forum topic. We have some pretty good skills, but divining your intentions is not one of them. :-)

- Don D'Minion - SpamCop Admin -

.

[dbiel]

Wiki FAQ entry created at ReportsToBadAbuseAddress

[Wazoo]

Reporting problems with abuse addresses directly to deputies[at]admin.spamcop.net via email is far and away the most effective route to a solution.

Have a note to myself that the FAQ entries, the Wiki entries, and all responses in the future need to reflect this 'new' preference in handling routing issues. The follow-on question then would be whether the spamcop.routing newsgroup needs to continue its existence ...????

Edit: OK, having to admit that I hadn't noticed that this newsgroup was actually removed from the http://www.spamcop.net/help.shtml web page, having to assume now that this was done a long time ago.

Please use a descriptive subject line:

such as: Bad Abuse Address

Please be clear and concise.

Please include a Tracking URL.

Please do NOT simply point us to a forum topic. We have some pretty good skills, but divining your intentions is not one of them. :-)

I'm thinking that you could have possibly pointed to the copy of the e-mail I submitted and provided a copy of in this very Topic, perhaps even pointing out what was wrong with that e-mail .... although I'd have to note that there has been no reply to the follow-up e-mail as shown here, in addition to several other Don/Deputies e-mails. So just as folks complain about a lack of response / action seen in the newsgroups, one might not see anything from an e-mail submittal either. It is probably best described the same way changes to the parsing code is found to be 'fixed' ... whatever was broken just starts working ...????

SpamCop Newsgroups Wiki page updated.

SpamCop Newsgroups - How to access and use Wiki page updated.

SpamCop Newsgroups FAQ entry 'here' updated.

[SpamCopAdmin]

one might not see anything from an e-mail submittal either.

Looking at posts #2 and #3 in this thread...

You posted your message to Ellen, and then posted her response 35 minutes later, and now you're warning people that email submittals might be ignored.

I can't help but think that your warning is contradicted by the facts.

- Don -

.

[Wazoo]

Looking at posts #2 and #3 in this thread...

You posted your message to Ellen, and then posted her response 35 minutes later, and now you're warning people that email submittals might be ignored.

I can't help but think that your warning is contradicted by the facts.

I specifically said "follow-up e-mail", which is seen at Linear Post #13. The commentary also mentioned several other e-mails on different subjects. I've even resent one of them (again to both you and Deputies) on the apparent premise that somehow a spamcop.net to spamcop.net e-mail was somehow lost.

[SpamCopAdmin]

I specifically said "follow-up e-mail"

Ah! My mistake.

I thought you were warning users that if they send in information by email it might be ignored.

I didn't realize that when you said, "one might not see anything from an e-mail submittal either," you were actually talking about follow-up emails and not first report emails.

- Don -

.

[Wazoo]

I thought you were warning users that if they send in information by email it might be ignored.

I did not use any words close to ignored.

I didn't realize that when you said, "one might not see anything from an e-mail submittal either," you were actually talking about follow-up emails and not first report emails.

Interpretation involved apparently. My first e-mail dealt with the apparent bad look-up. My follow-up extended that to an apparent issue with the parser code, based on the additional samples of bad lookup returns. There is/was the assumption that the Reply would be of the 'ticket has been opened' type. Pretty much my same expectation with my write-up on the XSS / scri_pt insertion exploit.

[SpamCopAdmin]

Interpretation involved apparently.

I guess I don't understand.

If you weren't warning the folks in the forum that if they write to the Deputies, they might not get a reply, which implies that their email will be ignored, what were you warning them against?

- Don D'Minion - SpamCop Admin -

.

[Wazoo]

I guess I don't understand.

If you weren't warning the folks in the forum that if they write to the Deputies, they might not get a reply, which implies that their email will be ignored, what were you warning them against?

You know . stuff happens when you start reading things with a certain mind-set already in place, then choose to only read selected words and phrases, then pull them out of context to make some off the wall point.

I repeat, I said nothing close to the word, definition, or scenario of 'ignored' ... only you have used this word. In fact, doesn't the following statement that you ignored in the same paragraph state just the opposite? It is probably best described the same way changes to the parsing code is found to be 'fixed' ... whatever was broken just starts working ...????

This Forum, the newsgroups, both contain numerous complaints, remarks, pointers about non-response to both postings and e-mails. There is nothing new in this.

On this specific Topic and data presented, I note that Dbiel made a new Wiki page, in which he states that the three examples of a hypenated Domain name have all been fixed and seems to suggest that the parser code may have been fixed. I'm not sure where that data came from, as the only response thus far seems to be Ellen's reply to my first e-mail, which appears to be a fix based on her manually manipulating the database. Nothing else stated in this Topic, no response seen in the spamcop.routing newsgroup to the same thread started on the same subject (hypenated Domain names) ..... Yet again, I am not using anything close to the word "ignored" .. only pointing out the lack of a response from those that can change things.

To answer your question directly, I was not making a warning. I was simply pointing out that the lack of a Reply may not necessarily mean that nothing was being done. However, I must note that without feedback, it is hard to tell what the status might actually be. Note the continued posting of more and more examples in this Topic. Feedback from 'above' that the programming staff were in fact working on a fix would short-circuit these additional posts.

[dbiel]

On this specific Topic and data presented, I note that Dbiel made a new Wiki page, in which he states that the three examples of a hypenated Domain name have all been fixed and seems to suggest that the parser code may have been fixed. I'm not sure where that data came from, as the only response thus far seems to be Ellen's reply to my first e-mail, which appears to be a fix based on her manually manipulating the database. Nothing else stated in this Topic, no response seen in the spamcop.routing newsgroup to the same thread started on the same subject (hypenated Domain names) ..... Yet again, I am not using anything close to the word "ignored" .. only pointing out the lack of a response from those that can change things.

I tried not to imply that the parser code had been fixed, but only that the 3 examples had been fixed. I also concluded from the common problem of the domain having a hyphen, that the hyphen might be the problem. But that was just a logical guess. Sorry if it reads incorrectly. The link to the Wiki page is http://forum.spamcop.net/scwik/ReportsToBadAbuseAddress

[Miss Betsy]

What I want to know is who sends the deputies just a link to forum topic?

I am trying to remember if I ever did. I might have since a topic like this is not easy for me to summarize since it is getting a little detailed and I think it would be obvious if they read the topic what input was needed. But, I very rarely email the deputies about anything and can't say that I was ever ignored when I did.

Yet every once in a while we get a topic started by someone who hasn't gotten a response from a deputy. Usually, it seems obvious that the reason is that they haven't given enough information so they get the old Socrates routine from Wazoo (and I don't remember ever seeing a complaint from a deputy then).

As Wazoo says, there are ways and there are ways to experience a response. If the problem gets fixed, that's a response, right?

And who sends the deputies a link to a forum topic?

Miss Betsy