btech Posted January 18, 2006 Share Posted January 18, 2006 I came across the ever-so- famous spam "Re: your site information here...": http://www.spamcop.net/sc?id=z860157401z8a...5d472d119a47acz And I see that that Parsing input: http://asia.geocities.com/ibbie22422karlen53446 No recent reports, no history available Routing details for 66.218.77.68 [refresh/show] Cached whois for 66.218.77.68 : network-abuse[at]cc.yahoo-inc.com Using abuse net on network-abuse[at]cc.yahoo-inc.com abuse net cc.yahoo-inc.com = abuse[at]yahoo.com Using best contacts abuse[at]yahoo.com abuse[at]yahoo.com redirects to network-abuse[at]cc.yahoo-inc network-abuse[at]cc.yahoo-inc bounces (9 sent : 8 bounces) Cannot find master for:http://asia.geocities.com/ibbie22422karlen53446 No valid email addresses found, sorry! and Parsing input: http://in.geocities.com/whitney2627binni63545/ No recent reports, no history available Routing details for 66.218.77.68 [refresh/show] Cached whois for 66.218.77.68 : network-abuse[at]cc.yahoo-inc.com Using abuse net on network-abuse[at]cc.yahoo-inc.com abuse net cc.yahoo-inc.com = abuse[at]yahoo.com Using best contacts abuse[at]yahoo.com abuse[at]yahoo.com redirects to network-abuse[at]cc.yahoo-inc network-abuse[at]cc.yahoo-inc bounces (9 sent : 8 bounces) Cannot find master for:http://in.geocities.com/whitney2627binni63545/ No valid email addresses found, sorry! Looks to me that the 'redirect' spammers found a host/isp that isn't too proactive is receiving reports and/or stopping abuse. Link to comment Share on other sites More sharing options...
Wazoo Posted January 18, 2006 Share Posted January 18, 2006 From: "Ellen" <nobody[at]spamcop.net> Newsgroups: spamcop Subject: Re: (attn Deputy) "network-abuse[at]cc.yahoo-inc" address: just a text error - or is that why the Yahbut complaints bounce? Date: Tue, 17 Jan 2006 12:07:10 -0500 Message-ID: <dqj8b1$6pp$1[at]news.spamcop.net> References: <dqh51p$un$1[at]news.spamcop.net> "R. Asby Dragon" <none.of[at]your.biz> wrote in message news:dqh51p$un$1[at]news.spamcop.net... > As I mentioned yesterday? Sunday? we are working with yahoo to try to get this fixed. Ellen SpamCop Link to comment Share on other sites More sharing options...
bobbear Posted January 19, 2006 Share Posted January 19, 2006 Cannot find master for:http://in.geocities.com/whitney2627binni63545/ No valid email addresses found, sorry![/code] Looks to me that the 'redirect' spammers found a host/isp that isn't too proactive is receiving reports and/or stopping abuse. 39400[/snapback] SC uses the network abuse reporting address for all yahoo/geocities domains where I would report the above two examples to sg-geo-abuse[at]yahoo-inc.com and in-geo-abuse[at]yahoo-inc.com respectively for Asian and Indian sites. I started manually reporting all geocities spammers some time ago because I noticed that the spammer's geocities sites/redirects remained active after SC's IP derived network abuse reports whereas on manual reports routed directly to the correct domain abuse team the sites are usually fairly quickly de-activated and I always get a reply back from the abuse team concerned. I don't know how the 'best contacts' are derived but surely it's just a simple typo missing the .com off the network abuse reporting address, (it's certainly going to bounce as it is!), which I still have as network-abuse[at]cc.yahoo-inc.com derived from the whois data. Please excuse me if I'm missing something here!.... Link to comment Share on other sites More sharing options...
btech Posted January 19, 2006 Author Share Posted January 19, 2006 which I still have as network-abuse[at]cc.yahoo-inc.com derived from the whois data. Please excuse me if I'm missing something here!.... 39455[/snapback] If you look in that parsing, it shows the number of bounces sent to that address and abuse[at]yahoo.com Even if you manually enter one of the two as a 'user defined recipient', SC won't sent the report to them... it will get dev'nulled. Link to comment Share on other sites More sharing options...
bobbear Posted January 19, 2006 Share Posted January 19, 2006 If you look in that parsing, it shows the number of bounces sent to that address and abuse[at]yahoo.com Even if you manually enter one of the two as a 'user defined recipient', SC won't sent the report to them... it will get dev'nulled. 39460[/snapback] If that's a copy/paste, then the parser isn't showing a valid address:- Using best contacts abuse[at]yahoo.com abuse[at]yahoo.com redirects to network-abuse[at]cc.yahoo-inc network-abuse[at]cc.yahoo-inc bounces (9 sent : 8 bounces) network-abuse[at]cc.yahoo-inc is not a valid address, network-abuse[at]cc.yahoo-inc.com is. Link to comment Share on other sites More sharing options...
Wazoo Posted January 20, 2006 Share Posted January 20, 2006 This displayed data (missing ".com") has been pointed out, but again, the last response seen is the newsgroup posting/data I provided above ...... Link to comment Share on other sites More sharing options...
Wazoo Posted January 23, 2006 Share Posted January 23, 2006 My fault, being the only person trying to keep up with 'everything, everywhere" ..??? (can't believe that, but yet ....) Another Thread in an different newsgroup, noticing traffic in another Topic here that I'd actually forgotten somehow to actually cart the data over when first seen .. apologies for the delay of a few days ... From: "Ellen" <nobody[at]spamcop.net> Newsgroups: spamcop.help Subject: Re: Geocities Reporting Date: Fri, 20 Jan 2006 16:41:02 -0500 Message-ID: <dqrlfl$i5g$1[at]news.spamcop.net> "Kenneth Brody" wrote in message news:43D13DBB.7643C069[at]spamcop.net... > > Well, it now shows: > >   Using best contacts abuse[at]yahoo.com >   abuse[at]yahoo.com redirects to network-abuse[at]cc.yahoo-inc.com > > My understanding is that the problem was that Yahoo had the wrong data in > the abuse.net database, which is something that SpamCop does not control. > Hence, the need for someone at Yahoo to fix it. (Short of modifying > SpamCop's parser to special-case "cc.yahoo-inc" to fix it.) > twas a case of multiple fat-fingers my more than one person Ellen I also posted a copy of this spamcop.help post back into the spamcop newsgroup Thread on the same subject to help that thread a bit ..... Link to comment Share on other sites More sharing options...
btech Posted January 24, 2006 Author Share Posted January 24, 2006 Here's a recent phishing attempt that uses Yahoo, but the parser can't pick out the link: http://www.spamcop.net/sc?id=z863490958zba...bd06f8001806d9z (http:/66.1.180.204:84/page/update/) should be picked out of that message. Link to comment Share on other sites More sharing options...
Wazoo Posted January 24, 2006 Share Posted January 24, 2006 Here's a recent phishing attempt that uses Yahoo, but the parser can't pick out the link: http://www.spamcop.net/sc?id=z863490958zba...bd06f8001806d9z 39651[/snapback] Tracking link: http://rds.yahoo.com/s=44831148:d1/cs=4483...84/page/update/ [report history] Resolves to 66.218.71.223 Routing details for 66.218.71.223 [refresh/show] Cached whois for 66.218.71.223 : network-abuse[at]cc.yahoo-inc.com Using abuse net on network-abuse[at]cc.yahoo-inc.com abuse net cc.yahoo-inc.com = abuse[at]yahoo.com Using best contacts abuse[at]yahoo.com abuse[at]yahoo.com redirects to network-abuse[at]cc.yahoo-inc.com If reported today, reports would be sent to: Re: http://rds.yahoo.com/s=44831148:d1/cs=44831148/... (Administrator of network hosting website referenced in spam) network-abuse[at]cc.yahoo-inc.com ???? worked for me ... and http://www.spamcop.net/mcgi?action=showhis...id;val=80262510 suggests that it worked for others ... ???? Link to comment Share on other sites More sharing options...
StevenUnderwood Posted January 25, 2006 Share Posted January 25, 2006 Resolves to 66.218.71.223 39654[/snapback] Brandon's point was that it should be reported to the redirection site. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.