mMerlin Posted February 10, 2014 Share Posted February 10, 2014 Tracking URL: http://www.spamcop.net/sc?id=z5726040040z8...91cfb6d00e5bb8z whois.ripe.net 212.28.246.106 (nothing found) Display Data %ERROR:201: access denied for 184.94.240.90 % % Sorry, access from your host has been permanently % denied because of a repeated excessive querying. Looks like spamcop needs to spread the load better across multiple query sources. Manual lookup through http://apps.db.ripe.net/search/abuse-finder.html says abuse[at]cyberia.net.lb Do the reports dev nulled to nomaster[at]devnull.spamcop.net trigger any followup to locate appropriate information for later reports? Link to comment Share on other sites More sharing options...
Farelf Posted February 11, 2014 Share Posted February 11, 2014 Haven't seen that parser error in a good long time mMerlin, this observation deserves its own topic. SC Admin may well be most interested. If you re-visit your parse (click the link you gave) you will see the report routing is now fine. Can only join you in hoping SC can juggle things somehow to avoid it happening regularly. Link to comment Share on other sites More sharing options...
mMerlin Posted February 11, 2014 Author Share Posted February 11, 2014 Can not tell from reviewing the changes through the tracking link if the problem is really fixed or not. The original error was reporting a specific source IP. Due to whatever load balancing is being done, the 'retry' may have used a different host that is not, and never was, blocked. Link to comment Share on other sites More sharing options...
mMerlin Posted February 12, 2014 Author Share Posted February 12, 2014 Just got another one: No reporting addresses found for 81.19.135.139, using devnull for tracking. with details of: $ whois 81.19.135.139[at]whois.ripe.net [whois.ripe.net] % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf %ERROR:201: access denied for 184.94.240.90 % % Sorry, access from your host has been permanently % denied because of a repeated excessive querying. % For more information, see % http://www.ripe.net/data-tools/db/faq/faq-...1-access-denied That is the same IP. Need to either get it allowed again, or take it off the queue so that it is does not keep rejecting reports. User Notification sent to service[at]ivc.nnov.ru, pointed to by ripe abuse-finder Link to comment Share on other sites More sharing options...
mMerlin Posted April 28, 2014 Author Share Posted April 28, 2014 This is still happening, (10 minutes ago) with the same [spamcop server] ip (184.94.240.90). REALLY need to get that machine removed from the list that does lookup on ripe. Or convince ripe to add it as an exception for their 'excessive querying' limit. And spamcop will not let me manually add the correct reporting address auftrag[at]nic.telekom.de according to https://apps.db.ripe.net/search/abuse-finder.html $ whois 87.184.88.107[at]whois.ripe.net [whois.ripe.net] % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf %ERROR:201: access denied for 184.94.240.90 % % Sorry, access from your host has been permanently % denied because of a repeated excessive querying. % For more information, see % http://www.ripe.net/data-tools/db/faq/faq-...1-access-denied % This query was served by the RIPE Database Query Service version 1.72 (DBC-WHOIS3) Link to comment Share on other sites More sharing options...
SpamCop 98 Posted April 28, 2014 Share Posted April 28, 2014 RIPE lookups have not worked here since they added the "-B" flag IIRC. I know there were still newsgroups when it first became an issue. See this thread from nine years ago. Frankly I'm surprised sc still tries to whois the RIPE server since it has not been able to parse such results for many years. OTOH, 87.184.88.107 is listed in bl.spamcop.net as well as cbl.abuseat.org. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.