No report for URLs that don't resolve?

[aculver]

I submitted a piece of spam which contained a URL in the body. I was surprised when SpamCop discarded the URL because it didn't resolve to an IP address. I can understand why SpamCop wouldn't act on the URL from an IP basis. But why not record the URL and why not send a report to the admin in the whois info of the domain? The owner of the domain may want to know that something might be going on. Also, just because the hostname doesn't resolve to an IP at the time I reported it, doesn't mean it won't resolve in the future. It may be a fast-flux domain.

Just seems odd to me that the url would be completely ignored just because it doesn't resolve to an IP. Here's the report:

http://www.spamcop.net/mcgi?action=gettrac...rtid=4033614096

Andrew

[StevenUnderwood]

You are the only person (outside of spamcop staff) who can see the results of that link. Please check the FAQ for the method to turn that repoort ID into a TrackingURL.

SpamCop.net is not the place to be if your primary focus is on taking down the spamvertized websites. Its focus is on the source of the spam message. There are other services that do a much better job of handling the spamvertized websites.

One reason spamcop MAY have as to why they do not report URL's without IP addresses is that the site may already have been taken down.

[rconner]

why not send a report to the admin in the whois info of the domain? The owner of the domain may want to know that something might be going on.

As Steven alludes, SpamCop puts spam websites at a much lower priority than spam sources. Certainly if a web URL won't resolve, SpamCop is not going to spend any more time on it.

In most of the spam I get, the admin address in the WHOIS data actually points to the spammer (if it is not a completely bogus address to begin with), so it is not clear what would be accomplished by sending reports of this sort. The state of play in the domain registration business makes it unwise to rely upon information obtained from a domain-WHOIS lookup (at least where spam websites are involved).

-- rick

[aculver]

Here's the tracking URL http://www.spamcop.net/sc?id=z2791161873za...58d04d7480a9b2z

However, my question has pretty much been answered. Thanks for the replies.

Andrew

[Farelf]

Thanks for the tracker. I don't believe the parser's "IP not found ; wbsnhj.jilfawris.com discarded as fake" is necessarily correct every time (it doesn't try very hard to resolve links), but it is in this case.

...One reason spamcop MAY have as to why they do not report URL's without IP addresses is that the site may already have been taken down.

Which appears to be right on the money for this one (or it was not set up with hosting in the first place):

C:\...>nslookup wbsnhj.jilfawris.com

...

*** UnKnown can't find wbsnhj.jilfawris.com: Non-existent domain

C:\...>nslookup jilfawris.com

...

*** UnKnown can't find jilfawris.com: Non-existent domain

C:\...>

And, as Rick points out, while the purported registrar of jilfawris.com may again/yet set up his DNS, in the unlikely event his is real contact address detail in the domain whois record he will not require reminding that his 'business' is driven by spam - though he would probably appreciate any confirmation that the weblink is getting out there.