Jump to content

Dosnowmedia.com reporting


mungobomb
 Share

Recommended Posts

I am having a lot of spam come in from dosnowmedia.com. If one goes to dosnowmedia.com, one is taken to opendns.

Spamcop is sending reports to postmaster[at]dosnowmedia.com. From what I can understand by googling, the correct email may be abuse[at]dosnowmedia.com.

From googling dosnowmedia.net, one gets to:

http://webdishtv.net/privacy.html

Interestingly, at that URL it says dosnowmedia.com at the top of the page, not webdishtv.net

This is where it says that reports should go to abuse[at]dosnowmedia.co (NOT postmaster[at]dosnowmedia.com, as Spamcop is using as default)

Is there any way the Spamcop abuse directory can be updated so spam from this source goes to the correct abuse address, instead of uselessly bouncing?

An example of the sort of report email I'm talking about is here:

http://www.spamcop.net/sc?id=z3230075656z4...d92ad519b13182z

Notice this:

Routing details for 208.54.255.220

[refresh/show] Cached whois for 208.54.255.220 : support[at]dosnowmedia.com

Using abuse net on support[at]dosnowmedia.com

No abuse net record for dosnowmedia.com

Using default postmaster contacts postmaster[at]dosnowmedia.com

postmaster[at]dosnowmedia.com bounces (11 sent : 6 bounces)

Using postmaster#dosnowmedia.com[at]devnull.spamcop.net for statistical tracking.

Link to comment
Share on other sites

Routing details for 208.54.255.220

[refresh/show] Cached whois for 208.54.255.220 : support[at]dosnowmedia.com

Using abuse net on support[at]dosnowmedia.com

Thanks for posting the tracking link. You might try hitting the "refresh/show" link on future mails, it may refresh the cache and pull in a better reporting address.

Normally, the authoritative source for getting these reporting addresses is via WHOIS lookup, not necessarily by Googling (unless Google led you to a WHOIS service). Even then, SpamCop occasionally will refuse to report to certain addresses for various reasons (for example, because the operators of the addresses use the reports for "list laundering" or simply because their mailboxes are plugged up).

-- rick

Link to comment
Share on other sites

I am having a lot of spam come in from dosnowmedia.com. If one goes to dosnowmedia.com, one is taken to opendns.

Domain doesn't seem to exist for me ...????

Spamcop is sending reports to postmaster[at]dosnowmedia.com. From what I can understand by googling, the correct email may be abuse[at]dosnowmedia.com.

An example of the sort of report email I'm talking about is here:

http://www.spamcop.net/sc?id=z3230075656z4...d92ad519b13182z

Notice this:

Routing details for 208.54.255.220

[refresh/show] Cached whois for 208.54.255.220 : support[at]dosnowmedia.com

Using abuse net on support[at]dosnowmedia.com

No abuse net record for dosnowmedia.com

Using default postmaster contacts postmaster[at]dosnowmedia.com

postmaster[at]dosnowmedia.com bounces (11 sent : 6 bounces)

Using postmaster#dosnowmedia.com[at]devnull.spamcop.net for statistical tracking.

Your sample doesn't match current conditions.

Is there any way the Spamcop abuse directory can be updated so spam from this source goes to the correct abuse address, instead of uselessly bouncing?

Historicaly, this is what the newsgroup spamcop.routing was all about. Lack of paid-staff responses there ha lead to folks posting this type of data/request into the spamcop newsgroup.

As none of your data seems to check out here, not sure what you are really looking at/for.

BTW: your initial account here was Banned ... duplicate accounts are not allowed.

Link to comment
Share on other sites

Spamcop was using the WHOIS source, but it was giving no answer, so it was defaulting to Postmaster[at]dosnowmedia.com. For some reason the older reports are now saying "to old to report" when I pull up the links (which is what you experienced). All I know is, Spamcop was sending reports to postmaster at dosnowmedia.com, which, you are right, does not come up if you try to go to http://www.dosnowmedia.com, but, if you go to http://www.webdishtv.net, does show up. The page SAYS "dosnowmedia.com" at the top, even though the web address is webdishtv.net). It says clearly: send abuse to "Abuse[at]dosnowmedia.com". To see this, just go to http://www.webdishtv.net/privacy.html. Maybe the mail server is running at dosnowmedia.com, even if the page dosnowmedia.com no longer goes anywhere. I had some Spamcop reports where it was clearly trying to send out reports to Postmaster at dosnowmedia.com, and this was not doing anything (getting bounces). That was my only point. The correct address is "abuse[at]dosnowmedia.com". This is what needs updating in the database. If there is some better place to send this information, I'm willing to go there (I'm new at this.) As for double registration, I realized I was using part of my email id as my forum id. I did that once and got nuked by spam when the bots sent out email to various ISPs with that id until they found me, so I created a new registration which evaded that problem. The fact that the first one was cancelled is fine with me. I'm afraid that the onwers of webdishtv.net have not updated WHOIS with the new abuse address.

Edited by mungobomb
Link to comment
Share on other sites

I thought that spamcop also queried abuse.net if it didn't get an address from whois.

The best thing to do is to inform dosnowmedia.com that they are missing spam reports because they haven't updated their information. It may be deliberate (they don't want to know) or it may be cluelessness.

Whatever, once it is called to their attention, then the ball is in their court. And their response gives you a clue to their state of mind (spam or anti-spam).

Miss Betsy

Link to comment
Share on other sites

Forget about what websites say or what Google says. The authoritative dope for who controls IP addresses, to the extent any such authoritative dope exists, is found in IP-WHOIS. You won't find this info at abuse.net, although SpamCop does check the reporting contact addresses through abuse.net, possibly to check whether the domain has published a preferred address there. I should say that I did a WHOIS lookup on the source IP, and it didn't mention anything about dosnowmedia:

whois 208.54.255.220

OrgName:	PullThePlug Technologies LLC
OrgID:	  PTL-31
Address:	21800 Town Center Plaza #266A
City:	   Sterling
StateProv:  VA
PostalCode: 20170
Country:	US

ReferralServer: rwhois://rwhois.ptptech.com:4321

NetRange:   208.54.240.0 - 208.54.255.255
CIDR:	   208.54.240.0/20
OriginAS:   AS29944
NetName:	PTPTECH-ARIN-BLK1
NetHandle:  NET-208-54-240-0-1
Parent:	 NET-208-0-0-0-0
NetType:	Direct Allocation
NameServer: AUTH00.NS.PTPTECH.COM
NameServer: AUTH10.NS.PTPTECH.COM
NameServer: AUTH20.NS.PTPTECH.COM
NameServer: AUTH30.NS.PTPTECH.COM
Comment:
RegDate:	2007-09-07
Updated:	2009-01-05

RAbuseHandle: OPERA12-ARIN
RAbuseName:   Operations
RAbusePhone:  +1-800-768-0189
RAbuseEmail:  arin[at]pryme.net

RNOCHandle: OPERA12-ARIN
RNOCName:   Operations
RNOCPhone:  +1-800-768-0189
RNOCEmail:  arin[at]pryme.net

RTechHandle: OPERA12-ARIN
RTechName:   Operations
RTechPhone:  +1-800-768-0189
RTechEmail:  arin[at]pryme.net

OrgTechHandle: OPERA12-ARIN
OrgTechName:   Operations
OrgTechPhone:  +1-800-768-0189
OrgTechEmail:  arin[at]pryme.net

It would seem that here, today, the abuse of this address is reportable to arin at pryme.net. That's why it would be useful to try the refresh/show link.

-- rick

Edited by rconner
Link to comment
Share on other sites

If one goes to dosnowmedia.com, one is taken to opendns.

Domain doesn't seem to exist for me ...????

For people using OpenDNS servers, domains that do not exist get redirected to OpenDNS. That is part of their "service" which I need to remember whenever I test something locally.

Link to comment
Share on other sites

Also, sometimes someone else has told spamcop what the abuse address should be. In other words, if they took your advice and changed it, perhaps some months down the road, someone would post saying the correct address is something[at]pryme.net.

Other times, the server admin at the IP address requests spamcop reports go to a particular email address. In that case, if reports start bouncing, I would expect spamcop staff to look into it.

IMHO, the best way to get to the bottom of it is to send a manual report to whatever email address you think is the correct one.

Miss Betsy

Link to comment
Share on other sites

<snip>

IMHO, the best way to get to the bottom of it is to send a manual report to whatever email address you think is the correct one.

...That's a good solution.

...To submit your information to SpamCop, I would suggest that you send it to the SpamCop Deputies at e-mail address deputies[at]admin.spamcop.net. I don't know exactly in what form the SpamCop Deputies prefer such information but were I sending it I'd include a bit of discussion (as brief as possible) as to how I came upon the "correct" abuse address and why I consider it the best one to use.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...