mungobomb Posted August 17, 2009 Share Posted August 17, 2009 I am having a lot of spam come in from dosnowmedia.com. If one goes to dosnowmedia.com, one is taken to opendns. Spamcop is sending reports to postmaster[at]dosnowmedia.com. From what I can understand by googling, the correct email may be abuse[at]dosnowmedia.com. From googling dosnowmedia.net, one gets to: http://webdishtv.net/privacy.html Interestingly, at that URL it says dosnowmedia.com at the top of the page, not webdishtv.net This is where it says that reports should go to abuse[at]dosnowmedia.co (NOT postmaster[at]dosnowmedia.com, as Spamcop is using as default) Is there any way the Spamcop abuse directory can be updated so spam from this source goes to the correct abuse address, instead of uselessly bouncing? An example of the sort of report email I'm talking about is here: http://www.spamcop.net/sc?id=z3230075656z4...d92ad519b13182z Notice this: Routing details for 208.54.255.220 [refresh/show] Cached whois for 208.54.255.220 : support[at]dosnowmedia.com Using abuse net on support[at]dosnowmedia.com No abuse net record for dosnowmedia.com Using default postmaster contacts postmaster[at]dosnowmedia.com postmaster[at]dosnowmedia.com bounces (11 sent : 6 bounces) Using postmaster#dosnowmedia.com[at]devnull.spamcop.net for statistical tracking. Link to comment Share on other sites More sharing options...
rconner Posted August 17, 2009 Share Posted August 17, 2009 Routing details for 208.54.255.220 [refresh/show] Cached whois for 208.54.255.220 : support[at]dosnowmedia.com Using abuse net on support[at]dosnowmedia.com Thanks for posting the tracking link. You might try hitting the "refresh/show" link on future mails, it may refresh the cache and pull in a better reporting address. Normally, the authoritative source for getting these reporting addresses is via WHOIS lookup, not necessarily by Googling (unless Google led you to a WHOIS service). Even then, SpamCop occasionally will refuse to report to certain addresses for various reasons (for example, because the operators of the addresses use the reports for "list laundering" or simply because their mailboxes are plugged up). -- rick Link to comment Share on other sites More sharing options...
Wazoo Posted August 17, 2009 Share Posted August 17, 2009 I am having a lot of spam come in from dosnowmedia.com. If one goes to dosnowmedia.com, one is taken to opendns. Domain doesn't seem to exist for me ...???? Spamcop is sending reports to postmaster[at]dosnowmedia.com. From what I can understand by googling, the correct email may be abuse[at]dosnowmedia.com. An example of the sort of report email I'm talking about is here: http://www.spamcop.net/sc?id=z3230075656z4...d92ad519b13182z Notice this: Routing details for 208.54.255.220 [refresh/show] Cached whois for 208.54.255.220 : support[at]dosnowmedia.com Using abuse net on support[at]dosnowmedia.com No abuse net record for dosnowmedia.com Using default postmaster contacts postmaster[at]dosnowmedia.com postmaster[at]dosnowmedia.com bounces (11 sent : 6 bounces) Using postmaster#dosnowmedia.com[at]devnull.spamcop.net for statistical tracking. Your sample doesn't match current conditions. Is there any way the Spamcop abuse directory can be updated so spam from this source goes to the correct abuse address, instead of uselessly bouncing? Historicaly, this is what the newsgroup spamcop.routing was all about. Lack of paid-staff responses there ha lead to folks posting this type of data/request into the spamcop newsgroup. As none of your data seems to check out here, not sure what you are really looking at/for. BTW: your initial account here was Banned ... duplicate accounts are not allowed. Link to comment Share on other sites More sharing options...
mungobomb Posted August 17, 2009 Author Share Posted August 17, 2009 Spamcop was using the WHOIS source, but it was giving no answer, so it was defaulting to Postmaster[at]dosnowmedia.com. For some reason the older reports are now saying "to old to report" when I pull up the links (which is what you experienced). All I know is, Spamcop was sending reports to postmaster at dosnowmedia.com, which, you are right, does not come up if you try to go to http://www.dosnowmedia.com, but, if you go to http://www.webdishtv.net, does show up. The page SAYS "dosnowmedia.com" at the top, even though the web address is webdishtv.net). It says clearly: send abuse to "Abuse[at]dosnowmedia.com". To see this, just go to http://www.webdishtv.net/privacy.html. Maybe the mail server is running at dosnowmedia.com, even if the page dosnowmedia.com no longer goes anywhere. I had some Spamcop reports where it was clearly trying to send out reports to Postmaster at dosnowmedia.com, and this was not doing anything (getting bounces). That was my only point. The correct address is "abuse[at]dosnowmedia.com". This is what needs updating in the database. If there is some better place to send this information, I'm willing to go there (I'm new at this.) As for double registration, I realized I was using part of my email id as my forum id. I did that once and got nuked by spam when the bots sent out email to various ISPs with that id until they found me, so I created a new registration which evaded that problem. The fact that the first one was cancelled is fine with me. I'm afraid that the onwers of webdishtv.net have not updated WHOIS with the new abuse address. Link to comment Share on other sites More sharing options...
Miss Betsy Posted August 18, 2009 Share Posted August 18, 2009 I thought that spamcop also queried abuse.net if it didn't get an address from whois. The best thing to do is to inform dosnowmedia.com that they are missing spam reports because they haven't updated their information. It may be deliberate (they don't want to know) or it may be cluelessness. Whatever, once it is called to their attention, then the ball is in their court. And their response gives you a clue to their state of mind (spam or anti-spam). Miss Betsy Link to comment Share on other sites More sharing options...
rconner Posted August 18, 2009 Share Posted August 18, 2009 Forget about what websites say or what Google says. The authoritative dope for who controls IP addresses, to the extent any such authoritative dope exists, is found in IP-WHOIS. You won't find this info at abuse.net, although SpamCop does check the reporting contact addresses through abuse.net, possibly to check whether the domain has published a preferred address there. I should say that I did a WHOIS lookup on the source IP, and it didn't mention anything about dosnowmedia: whois 208.54.255.220 OrgName: PullThePlug Technologies LLC OrgID: PTL-31 Address: 21800 Town Center Plaza #266A City: Sterling StateProv: VA PostalCode: 20170 Country: US ReferralServer: rwhois://rwhois.ptptech.com:4321 NetRange: 208.54.240.0 - 208.54.255.255 CIDR: 208.54.240.0/20 OriginAS: AS29944 NetName: PTPTECH-ARIN-BLK1 NetHandle: NET-208-54-240-0-1 Parent: NET-208-0-0-0-0 NetType: Direct Allocation NameServer: AUTH00.NS.PTPTECH.COM NameServer: AUTH10.NS.PTPTECH.COM NameServer: AUTH20.NS.PTPTECH.COM NameServer: AUTH30.NS.PTPTECH.COM Comment: RegDate: 2007-09-07 Updated: 2009-01-05 RAbuseHandle: OPERA12-ARIN RAbuseName: Operations RAbusePhone: +1-800-768-0189 RAbuseEmail: arin[at]pryme.net RNOCHandle: OPERA12-ARIN RNOCName: Operations RNOCPhone: +1-800-768-0189 RNOCEmail: arin[at]pryme.net RTechHandle: OPERA12-ARIN RTechName: Operations RTechPhone: +1-800-768-0189 RTechEmail: arin[at]pryme.net OrgTechHandle: OPERA12-ARIN OrgTechName: Operations OrgTechPhone: +1-800-768-0189 OrgTechEmail: arin[at]pryme.net It would seem that here, today, the abuse of this address is reportable to arin at pryme.net. That's why it would be useful to try the refresh/show link. -- rick Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 18, 2009 Share Posted August 18, 2009 If one goes to dosnowmedia.com, one is taken to opendns. Domain doesn't seem to exist for me ...???? For people using OpenDNS servers, domains that do not exist get redirected to OpenDNS. That is part of their "service" which I need to remember whenever I test something locally. Link to comment Share on other sites More sharing options...
Miss Betsy Posted August 18, 2009 Share Posted August 18, 2009 Also, sometimes someone else has told spamcop what the abuse address should be. In other words, if they took your advice and changed it, perhaps some months down the road, someone would post saying the correct address is something[at]pryme.net. Other times, the server admin at the IP address requests spamcop reports go to a particular email address. In that case, if reports start bouncing, I would expect spamcop staff to look into it. IMHO, the best way to get to the bottom of it is to send a manual report to whatever email address you think is the correct one. Miss Betsy Link to comment Share on other sites More sharing options...
turetzsr Posted August 18, 2009 Share Posted August 18, 2009 <snip> IMHO, the best way to get to the bottom of it is to send a manual report to whatever email address you think is the correct one. ...That's a good solution. ...To submit your information to SpamCop, I would suggest that you send it to the SpamCop Deputies at e-mail address deputies[at]admin.spamcop.net. I don't know exactly in what form the SpamCop Deputies prefer such information but were I sending it I'd include a bit of discussion (as brief as possible) as to how I came upon the "correct" abuse address and why I consider it the best one to use. Link to comment Share on other sites More sharing options...
Miss Betsy Posted August 19, 2009 Share Posted August 19, 2009 Always nice to get confirmation! You are a good 'confirmer' Steve. Miss Betsy Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.