BUG: Reporting tool cannot resolve Russian domain names

[wkrick]

The reporting tool is having issues resolving Russian domain names.

This is a problem for me because the majority of spam I get these days is in Russian.

I think it's ultimately a character set/encoding problem that's faking out the reporting tool.

For example, when I mouse over the link in the Russian spam in Firefox, the domain looks like the screenshot below...

But when I submit it through the SpamCop Reporting tool, I get this error...

Cannot resolve http://àëüôà-ãðóï.com.ua/kvoliti/

When I examine the source of the email, it appears that the email is using...

charset="windows-1251"

...and here's how the URL is actually encoded...

 

<DIV><A href=3D"http://=E0=EB=FC=F4=E0-=E3=F0=F3=EF.com.ua/kvoliti/"><FON=
T color=3D#0000ff size=3D4 
face=3DVerdana><B><U>=C1=EE=EB=FC=F8=E5 =E8=ED=F4=EE=F0=EC=E0=F6=E8=E8 =ED=
=E0 =F1=E0=E9=F2=E5 
>>></U></B></FONT></A></DIV>

[turetzsr]

Hi, wkrick,

...While the SpamCop parser does make an attempt to report spamvertized links, that is not at all an important consideration. There are other tools, such as Knujon and Complainterator, that are more appropriate for that purpose.

...The error wasn't fatal, was it (the parse results still enabled you to send complaints to the spam source abuse addresses, right?)?

[wkrick]

...The error wasn't fatal, was it (the parse results still enabled you to send complaints to the spam source abuse addresses, right?)?

Unfortunately, the source is bouncing abuse reports so the report gets devnulled...

Tracking message source: 79.99.130.226:

Routing details for 79.99.130.226

[refresh/show] Cached whois for 79.99.130.226 : abuse[at]troublefree.nl

Using abuse net on abuse[at]troublefree.nl

No abuse net record for troublefree.nl

Using best contacts abuse[at]troublefree.nl

abuse[at]troublefree.nl bounces (15 sent : 8 bounces)

Using abuse#troublefree.nl[at]devnull.spamcop.net for statistical tracking.

...and I get tons of email from these jerks daily. I just want it to stop.

[turetzsr]

Unfortunately, the source is bouncing abuse reports so the report gets devnulled...

...But that's a separate issue from resolving spamvertized links. Please bear in mind that the principal purpose of SpamCop is to manage the SpamCop Blocklist (messages to abuse desks is a secondary, albeit useful, feature) and devnulling doesn't have an affect on whether your spam contributes to the BL.

...and I get tons of email from these jerks daily. I just want it to stop.

...Again, a separate issue from resolving spamvertized links. And you can always complain directly to whomever you can find to accomplish the goal of stopping the spam, if you can find the appropriate people/ organizations. And if these sources (IP addresses from which the spams originate) do wind up on the SCBL, the SCBL can be used to get them from falling into your Inbox.

[Farelf]

Unfortunately, the source is bouncing abuse reports so the report gets devnulled...

...and I get tons of email from these jerks daily. I just want it to stop.

...And you can always complain directly to whomever you can find to accomplish the goal of stopping the spam, if you can find the appropriate people/ organizations. ...

Sounds like a job for RIPE abuse-finder, brought to attention by cwg in http://forum.spamcop.net/forums/index.php?showtopic=11957

http://apps.db.ripe.net/dbweb/search/abuse-finder.html suggests two abuse addresses for 79.99.130.226 -

abuse[at]troublefree.nl

abuse[at]pcextreme.nl

The first one bounces, the second one is worth a try. Note it is not uncommon for abuse addresses to bounce SpamCop reports but accept private (manual) reports. The fact they bounce SC reports is not a good indication about their preparedness to address spam issues however.

Cross-reference added in the "routing" forum http://forum.spamcop.net/forums/index.php?showtopic=11969

[Stan_qaz]

I am starting to see a good number of these and wondered if there were any plans to add detection and reporting for URLs using the international character encoding?

	Òåë.:   +7-911-959-89-48,	 
	ýë.ïî÷òà :  mail[at]sensorus.ru
	www.áåñêîíòà êòíûå-òåõíîëîãèè.ðô  

http://www.spamcop.net/mcgi?action=gettrac...rtid=5720953763

If I understand things properly I might as well do a quick report on these for now since the web link is being ignored by the full reporting. Is that the best solution?

[turetzsr]

<snip>

http://www.spamcop.net/mcgi?action=gettrac...rtid=5720953763

...Thank you for trying to provide the full parse for us, Stan_qaz, but unfortunately you and SpamCop staff are the only ones who can access that link. Please see information regarding the "Tracking link" for a link that most of us will be able to see.

If I understand things properly I might as well do a quick report on these for now since the web link is being ignored by the full reporting. Is that the best solution?

...You should be able to use any reporting method available to you, all will report the spam (if possible) and ignore the links that it can not interpret.

...Side note: quick reporting is a little (or very, for some) dangerous: please see the "WARNING" in the body of SpamCop FAQ entry "What Is Quick Reporting?"

[Stan_qaz]

Thanks for the tip on the tracking URL, I have so few problems I don't post here often and messed that up. If I'm reading your link correctly there is no way to get a sharable link unless I keep the one on the reporting page as it isn't available elsewhere / later. Keeping a few more tabs available when I'm having a problem won't be much of a burden so I'll do that next time I have an issue.

I'll just filter these messages out and do quick reports on them, no sense wasting fuel on full reports if the links won't be used. So far I haven't has any major problems with quick reporting but keep an close eye on what is being done so if something does come up I'll catch it early.

Thanks.

[Farelf]

You can retrieve the tracking link/URL from within the "Past Reports" tab in your member account Stan (hit the "Parse" link in the selected and displayed report to get to it, near the top of the resulting page). It looks like

http://www.spamcop.net/sc?id=z5266044301z87c91e752269c0b484e02c9e60ebdba9z