nomaster[at]devnull.spamcop.net

[efa]

what happen when found an IP that generate the infamous:

"No reporting addresses found for <IP>, using devnull for tracking."

I imagine no mail is sent outside Spamcop, and the one to <nomaster[at]devnull.spamcop.net> is to start a manual process to discover the right email. Right?

Here an example:

http://www.spamcop.net/sc?id=z5329725900z9...215fca8ad90f6bz

[turetzsr]

Hi, efa,

...Does the earlier discussion at your "No reporting addresses found for 83.95.183.76, using devnull for tracking" answer this, too, or do you have something entirely different in mind?

[SpamCopAdmin]

I imagine no mail is sent outside Spamcop

That's correct. It doesn't matter where we send the report. It is the act of sending the report that feeds our blocking list database. It would be nice to send the report to someone who will take action, but it's not necessary.

and the one to <nomaster[at]devnull.spamcop.net> is to start a manual process to discover the right email. Right?

No. We don't spend time trying to generate reporting addresses.

- Don D'Minion - SpamCop Admin -

- Service[at]Admin.SpamCop.net -

.

[efa]

I completely forgot I started the same thread in 2007, my two neurons does not communicate anymore.

Anyway, at that time about 1 on 100 spam generate a nomaster, in last month I estimate about 80%.

The spammers discovered a way to avoid reporting.

We have to automate the contact recovery in some manner?

[turetzsr]

I completely forgot I started the same thread in 2007, my two neurons does not communicate anymore.

...I can definitely relate! <g>

<snip>

The spammers discovered a way to avoid reporting.

<snip>

...Only to the abuse desk. If you went ahead with your report (which it appears you did), it fed the database that SpamCop uses to decide whether to include the IP address on the SCBL.

[Farelf]

83.149.3.48

using nslookup, type=ptr:

Non-authoritative answer:

48.3.149.83.in-addr.arpa name = ip-83-149-3-48.nwgsm.ru

******************************************************

Using NirSoft IPNetInfo v 1.37:

% This is the RIPE Database query service.

% The objects are in RPSL format.

%

% The RIPE Database is subject to Terms and Conditions.

% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Information related to '83.149.0.0 - 83.149.7.255'

...

person: Oleg A. Yurlov

e-mail: OYurlov[at]MegaFon.RU

notify: OYurlov[at]MegaFon.RU

...

% This query was served by the RIPE Database Query Service version 1.8.13 (WHOIS2)

******************************************************

[petzl]

I completely forgot I started the same thread in 2007, my two neurons does not communicate anymore.

Anyway, at that time about 1 on 100 spam generate a nomaster, in last month I estimate about 80%.

The spammers discovered a way to avoid reporting.

We have to automate the contact recovery in some manner?

Well you have had it added to the SCBL

http://www.spamcop.net/w3m?action=checkblo...;ip=83.149.3.48

If you have time you could look-up and address yourself

OYurlov[at]MegaFon.RU this is not listed as an abuse address sometimes admin find that sending reports to spam friendly worsens spam and has them DOS attack your address

For Windows there is a freeware program for you to try

http://www.nirsoft.net/utils/ipnetinfo.html (download is near page bottom under Feedback)

[Farelf]

Agree with petzl on possible reporting address. Fairly safe to add it to the user-defined reports from SC though if you are getting a stream from there and if have that facility as a paying user (keeps you quarantined from direct contact).

If you are happy with that "person" address (your spam, your call), better yet to propose it in http://forum.spamcop.net/forums/index.php?showforum=39 for Don or deputies to consider. That way, if taken up, it can be monitored for bounces, etc. And there must be more than just you who reported it. And the admin of that network "neighbourhood" looks to need all the help he can get (out of control). Or is simply spam-friendly - but in which case no harm done.**

[EDIT]**Ah, scrub that, sounds as spammy as can be on closer look:

"person:

...

remarks: Also known as Kris Werewolf"

Say what? And OYurlov[at] looks awfully suspect too since I see this network is "famous" as a Russian dating service. Nah, very much fear Mr. Werewolf needs no confirmation from SC about what his network is doing. Let it go, be happy when you contribute to having one of the IP addresses added to the SCbl and hope he draws some less forgiving attention from longer-retention RBLs as well. AAAaaaroooo!

[turetzsr]

<snip>

Fairly safe to add it to the user-defined reports from SC though if you are getting a stream from there and if have that facility as a paying user

<snip>

...Even us "free" users have this facility (or something that's at least analogous). To add an e-mail address to which to send reports:

1. navigate to the SpamCop reporting website.
   
2. log in.
   
3. click the "Preferences" tab.
   
4. click the link labeled "Report Handling Options."
   
5. look for the section labeled "Public standard report recipients" and enter addresses into the text field; if more than one address, separate with a comma followed by a space.
   
6. click the button labeled "Save Preferences" -- the button will be at the bottom left of the page; you will probably have to scroll down to see it.
   

The SpamCop parser will offer to send reports to the e-mail addresses you stored as "Public standard report recipients;" turn the checkboxes next to the addresses on or off as appropriate for the specific spam you are reporting.

[Farelf]

...Even us "free" users have this facility (or something that's at least analogous). ...

Good heavens, thanks for the reminder Steve - had totally forgotten that (mumble) premature senescence.