ArtmakersWorlds Posted September 1, 2012 Share Posted September 1, 2012 Hope I put this in the right place. Why do I keep getting this? No reporting addresses found for 5.101.40.80, using devnull for tracking. No reporting address? It came to me from somewhere. Why is it I can't seem to report these? Link to comment Share on other sites More sharing options...
rconner Posted September 1, 2012 Share Posted September 1, 2012 No reporting address? It came to me from somewhere. Why is it I can't seem to report these?The party that "owns" this IP address is supposed to register one or more contact addresses with the registry that issued the address, so (for example) they can be reached in cases of abuse of the address. In this case, they failed to do so, so SpamCop can't send a report to them. The IP address is retained by SpamCop, however, and may go onto (or remain on) a blocking list if the spamming continues. -- rick Link to comment Share on other sites More sharing options...
Farelf Posted September 2, 2012 Share Posted September 2, 2012 Interesting case. That network: inetnum: 5.101.0.0 - 5.101.95.255 netname: antoss-net descr: net for ISP Antoss ltd. country: RU org: ORG-Al246-RIPE (unusual scope - smaller than a /17, larger than a /18) ... doesn't rate highly in the spam stakes at all: ... doesn't bother the radar in http://www.spamcop.net/w3m?action=map;mask...cnt;sort=ipsort ... and I only see one SC report in the last 90 days (if you have a reporting credit/are a paying member you can retrieve that information). ... Senderbase - http://www.senderbase.org/ - finds nothing at all for the IP address or even for 5.101.40.0/24 (5.101.40.0 - 5.101.40.255). Yes, yes ArtmakersWorlds, you are "privileged" As Rick says, if the spam continues (and it is reported) it will, at least, keep accruing data for the SCbl but it would need to be hitting other reporters as well before it might be listed. On current indications there's no need to do more about this one. The RIPE record shows only an organization address (antoss[at]gmail.com) which is not an abuse address and not worth bothering at this point. All "no master" cases will have some sort of a story behind them and, generally, no sleep should be lost over that. Where there's substantial spamming and the parser fails to find an evident/likely reporting address or a no-report over-ride is possibly outdated, that's another story and there's a sub-forum for that (http://forum.spamcop.net/forums/index.php?showforum=39). Link to comment Share on other sites More sharing options...
petzl Posted September 2, 2012 Share Posted September 2, 2012 Interesting case. That network: inetnum: 5.101.0.0 - 5.101.95.255 netname: antoss-net descr: net for ISP Antoss ltd. country: RU org: ORG-Al246-RIPE (unusual scope - smaller than a /17, larger than a /18) Spammers often get into IP hopping to avoid blocklists Link to comment Share on other sites More sharing options...
ArtmakersWorlds Posted September 4, 2012 Author Share Posted September 4, 2012 I just don't understand half of what you folks talk about. I guess I'll keep on hitting send even if it says devnull. Hope that's good enough. Link to comment Share on other sites More sharing options...
Farelf Posted September 4, 2012 Share Posted September 4, 2012 Yes, that's the thing to do. Link to comment Share on other sites More sharing options...
turetzsr Posted September 4, 2012 Share Posted September 4, 2012 Hi, ArtmakersWorlds, ...The quick, simplified answer to your original question is that the SpamCop parser (which provided the message about which you are asking) isn't looking for the e-mail address that sent the message, it is looking for an "official" address to send a complaint but can't find one. Link to comment Share on other sites More sharing options...
lartingyou Posted December 24, 2014 Share Posted December 24, 2014 Hello, I'm chiming in because I've been receiving academic spams (promotion of conferences) out of a Jordanian university using a dirty list for some time. The parses always get a nomaster at devnull for the sending host mail1.just.edu.jo whose IP is 87.236.232.130. Here are examples: [edited to provide proper tracking links] https://www.spamcop.net/sc?id=z6024914306ze257ce5d677054e5ca27c8613c3b4074z https://www.spamcop.net/sc?id=z6034533535z3caace670fe85aa1999af4182a003d4fz https://www.spamcop.net/sc?id=z6032268933zec6ff5cebc9582e426c400d05bcb3c1fz https://www.spamcop.net/sc?id=z6025536261z292043ba8f3b15572f5f8ce5b1cec804z https://www.spamcop.net/sc?id=z6033078631zf3c93670b9d6c39976520477bb952c44z I'm willing to do the legwork to fix the problem, but want some advice on how to proceed. Do I need to contact an admin at mail1.just.edu.jo to point out that their RIPE info is wrong? Do I have a snowball's chance in Hades of making a difference? I'm getting pings back from semi-innocent bystanders whose URLs are spamvertized, but I realize the real force of SC is not being properly applied. Thanks for your advice in advance. EDIT: According to https://who.is/whois-ip/ip-address/87.236.232.130 : % Abuse contact for '87.236.232.0 - 87.236.233.255' is 'mayyad[at]junet.edu.jo' Link to comment Share on other sites More sharing options...
lisati Posted December 24, 2014 Share Posted December 24, 2014 Hello lartingyou. Unfortunately many users of this forum won't be able to view the reports you linked to, I was given "Sorry, you are not authorized to view this message." What some of us would find more useful are the tracking links that are shown when manually reporting spam rather than links to the actual reports. Link to comment Share on other sites More sharing options...
lartingyou Posted December 24, 2014 Share Posted December 24, 2014 What some of us would find more useful are the tracking links... My bad! I've been away too long and made a "beginner" mistake. I edited the original post above to fix this. Come to think of it, so many people make this mistake that perhaps the "past reports" UI could also provide tracking links. Engineers can recognize a bad design when enough people are making the same mistake. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.