178.33.170.88 reports to ovh.net

[petzl]

178.33.170.88 abuse[at]ovh.net (wrong abuse address?)

Why is this listed in Portugal??

178.33.170.88 ovh4ff.srv1.srv.br

abuse[at]ovh.net are complete scum as far as reading spam reports, The police is all they respond to from experience

I'm including

cert[at]cert.br mail-abuse[at]cert.br

Using Win32Whois I get this

Checking IP: 178.33.170.88...
Name:		ovh4ff.srv1.srv.br
IP:		178.33.170.88
Domain:	srv.br

Querying root.rwhois.net:4321 for srv.br...
Can not resolve host 'root.rwhois.net'

Software progam "Win32Whois" comes up with
Querying whois.nic.br for srv.br...

% Copyright (c) Nic.br
%  The use of the data below is only permitted as described in
%  full by the terms of use (http://registro.br/termo/en.html),
%  being prohibited its distribution, comercialization or
%  reproduction, in particular, to use it for advertising or
%  any similar purpose.
%  2012-12-17 04:48:28 (BRST -02:00)

% reserved:	CG

% Security and mail abuse issues should also be addressed to
% cert.br, http://www.cert.br/, respectivelly to  mailto:cert[at]cert.br
% and  mailto:mail-abuse[at]cert.br

[AJR]

You need to look at the whois records for the IP address rather than the domain name, which shows that the IP address belongs to OVH:

$ whois 178.33.170.88

% This is the RIPE Database query service.

% The objects are in RPSL format.

%

% The RIPE Database is subject to Terms and Conditions.

% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: this output has been filtered.

% To receive output for a database update, use the "-B" flag.

% Information related to '178.33.170.64 - 178.33.170.95'

inetnum: 178.33.170.64 - 178.33.170.95

netname: ONDAMKT3

descr: IPs da Onda

country: PT

org: ORG-OL44-RIPE

admin-c: OTC6-RIPE

tech-c: OTC6-RIPE

status: ASSIGNED PA

mnt-by: OVH-MNT

source: RIPE # Filtered

organisation: ORG-OL44-RIPE

org-name: OVH Hosting LDA

org-type: OTHER

address: Avenida Miguel Bombarda, 133 - 6�A

address: 1050-164 Lisboa

address: Portugal

abuse-mailbox: abuse[at]ovh.net

mnt-ref: OVH-MNT

mnt-by: OVH-MNT

source: RIPE # Filtered

role: OVH PT Technical Contact

address: OVH Hosting LDA

address: Avenida Miguel Bombarda, 133 - 6�A

address: 1050-164 Lisboa

address: Portugal

admin-c: OK217-RIPE

tech-c: GM84-RIPE

nic-hdl: OTC6-RIPE

abuse-mailbox: abuse[at]ovh.net

mnt-by: OVH-MNT

source: RIPE # Filtered

% Information related to '178.32.0.0/15AS16276'

route: 178.32.0.0/15

descr: OVH ISP

descr: Paris, France

origin: AS16276

mnt-by: OVH-MNT

source: RIPE # Filtered

% This query was served by the RIPE Database Query Service version 1.47 (WHOIS1)

The hostname ovh4ff.srv1.srv.br tells you that whoever is renting this server from OVH is based in Brazil (probably - the .br whois shows very minimal information), but the cert.br folks may not be able to do much unless they can get OVH to cooperate.

(As an aside, .br domain are registered at the third level, so the domain you'd need to check is srv1.srv.br rather than srv.br.)

[petzl]

You need to look at the whois records for the IP address rather than the domain name, which shows that the IP address belongs to OVH:

The hostname ovh4ff.srv1.srv.br tells you that whoever is renting this server from OVH is based in Brazil (probably - the .br whois shows very minimal information), but the cert.br folks may not be able to do much unless they can get OVH to cooperate.

(As an aside, .br domain are registered at the third level, so the domain you'd need to check is srv1.srv.br rather than srv.br.)

Thanks

OVH I never have had any luck with directly. A spammer was sending me child porn so went through French police which seemed to work?

This Brazil spammer has been attacking my email address for years finally got him moving by going upstairs abuse address. Now s/he's moved to OVH.net will keep including cert[at]cert.br & mail-abuse[at]cert.br.

Sometimes asking here one gets better advice.