MyNameHere Posted April 12, 2013 Posted April 12, 2013 I admit I haven't paid a lot of attention to spamvertised URL reporting in the past, but today I noticed a lot of "Cannot find master for..." messages on those. The parser is finding a reporting address but says "Reports disabled for...," and there are no reports sent regarding the spamvertised URLs. I thought if reports were disabled or no reporting address was found, the reports were sent to nomaster<at>devnull.spamcop.net or abuse#<domain><at>devnull.spamcop.net for tracking. In fact, I saw some of those messages today, but most of the URLs were "Cannot find master" and not reported at all. What am I missing here? Here is an example tracking URL. Thanks!
Farelf Posted April 12, 2013 Posted April 12, 2013 The SC blocklist handles only the IP addresses of the spam sources/relays into your network - addresses of spamvertized URLs aren't listed there. The SURBL taps in to anything the parser resolves as I understand it but that's not part of SC. Looks to be a lot of new "pharmaceutical" sites being thrown up at the moment, a new botnet offensive under way, perhaps, more noticeable than usual for some reason, anyway.
petzl Posted April 12, 2013 Posted April 12, 2013 I admit I haven't paid a lot of attention to spamvertised URL reporting in the past, but today I noticed a lot of "Cannot find master for..." messages on those. The parser is finding a reporting address but says "Reports disabled for...," and there are no reports sent regarding the spamvertised URLs. I thought if reports were disabled or no reporting address was found, the reports were sent to nomaster<at>devnull.spamcop.net or abuse#<domain><at>devnull.spamcop.net for tracking. In fact, I saw some of those messages today, but most of the URLs were "Cannot find master" and not reported at all. What am I missing here? Here is an example tracking URL. Thanks! Devnull because there is no reportable address found Using this windows program and looking I came up with 89.31.32.56 ohotin[at]icentr.net Another of countless former Soviet bloc's Botnets http://cbl.abuseat.org/lookup.cgi?ip=89.31.32.56
MyNameHere Posted April 13, 2013 Author Posted April 13, 2013 Maybe I wasn't clear. I'm asking why the parser was not using devnull. It was just saying "Cannot find master" and giving up. Maybe I wasn't clear. I'm asking why the parser was not using devnull. It was just saying "Cannot find master" and giving up. I see now that the tracking URL now shows a more normal parsing. That's not what it was doing this morning. That means something changed between this morning and afternoon. This morning the parser said "Cannot find master..." about almost all the URLs in my batch of spam.
Recommended Posts
Archived
This topic is now archived and is closed to further replies.