mrmaxx Posted December 4, 2013 Share Posted December 4, 2013 Tracking URL: http://www.spamcop.net/sc?id=z5632489121z1...7f605f99d45803z SpamCop appears not to be able to talk to RipeStat and get the abuse contact information. For 193.19.76.0/23, the abuse contact is abuse[at]completel.fr Link to comment Share on other sites More sharing options...
Farelf Posted December 6, 2013 Share Posted December 6, 2013 Doesn't affect the found abuse address at all, but has routing changed since you reported? Can't see that IP address in the report linked. Link to comment Share on other sites More sharing options...
mrmaxx Posted December 9, 2013 Author Share Posted December 9, 2013 Doesn't affect the found abuse address at all, but has routing changed since you reported? Can't see that IP address in the report linked. Probably has, based on the new parse. Link to comment Share on other sites More sharing options...
Richard7310 Posted January 5, 2014 Share Posted January 5, 2014 Tracking URL: http://www.spamcop.net/sc?id=z5632489121z1...7f605f99d45803z SpamCop appears not to be able to talk to RipeStat and get the abuse contact information. For 193.19.76.0/23, the abuse contact is abuse[at]completel.fr I beg to differ: % Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net' % This query was served by the RIPE Database Query Service version 1.70.1 (ld 274) per SmartWhois®, Copyright © 1998-2013 TamoSoft, Version 5.1 (Build 274) Link to comment Share on other sites More sharing options...
mrmaxx Posted January 9, 2014 Author Share Posted January 9, 2014 I beg to differ: % Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net' % This query was served by the RIPE Database Query Service version 1.70.1 (ld 274) per SmartWhois®, Copyright © 1998-2013 TamoSoft, Version 5.1 (Build 274) I've noticed that sometimes the "abuse" address in the whois info and the abuse contact provided by RipeStat are different. Not sure if this is the case, but I was going directly to RIPE's website, so that would seem to be the "authoritative" person, unless the IP address is portable and has a new host. Link to comment Share on other sites More sharing options...
Richard7310 Posted January 10, 2014 Share Posted January 10, 2014 I've noticed that sometimes the "abuse" address in the whois info and the abuse contact provided by RipeStat are different. Not sure if this is the case, but I was going directly to RIPE's website, so that would seem to be the "authoritative" person, unless the IP address is portable and has a new host. Agreed that abuse contacts vary, but not sure if you mean any whois or RIPE Whois, compared to RipeStat. I was not so clear myself: Smart Whois does not show an ABUSE contact in this instance; rather, only ADMIN & TECH, noc[at]ddo.net & support[at]ddo.net, respectively. So, I clicked View Source, which opens a new window, where the footnote is '% This query was served by the RIPE Database Query Service version 1.70.1 (WHOIS1),' which has always seemed authoritative enough. Looking for a good address In the latter RIPE query. a new heading appears for the range within which the query exists, either '% Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net,' as in this case, or '% No Abuse contact registered for [n.n.n.n. - n.n.n.n].' However, a different contact may sometimes appear further down on an 'abuse-mailbox:' line, such that RIPE may be inconsistent within itself, aside from any possible difference with x-whois. The usually-present line, 'e-mail:,' and often-present line, 'notify:,' are worth a look & comparison, especially in the absence of an abuse contact, though an ADMIN or TECH role may be indicated. Sometimes, there is a 'remarks:' line, usually about using only a certain address. I find myself clicking on View Source for so many reasons, suffice it to say most of the time, without getting into a flow-chart situation now. I suppose that this is the RIPE mess currently being programmed. Link to comment Share on other sites More sharing options...
mrmaxx Posted January 13, 2014 Author Share Posted January 13, 2014 Agreed that abuse contacts vary, but not sure if you mean any whois or RIPE Whois, compared to RipeStat. I was not so clear myself: Smart Whois does not show an ABUSE contact in this instance; rather, only ADMIN & TECH, noc[at]ddo.net & support[at]ddo.net, respectively. So, I clicked View Source, which opens a new window, where the footnote is '% This query was served by the RIPE Database Query Service version 1.70.1 (WHOIS1),' which has always seemed authoritative enough. Looking for a good address In the latter RIPE query. a new heading appears for the range within which the query exists, either '% Abuse contact for '193.19.76.0 - 193.19.77.255' is 'contact[at]ddo.net,' as in this case, or '% No Abuse contact registered for [n.n.n.n. - n.n.n.n].' However, a different contact may sometimes appear further down on an 'abuse-mailbox:' line, such that RIPE may be inconsistent within itself, aside from any possible difference with x-whois. The usually-present line, 'e-mail:,' and often-present line, 'notify:,' are worth a look & comparison, especially in the absence of an abuse contact, though an ADMIN or TECH role may be indicated. Sometimes, there is a 'remarks:' line, usually about using only a certain address. I find myself clicking on View Source for so many reasons, suffice it to say most of the time, without getting into a flow-chart situation now. I suppose that this is the RIPE mess currently being programmed. Yeah. I usually check RIPE whois and RIPESTAT both. Sometimes even if there is an abuse contact in the RIPE whois, they will show a different abuse contact in RIPESTAT, which I find interesting. If neither of those works, or if the suggested RIPE/RIPESTAT contact is no good to SpamCop, I'll often do a traceroute and try to find the first hop above the host and complain to them. There's been a couple times I"d have to go three or four hops upstream to report and I figure by that time, there's no use reporting and I'll just have to let SC report to /DEV/NULL Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.