FuturePilot Posted July 27, 2016 Share Posted July 27, 2016 This has been disabled for some time now. Is there anything that can be done about this? I'm getting bombarded with large amounts of spam coming from datashack. Link to comment Share on other sites More sharing options...
Lking Posted July 27, 2016 Share Posted July 27, 2016 By "disabled" do you mean that spam reports are being send to '[at]devnull.spamcop.net' ? If so, there are several reason why this could be done, for example 1) datashack.net has ask not to receive reports, 2) SpamCop knows that the host sends spam reports to the spammer, 3) spam reports bounce when send to the identified abuse email address.... Of course a Tracking URL for an example spam would help the rest of us know what you mean, and explain what the parser has done. Link to comment Share on other sites More sharing options...
FuturePilot Posted July 27, 2016 Author Share Posted July 27, 2016 3 hours ago, Lking said: By "disabled" do you mean that spam reports are being send to '[at]devnull.spamcop.net' ? If so, there are several reason why this could be done, for example 1) datashack.net has ask not to receive reports, 2) SpamCop knows that the host sends spam reports to the spammer, 3) spam reports bounce when send to the identified abuse email address.... Of course a Tracking URL for an example spam would help the rest of us know what you mean, and explain what the parser has done. Yes it's dev nulling the reports. Parsing header: Received: from mx2.keylognews.com ([142.54.168.228]) by mx-ha.gmx.net (mxgmx012) with ESMTP (Nemesis) id 0Mhe4p-1beLt242ct-00Mq8U for <x>; Tue, 26 Jul 2016 17:16:28 +0200 host 142.54.168.228 = ketira.extra965.net (cached) Possible spammer: 142.54.168.228 Received line accepted Received: from (127.0.0.1) by mx2.keylognews.com id hiuvcu16lt0v for <x>; Tue, 26 Jul 2016 14:49:34 -0500 (envelope-from <return@mx2.keylognews.com>) no from host 127.0.0.1 (getting name) no name 142.54.168.228 not listed in cbl.abuseat.org 142.54.168.228 not listed in dnsbl.sorbs.net 142.54.168.228 is not an MX for mx-ha.gmx.net 142.54.168.228 is an MX for mx2.keylognews.com 127.0.0.1 discarded Tracking message source: 142.54.168.228: Routing details for 142.54.168.228 [refresh/show] Cached whois for 142.54.168.228 : security@datashack.net Using abuse net on security@datashack.net abuse net datashack.net = security@datashack.net Using best contacts security@datashack.net Reports disabled for security@datashack.net Using security#datashack.net@devnull.spamcop.net for statistical tracking. Message is 26 hours old 142.54.168.228 not listed in cbl.abuseat.org 142.54.168.228 not listed in dnsbl.sorbs.net 142.54.168.228 not listed in accredit.habeas.com 142.54.168.228 not listed in plus.bondedsender.org 142.54.168.228 not listed in iadb.isipp.com Finding links in message body Parsing HTML part Reducing redundant links for bit.ly Resolving link obfuscation http://bit.ly/2a44hg6 Tracking link: http://bit.ly/2a44hg6 No recent reports, no history available Host bit.ly (checking ip) = 67.199.248.10 Resolves to 67.199.248.10 Routing details for 67.199.248.10 [refresh/show] Cached whois for 67.199.248.10 : abuse@bitly.com Using abuse net on abuse@bitly.com abuse net bitly.com = security@bit.ly Using best contacts security@bit.ly Reports regarding this spam have already been sent: Re: 142.54.168.228 (Administrator of network where email originates) Reportid: 6500407631 To: security#datashack.net@devnull.spamcop.net Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.