Steve Posted May 26, 2018 Share Posted May 26, 2018 Not sure why SC "dev/null"s this email address, but when I manually report emails to the address, within a few minutes I get an auto-reply back from Ikoula Support. Is SC refusing to send the emails to that address? https://www.spamcop.net/sc?id=z6466514536zb80506f981ff3477ff6381ec10110636z Link to comment Share on other sites More sharing options...
petzl Posted May 26, 2018 Share Posted May 26, 2018 5 hours ago, Steve said: Not sure why SC "dev/null"s this email address, but when I manually report emails to the address, within a few minutes I get an auto-reply back from Ikoula Support. Is SC refusing to send the emails to that address? https://www.spamcop.net/sc?id=z6466514536zb80506f981ff3477ff6381ec10110636z legacy issue maybe? For some reason SpamCop has been told they don't want reports or many reporting spam have said the abuse address gives details to spammers. Link to comment Share on other sites More sharing options...
Steve Posted May 26, 2018 Author Share Posted May 26, 2018 6 hours ago, petzl said: legacy issue maybe? For some reason SpamCop has been told they don't want reports or many reporting spam have said the abuse address gives details to spammers. Ok, so when SC "dev/null"s the reporting addresses, does the ISP still receive and process/handle the reports? Link to comment Share on other sites More sharing options...
Lking Posted May 26, 2018 Share Posted May 26, 2018 14 minutes ago, Steve said: Ok, so when SC "dev/null"s the reporting addresses, does the ISP still receive and process/handle the reports? No. As Petzl stated one of the possible reasons to dev/null a spam report is that the recipient has requested not to get the email or the ISP just passes the report to the spammer or past reports bounced ... SpamCop does not want to clutter the bandwidth with unwanted/bounced/ignored reports. Link to comment Share on other sites More sharing options...
Steve Posted May 26, 2018 Author Share Posted May 26, 2018 So then how do the spam reports that are dev/nulled get handled? Link to comment Share on other sites More sharing options...
Lking Posted May 26, 2018 Share Posted May 26, 2018 No matter where the spam reports go, to an ISP or to file (dev.null), the spam submitted feeds the database for the SpamCop Block List. The first objective/priority is to build a dynamic block list. All submitted email help build the SCBL, when the parser can identify a source IP. Secondly, the parser tries to identify a valid abuse address for the identify IP. If an address is found a redacted spam report is sent, unless there is no reason not to, Lastly, the body is parsed looking for spamertized link. This also adds to the SCBL and spam reports are sent similar to those above. As the last priority these links are often not parsed due to heavy workload and the limits of clock cycles. Link to comment Share on other sites More sharing options...
petzl Posted May 26, 2018 Share Posted May 26, 2018 4 hours ago, Steve said: So then how do the spam reports that are dev/nulled get handled? They stand to be blocklisted also SpamCop keeps statistics you can also add relevant abuse addresses to the Government Cert of that country Seems ikoula.com do not like being blocked! https://www.spamhaus.org/sbl/query/SBL371550 Their customer removed the following block https://www.spamhaus.org/sbl/query/109.238.2.52 Link to comment Share on other sites More sharing options...
Steve Posted May 27, 2018 Author Share Posted May 27, 2018 It seems from the auto-reply emails (and whois lookups) that they're a French ISP. Link to comment Share on other sites More sharing options...
petzl Posted May 27, 2018 Share Posted May 27, 2018 31 minutes ago, Steve said: It seems from the auto-reply emails (and whois lookups) that they're a French ISP. yes the CERT to add is "cert-fr.coss [AT] ssi [DOT] gouv [DOT] fr" Link to comment Share on other sites More sharing options...
Steve Posted May 27, 2018 Author Share Posted May 27, 2018 1 hour ago, petzl said: yes the CERT to add is "cert-fr.coss [AT] ssi [DOT] gouv [DOT] fr" Just checked here and that email addres is already there: Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.