APNIC Mirror Issue (was NoMaster ???)

[Wazoo]

This is the old APNIC mirror issue.  Please see Linear Post #8 above.  I have merged your original Topic (with Subject "Replying to No Master dev'nulling") into this Topic.

31093[/snapback]

Man, talk about all the errors involved when trying to submit an edit I was doing and the post got moved <g>

At any rate, the APNIC mirrors that the SpamCop parser is using aren't returning any data at present.

[Jeff G.]

Man, talk about all the errors involved when trying to submit an edit I was doing and the post got moved <g>

31095[/snapback]

I'm sorry.

[btech]

Sorry guys. I did a search, but nothing came up.. I must have searched wrong.

[efa]

From one month to today, I got a lot of "No reporting abuse email address" in header analisys.

I try to do a Whois query on source IP of that spam email, and the abuse address are always present.

All that spam mail come from APNIC Registrar.

So I think that spamcop cannot understand a new whois apnic report format.

If it is only one or two message, is not a big problem, but, I receive about 10 spam a day, and about 2 are with warn: "No reporting abuse email address"

So spamcop are lossing usefull.

Spamcop Admin: please fix it.

Valerio

[Jeff G.]

Valerio,

This is the old APNIC mirror issue. Please see Linear Post #8 above. I have merged your original Topic (with Subject "No reporting abuse email address") into this Topic.

Thanks!

[Jank1887]

This is the old APNIC mirror issue.

31328[/snapback]

well, if it's that old, why ain't it fixed yet?

[Jeff G.]

well, if it's that old, why ain't it fixed yet?

31329[/snapback]

Sorry, TPTB have yet to comment on an ETA for the fix.

[efa]

for sure is a spamcop parser bug.

All this whois report have an admin/abuse email to report spam.

For now we can continue to complain manually.

But spamcop are losing utility if Julian do not fix it in a hurry, please before holiday.

:-))

[Jeff G.]

I agree that this bug needs to be squashed. While we wait for that, would you mind asking your network admins to read the remarks at http://www.ripe.net/fcgi-bin/whois?form_ty...0&submit=Search? Thanks!

[efa]

would you mind asking your network admins to read the remarks at http://www.ripe.net/fcgi-bin/whois?form_ty...0&submit=Search?  Thanks!

31353[/snapback]

I dont understand whats paragraph in particular you are speaking of?

That whois record is about my company.

Those admins have done something wrong?

[Jeff G.]

I was referring to:

remarks:      This inetnum has been transfered as part of the ERX.

remarks:      It was present in both the ARIN and RIPE databases, so

remarks:      the information from both databases has been merged.

remarks:      If you are the mntner of this object, please update it

remarks:      to reflect the correct information.

remarks:

remarks:      Please see the information for this process:

remarks:      http://www.ripe.net/projects/erx/erx-ip/network-138.html

...

remarks:      Please visit the following URL to unlock this object

remarks:      http://www.ripe.net/db/none-deprecation-042004.html

[efa]

I was referring to:

31422[/snapback]

As I can understand, my Company Admins do not "resend authenticated email" of tech and abuse contacts from 2003 to today?

Right?

I'm not sure that I understood correctly, please explain me.

[StevenUnderwood]

Have your admins follow the links Jeff G. provided and fix the entries.

The entries changed, not because of anything on your end, but because of a change at the registrar that now requires your admins to correct/confirm.

[efa]

I work in a big company, I never see the IT admins.

And more I'm not sure that my admins will follow the RIPE message.

But for sure when I'll back at work I'll try to contact them and send your/RIPE notifications.

[agsteele]

for sure is a spamcop parser bug.

All this whois report have an admin/abuse email to report spam.

For now we can continue to complain manually.

But spamcop are losing utility if Julian do not fix it in a hurry, please before holiday.

:-))

31349[/snapback]

Well, for me, the process works well enough. These messages are getting trapped so I'm happy enough with that.

Sure, the reports to the abuse desks may not be reaching the desired destination but as my main priority is to keep the spew out of my mailbox I'm happy enough. The reporting to the abuse desk is an added benefit which I can manage without until TPTB are able to find a fix :-)

Andrew

[turetzsr]

<snip>

From: "Ellen"

Newsgroups: spamcop.routing

Subject: APNIC issues

Date: Mon, 13 Jun 2005 12:26:50 -0400

Organization: SpamCop

Lines: 12

Message-ID: <d8kcb0$ldn$1[at]news.spamcop.net>

NNTP-Posting-Date: Mon, 13 Jun 2005 16:30:25 +0000 (UTC)

X-Priority: 3

X-MSMail-Priority: Normal

I have opened a ticket on the APNIC issues. Until that is resolved, there is

no point in sending any more of these to routing. I am not inclined to

manual route the whole of apnic one block at a time :-)

Thanks

Ellen

29457[/snapback]

...Okay, it's been about four months, now ... can anyone jiggle the chain of TPTB to see if there's any hope for a fix?

...Also, I will note that the parser is able to find abuse addresses for these. See, for example, tracking URL http://www.spamcop.net/sc?id=z814507854z0b...ae8b4c667b923dz. So I'm wondering why it doesn't go ahead and offer to send to those abuse addresses ....

[Jeff G.]

1. Reports were already sent for that Tracking URL.
   
2. Longstanding bugs I documented in my FAQ Entry: The Link Analysis Process sometimes prevent reporting of spamvertized URLs.
   
3. abuse[at]kornet.net has gone "toes-up" ("abuse[at]kornet.net bounces (70325 sent : 43196 bounces)").
   

I have some suggested replacements for abuse[at]kornet.net: webmaster[at]kt.co.kr, yhs[at]kt.co.kr, and spamcop[at]kisa.or.kr (none of which bounced the last time I used them).

[turetzsr]

1. Reports were already sent for that Tracking URL.
   

34007[/snapback]

...True but I don't understand the relevance of this point....

• 2. Longstanding bugs I documented in my FAQ Entry: The Link Analysis Process sometimes prevent reporting of spamvertized URLs.
  

34007[/snapback]

...Again, I don't understand the relevance. The spamvertized URL was reported. It is the spam source that went to "nomaster."

• 3. abuse[at]kornet.net has gone "toes-up" ("abuse[at]kornet.net bounces (70325 sent : 43196 bounces)").
  

I have some suggested replacements for abuse[at]kornet.net: webmaster[at]kt.co.kr, yhs[at]kt.co.kr, and spamcop[at]kisa.or.kr (none of which bounced the last time I used them).

34007[/snapback]

...Is Julian or a Deputy aware of this? If not, could you enlighten them? If so, perhaps a reminder is in order? Thanks, Jeff G!

[Jeff G.]

Steve T, you have access to the same notification tools for SpamCop Deputies and Admins that I have access to. Good luck in getting this notification changed!