navybuff Posted July 19, 2005 Share Posted July 19, 2005 This guy is getting away with big time spamming. The source is being parsed but the domain is not.... Any Ideas? Seems like if it is reported correctly one time then SC should cache the results to use in the 10000 emails that follow with the same Spamvertised domain. See this: http://www.spamcop.net/sc?id=z787448268zdd...aa58b18b88351az http://joanne.pharma-plus.net/extra/xxxpersonals/ http://marko.pharma-plus.net/extra/xxxpersonals/ pharma-plus.net is IP Address 200.196.236.82 in Brazil Security issues should also be addressed to cert[at]cert.br, http://www.cert.br/ Mail abuse issues should also be addressed to mail-abuse[at]cert.br Registrar: Latin American and Caribbean IP address Regional Registry IP Address: 200.196.236.82 Whois results from whois.lacnic.net: % Copyright LACNIC lacnic.net % The data below is provided for information purposes % and to assist persons in obtaining information about or % related to AS and IP numbers registrations % By submitting a whois query, you agree to use this data % only for lawful purposes. % 2005-07-18 23:42:42 (BRT -03:00) inetnum: 200.128/9 status: allocated owner: Comite Gestor da Internet no Brasil ownerid: BR-CGIN-LACNIC responsible: Frederico A C Neves address: Av. das Nações Unidas, 11541, 7° andar address: 04578-000 - São Paulo - SP country: BR phone: +55 11 9119-0304 [] owner-c: CGB tech-c: CGB inetrev: 200.128/9 nserver: A.DNS.BR nsstat: 20050717 AA nslastaa: 20050717 nserver: B.DNS.BR nsstat: 20050717 AA nslastaa: 20050717 nserver: C.DNS.BR nsstat: 20050717 AA nslastaa: 20050717 nserver: D.DNS.BR nsstat: 20050717 AA nslastaa: 20050717 nserver: E.DNS.BR nsstat: 20050717 AA nslastaa: 20050717 remarks: These addresses have been further assigned to Brazilian users. remarks: Contact information can be found at the WHOIS server located remarks: at whois.registro.br or at http://whois.registro.br created: 19950104 changed: 20020902 nic-hdl: CGB person: Comite Gestor da Internet no Brasil e-mail: blkadm[at]NIC.BR address: Av. das Nações Unidas, 11541, 7° andar address: 04578-000 - São Paulo - SP country: BR phone: +55 19 9119-0304 [] created: 20020902 changed: 20050621 Link to comment Share on other sites More sharing options...
Merlyn Posted July 19, 2005 Share Posted July 19, 2005 http://www.spamhaus.org/sbl/sbl.lasso?query=SBL26457 Link to comment Share on other sites More sharing options...
navybuff Posted July 19, 2005 Author Share Posted July 19, 2005 http://www.spamhaus.org/sbl/sbl.lasso?query=SBL26457 30385[/snapback] Not sure what the point is here, I know it's blacklisted, why don't SC ? Link to comment Share on other sites More sharing options...
StevenUnderwood Posted July 19, 2005 Share Posted July 19, 2005 Not sure what the point is here, I know it's blacklisted, why don't SC ? 30386[/snapback] Spamcop does NOT blacklist based on spamvertized sites. It only sends a warning which you could do manually to: Reporting addresses: abuse[at]empresas.telefonica.com.br mail-abuse[at]nic.br security[at]empresas.telefonica.com.br These were found by entering only the url into the parser. Also, there have been PLENTY of reports about that URL already sent as seen in: http://www.spamcop.net/mcgi?action=showhis...id;val=62382285 If I were you, I would be complaining about finding the URL then doing nothing about it, which is in another recent topic here in the forums. This is still unexplained why it happens sometimes and not others (as I said, that link has been reported lots of times). In this specific case, it MIGHT have to do with the characters surrounding the link, ie: ---- http://marko.pharma-plus.net/extra/xxxpersonals/ ** Often, the multiple dashes is used to indicate a signature. Often a signature would be an Innocent Bystander (hotmail or Yahoo webmail, for instance). This is my best guess as to why the link is found and not parsed. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.