"Reporting disabled for ee.net"

[mikeobrien]

I'm getting a bunch of spam about a purported "Bird Flu Conference", advertising some conference in Washington D.C. The company involved appears to be "New Fields", whose server is in Japan(?) - ntt.net, anyway.

Whenever I report it, the mail is supposed to be sent to "ee.net", but I get instead "Reporting blocked for ee.net". Can anyone give me an idea why that is, and why I shouldn't end-run this and report it manually to "abuse[at]ee.net" myself?

Tracking URL for the curious:

http://www.spamcop.net/sc?id=z1269771375zd...5a2b1809499f25z

[agsteele]

Whenever I report it, the mail is supposed to be sent to "ee.net", but I get instead "Reporting blocked for ee.net". Can anyone give me an idea why that is, and why I shouldn't end-run this and report it manually to "abuse[at]ee.net" myself?

Looks to me as though the admins at ee.net are doing one of the following: bouncing reports, don't have an abuse address available, or have asked not to receive reports.

If that's the case then sending a manual report as you suggest is likely to have little result. Submitting the report has achieved the primary purpose of updating the SCbl

That said the guys at ee.net look like they're a reputable ISP. It may just be that they don't have a functioning abuse[at] address

Their website lists the following contacts:

Toll Free (800) 240 1981

Support

Email support[at]ee.net

DNS Administrator

Email dns[at]ee.net

You could try contacting them direct on one of these addresses.

If you get through then you can note that these New Fields folks seem to be the culprits since all the reports registered for the IP address in question are for this organisation.

Submitted: 04 April 2007 08:54:55 +0100:

New York Bird Flu School Planning Summit Announced

* 2229404077 ( http://www.new-fields.com/ ) To: abuse[at]ntt.net

* 2229404062 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 04 April 2007 08:46:23 +0100:

New York Bird Flu School Planning Summit Announced

* 2229397286 ( http://www.new-fields.com/ ) To: abuse[at]ntt.net

* 2229397272 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 04 April 2007 03:54:10 +0100:

New York Bird Flu School Planning Summit Announced

* 2229202462 ( http://www.new-fields.com/ ) To: mole[at]devnull.spamcop.net

* 2229202451 ( 209.190.4.66 ) To: mole[at]devnull.spamcop.net

Submitted: 04 April 2007 01:41:22 +0100:

New York Bird Flu School Planning Summit Announced

* 2229125599 ( http://www.new-fields.com/ ) To: abuse[at]ntt.net

* 2229125596 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 03 April 2007 14:04:24 +0100:

BREAKING NEWS - Egypt confirms 32nd human case of H5N1 infection

* 2228347530 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2228347473 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 03 April 2007 08:46:35 +0100:

BREAKING NEWS - Egypt confirms 32nd human case of H5N1 infection

* 2227888748 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2227888747 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 03 April 2007 07:07:32 +0100:

BREAKING NEWS - Egypt confirms 32nd human case of H5N1 infection

* 2227773150 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2227773098 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 01 April 2007 23:28:24 +0100:

Algeria Electricity EXPO 2007 in Algeria

* 2226244022 ( http://www.new-fields.ae/ ) To: saleemmb[at]emirates.net.ae

* 2226243995 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 30 March 2007 02:56:28 +0100:

BREAKING NEWS - Three more dead from H5N1 infection in Indonesia

* 2221530839 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2221530834 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 29 March 2007 12:59:30 +0100:

BREAKING NEWS - Three more dead from H5N1 infection in Indonesia

* 2220626721 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2220626719 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 29 March 2007 11:32:59 +0100:

BREAKING NEWS - Three more dead from H5N1 infection in Indonesia

* 2220528714 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2220528713 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 29 March 2007 09:59:40 +0100:

BREAKING NEWS - Three more dead from H5N1 infection in Indonesia

* 2220431164 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2220431163 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 29 March 2007 04:41:30 +0100:

BREAKING NEWS - Three more dead from H5N1 infection in Indonesia

* 2220067387 ( http://new-fields.com/birdfluschoolny/ ) To: mole[at]devnull.spamcop.net

* 2220067385 ( 209.190.4.66 ) To: mole[at]devnull.spamcop.net

Submitted: 29 March 2007 01:46:41 +0100:

BREAKING NEWS - Three more dead from H5N1 infection in Indonesia

* 2219908749 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2219908741 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Submitted: 29 March 2007 01:40:30 +0100:

BREAKING NEWS - Three more dead from H5N1 infection in Indonesia

* 2219882785 ( http://new-fields.com/birdfluschoolny/ ) To: abuse[at]ntt.net

* 2219882784 ( 209.190.4.66 ) To: abuse#ee.net[at]devnull.spamcop.net

Senderbase also notes a somewhat elevated chnage in Email volumes for their IP so if you can get through you may do them a favour by alerting them to the potential for a problem coming their way.

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day 4.9 1674%

Last 30 days 4.2 267%

Andrew

[mikeobrien]

Well, the actual error is "reports disabled for abuse[at]ee.net". I did try sending a few reports by hand. Whether it's a direct result would be hard to say, but I immediately saw a rise in incoming spam from ee.net - more than just bird flu stuff this time. It died out after I quit reporting manually. The stuff I sent to the abuse address did not bounce, so the address is good.

ee.net does look like a legit outfit but after that I have to wonder if perhaps one or two employees are augmenting their income...

Still love to know why "reports disabled".

[Farelf]

Still love to know why "reports disabled".

Indeed, report disabling often generates curiosity/suspicion. Since report disabling is a manual over-ride and there are many possible reasons - Don touched on this in [Resolved] Reports disabled, what is the significance? and Wazoo commented in Post #2 Reports disabled, What is the meaning of this message? - only a Deputy or SC Admin could say. Presumably they keep notes, it might be 'nice' to have an explanation or reference in/linked to the notation but I don't see anything like that in your posted tracking link. Maybe some 'history' link exists before the reports are sent? (But please, don't post a tracking URL to any unreported/uncancelled report in process.) I don't recall that in-line detail on the specifics of 'Reports disabled' has yet been requested in New Feature Request - but any such implementation involving more work for the the already overworked SC staff would be foredoomed (of course other solutions are conceivable, reality might be different).