Charter Communications autoreply bounces

[SideWinder]

I get the following autoreply bounces from SC notifications sent to Charter Communications (abuse at charter.net), when the IP block complained about really belongs to "WORLDWIDE WEB WORKS, LLC.". according to ARIN. However, a short trace reveals that Charter is the upstream provider for WWWL (through 71.14.172.253).

Should SC admins contact Charter and make sure they are actually wishing to receive SC reports about WWWL (as it doesn't seem like so because they get treated like this)?

These types of bounces come from "spamvertised website" reports and are like this (some editing done to obscure identities):

Received: via tmail-2004a-sau for x.200; Thu, 31 May 2007 15:29:x +0300 (EEST)

Received: from emh07.mail.saunalahti.fi (emh07.mail.saunalahti.fi [62.142.5.117])

by be33.mail.saunalahti.fi (Postfix) with ESMTP id x

for <x>; Thu, 31 May 2007 15:29:x +0300 (EEST)

Received: from sc-smtp2-bulkmx.soma.ironport.com (sc-smtp2-bulkmx.soma.ironport.com [204.15.82.125])

by emh07.mail.saunalahti.fi (Postfix) with ESMTP id x

for <x>; Thu, 31 May 2007 15:29:x +0300 (EEST)

Received: from sc-app2.spamcop.net ([204.15.82.21])

by sc-smtp2-bulkmx.soma.ironport.com with SMTP; 31 May 2007 05:29:x -0700

X-SpamCop-Reply-Ids: 2312132545

X-Spamcop-Return-Path: <x[at]abusecore.charter.net>

Received: from sc-smtp4-bulkmx.soma.ironport.com (sc-smtp4-bulkmx.soma.ironport.com [204.15.82.126])

by sc-app2.soma.ironport.com (Postfix) with ESMTP id x

for <x[at]reports.spamcop.net>; Thu, 31 May 2007 05:28:x -0700 (PDT)

Received: from abusecore.charter.net ([209.225.29.51])

by sc-smtp4-bulkmx.soma.ironport.com with ESMTP; 31 May 2007 05:28:x -0700

Received: from abusecore.charter.net (localhost [127.0.0.1])

by abusecore.charter.net (8.12.10/8.12.10/SuSE Linux 0.7) with ESMTP id x

for <x[at]reports.spamcop.net>; Thu, 31 May 2007 12:28:x GMT

Received: (from root[at]localhost)

by abusecore.charter.net (8.12.10/8.12.10/Submit) id x;

Thu, 31 May 2007 12:28:x GMT

Date: Thu, 31 May 2007 12:28:x GMT

Message-Id: <x[at]abusecore.charter.net>

From: Charter Abuse Tracking System <abuse[at]charter.net>

To: "SideWinder" <x[at]reports.spamcop.net>

Cc:

Subject: Re: [5.31.2007 2368125] [spamCop (http://wedfegge.com/) id:2312132545]Looking for gift? Buy Rolex! znhu

This email address is for reporting incidents of abuse coming from IP

addresses registered to Charter Communications. Abuse from IP addresses

not registered to Charter Communications should be directed to the

registered owners of the IP address in question.

The following link should be of assistance in locating the organization

responsible for the IP address:

http://www.arin.net/whois

Thank you,

Charter High-Speed Internet Security Team

# # #

From: "SideWinder" <x[at]reports.spamcop.net>

To: abuse[at]charter.net

Date: Wed, 30 May 2007 14:14:x +0300

Subject: [spamCop (http://wedfegge.com/) id:2312132545]Looking for gift? Buy Rolex! znhu

[Part 0 (plain text)]

[ SpamCop V640 ]

This message is brief for your comfort. Please use links below for details.

Spamvertised web site: http://wedfegge.com/

http://www.spamcop.net/w3m?i=z2312132545z5...5f9c20ad7847c8z

http://wedfegge.com/ is 216.211.158.128; Thu, 31 May 2007 12:25:32 GMT

[ Offending message ]

Received: via tmail-2004a-sau for x.200; Wed, 30 May 2007 14:14:x +0300 (EEST)

Received: from emh02.mail.saunalahti.fi (emh02.mail.saunalahti.fi [62.142.5.108])

by be33.mail.saunalahti.fi (Postfix) with ESMTP id x

for <x>; Wed, 30 May 2007 14:14:x +0300 (EEST)

Received: from swbell.net (unknown [61.152.182.228])

by emh02.mail.saunalahti.fi (Postfix) with ESMTP id x;

Wed, 30 May 2007 14:14:x +0300 (EEST)

Subject: Looking for gift? Buy Rolex! znhu

Message-ID: <1180_______1781[at]club-internet.fr>

To: x, x, x, x, x, x, x, x

Date: Wed, 30 May 2007 11:12:x +0000

From: "Fannie Cartwright" <fanniecartwright_gf[at]club-internet.fr>

MIME-Version: 1.0

Content-Type: text/plain;

charset="iso-8859-2"

Content-Transfer-Encoding: quoted-printable

Dear x

http://wedfegge.com

What is Exquisite Replica store?

At Exquisite Replica, we specialize in the sales of brand-name quality,

luxury replicas at some of the lowest prices possible. With our large sel=

ection of

products, you can be sure to find that perfect gift for yourself or a lov=

ed one.

You can buy:

* Rolex Watches

* Cartier Watches

* Breitling Watches

* Bvlgari Watches

* Omega Watches

* Tag Heuer Watches

* Officine Panerai Watches

* A.Lange & Sohne Watches

* Franck Muller Watches

* Chopard Watches

* Hermes Watches

* Jacob & Co. Watches

Get 25% off when buying 2 watches!

Visit Exquisite Replica Shop!

http://wedfegge.com

Thanks

Jennifer Cassidy

x wrote:

> Looking for special gift. Buy Rolex

knznfh1xbp-

[StevenUnderwood]

I get the following autoreply bounces from SC notifications sent to Charter Communications (abuse at charter.net), when the IP block complained about really belongs to "WORLDWIDE WEB WORKS, LLC.". according to ARIN. However, a short trace reveals that Charter is the upstream provider for WWWL (through 71.14.172.253).

Should SC admins contact Charter and make sure they are actually wishing to receive SC reports about WWWL (as it doesn't seem like so because they get treated like this)?

These types of bounces come from "spamvertised website" reports and are like this (some editing done to obscure identities):

I have a similiar report in my inbox right now about a different URL.

Tracking link: http://amikolo.com/
[report history]
Resolves to 216.211.158.128
Routing details for 216.211.158.128
[refresh/show] Cached whois for 216.211.158.128 : ipadmin[at]wwwllc.net
Using abuse net on ipadmin[at]wwwllc.net
abuse net wwwllc.net = abuse[at]chartercom.com, noc[at]wwwllc.net, postmaster[at]wwwllc.net, abuse[at]charter.net, abuse[at]wwwllc.net
Using best contacts abuse[at]chartercom.com noc[at]wwwllc.net postmaster[at]wwwllc.net abuse[at]charter.net abuse[at]wwwllc.net
Reports disabled for postmaster[at]wwwllc.net

Using postmaster#wwwllc.net[at]devnull.spamcop.net for statistical tracking.
Reports disabled for abuse[at]wwwllc.net

Using abuse#wwwllc.net[at]devnull.spamcop.net for statistical tracking.

They are getting the messages because abuse.net lists them as a contact:

Look up an address in the abuse.net contact database
postmaster[at]wwwllc.net (for wwwllc.net)
abuse[at]wwwllc.net (for wwwllc.net)
noc[at]wwwllc.net (for wwwllc.net)
abuse[at]charter.net (for wwwllc.net)
abuse[at]chartercom.com (for wwwllc.net)

Postmaster addresses are not generally used. The 2 wwwllc.net addresses are disabled, probably because of bouncing. All that is left are the charter addresses.

Keep in mind, sometimes these generically written replies are not to mean they are not looking into the issue.

[rconner]

IP-whois says that 71.14.172.253 is smack in the middle of Charter's block, no question.

I agree with Mr. Underwood, Charter's reply may not be a denial of responsibility, it may just be confusingly written.

-- rick

[StevenUnderwood]

IP-whois says that 71.14.172.253 is smack in the middle of Charter's block, no question.

I agree with Mr. Underwood, Charter's reply may not be a denial of responsibility, it may just be confusingly written.

-- rick

I just sent a reply to the message I received, asking the questions.