Cornholio Posted September 7, 2007 Posted September 7, 2007 I'm having a problem with a spam I forwarded. Spamcop says that the email sender's ISP has reported that the spam will cease (which is all good) but it also won't let me report the spammed site (which is a different ISP). Here's the link: http://www.spamcop.net/sc?id=z1422147826z5...3d90d84c397966z I understand not sending reports to the email sender's ISP, but why won't it let me report the spammed site (notewarm.com)?
turetzsr Posted September 7, 2007 Posted September 7, 2007 ...FWIW, it seems to work fine for me: <snip> If reported today, reports would be sent to: Re: 85.201.79.181 (Administrator of IP block - statistics only) abuse[at]tvcablenet.be abuse[at]pandora.be postmaster[at]tvcablenet.be Re: http://notewarm.com/ (Administrator of network hosting website referenced in spam) abuse[at]ocn.ad.jp
Cornholio Posted September 7, 2007 Author Posted September 7, 2007 ...FWIW, it seems to work fine for me: Notice the "if reported today" part... it only says that for spams you can't report (including previously reported spams, but that is not the case here). I get the exact same thing and no "report now" button.
Wazoo Posted September 7, 2007 Posted September 7, 2007 DNS games in progress first parse request for notewarm.com also showed the ocn.ad.jp address a second request returned; Parsing input: notewarm.com Cannot resolve notewarm.com No valid email addresses found, sorry! There are several possible reasons for this: The site involved may not want reports from SpamCop. SpamCop administrators may have decided to stop sending reports to the site to prevent listwashing. SpamCop uses internal routeing to contact this site, only knows about the internal method and so cannot provide an externally-valid email address. There may be no working email address to receive reports. A third request returned; Parsing input: notewarm.com Routing details for 123.202.228.243 [refresh/show] Cached whois for 123.202.228.243 : fionat[at]ctihk.com hostmaster[at]ctihk.com Using abuse net on hostmaster[at]ctihk.com abuse net ctihk.com = postmaster[at]ctihk.com, fionat[at]ctihk.com, abuse[at]hkbn.net, abuse[at]ctimail.com Using best contacts postmaster[at]ctihk.com fionat[at]ctihk.com abuse[at]hkbn.net abuse[at]ctimail.com Statistics: 123.202.228.243 not listed in bl.spamcop.net More Information.. 123.202.228.243 not listed in dnsbl.njabl.org 123.202.228.243 not listed in dnsbl.njabl.org 123.202.228.243 not listed in cbl.abuseat.org 123.202.228.243 not listed in dnsbl.sorbs.net Reporting addresses: postmaster[at]ctihk.com fionat[at]ctihk.com abuse[at]hkbn.net abuse[at]ctimail.com Then actually hitting the Tracking URL link provided; Tracking link: http://notewarm.com/ [report history] Resolves to 201.83.24.231 Routing details for 201.83.24.231 [refresh/show] Cached whois for 201.83.24.231 : virtua[at]virtua.com.br Using last resort contacts virtua[at]virtua.com.br Finding IP block owner: Routing details for 85.201.79.181 [refresh/show] Cached whois for 85.201.79.181 : abuse[at]tvcablenet.be Using abuse net on abuse[at]tvcablenet.be abuse net tvcablenet.be = postmaster[at]tvcablenet.be, abuse[at]pandora.be, abuse[at]tvcablenet.be Using best contacts postmaster[at]tvcablenet.be abuse[at]pandora.be abuse[at]tvcablenet.be Hint: see all the previous discussion material about things like 'rotating DNS' .. bot-nets .. etc. 09/07/07 17:23:29 dns notewarm.com Canonical name: notewarm.com Addresses: 123.202.228.243 123.224.172.86 201.83.24.231 221.125.110.250 58.89.244.158 61.244.106.118 75.47.248.190 75.60.220.164 76.243.198.63 80.66.253.137 81.95.182.51 84.101.32.176 84.159.223.213 85.176.239.143 85.228.126.145 no doubt. checking in a few will show a whole bunch of different IP addresses involved .... The parser deals with whatever the Domain resolved to at the moment of the look-up
Cornholio Posted September 8, 2007 Author Posted September 8, 2007 DNS games in progress no doubt. checking in a few will show a whole bunch of different IP addresses involved .... ... The parser deals with whatever the Domain resolved to at the moment of the look-up Yes, I'm familiar with rotating DNS, etc. However in this case, that is not the problem. Spamcop is finding IP addresses for the site and reporting addresses, it just will not let me send the report! Maybe the issue is that since the email sender's admin has indicated that the spam will cease, Spamcop assumes that this applies to the spammed site as well (even though the two are unrelated)?
Farelf Posted September 8, 2007 Posted September 8, 2007 Maybe the issue is that since the email sender's admin has indicated that the spam will cease, Spamcop assumes that this applies to the spammed site as well (even though the two are unrelated)?No, the two are unrelated - all that happened with the spamvertized site was that, after you reported, the parser resolved a reporting address. That doesn't mean you can retrospectively use SC to send a report to the now-resolved address (where would that all end? The reporting addresses keep changing in many instances). You can, of course, send a manual report but in so doing lose the shield of SpamCop. Gathering evidence and requesting the domain registrar to take action might be a more productive tactic (but that is getting away from the SC function).
Cornholio Posted September 8, 2007 Author Posted September 8, 2007 No, the two are unrelated - all that happened with the spamvertized site was that, after you reported, the parser resolved a reporting address. No... I never reported. There was never the option to do so. A reporting address was resolved the very first time, but it wouldn't let me report.
Farelf Posted September 8, 2007 Posted September 8, 2007 No... I never reported. There was never the option to do so. A reporting address was resolved the very first time, but it wouldn't let me report.Aha, I get it ("At last," thinks the long-suffering Cornholio) a bug of sorts then, definitely. Since SC's "mission" is the mail originator's IP address I guess there's not a lot of priority given to the secondary "targets". Even so, it is annoying, has an "unfinished" feeling about it. I will email the Deputies but I fear other matters would take precedence.
Cornholio Posted September 9, 2007 Author Posted September 9, 2007 Aha, I get it ("At last," thinks the long-suffering Cornholio) a bug of sorts then, definitely. Since SC's "mission" is the mail originator's IP address I guess there's not a lot of priority given to the secondary "targets". Even so, it is annoying, has an "unfinished" feeling about it. I will email the Deputies but I fear other matters would take precedence. Heheh. Thanks. Let me know what they say.
Recommended Posts
Archived
This topic is now archived and is closed to further replies.