Jump to content

strange reply


H_Toni
 Share

Recommended Posts

Hi,

there's a lot of spam coming from jeftexint.com; SC sends reports to devnull as well as register.com.

Now I got some replies from register.com:

Please note that the following domains and IPs are not with Register.com, reports for these need to be forwarded to another party, other than Register.com

What I'm supposed to do?

Is there some wrong information in SC's database, directing reports to a wrong address?

One of these submissions was (as an example): http://www.spamcop.net/sc?id=z1660680269zb...bad3a7a1750595z

(Hope I copied the right url)

--

Toni

Link to comment
Share on other sites

The reason that spamcop is sending reports to register.com is that their abuse address is listed at abuse.net as an abuse address for jeftexint.com.

The upstream for jeftexint.com seems to be abuse[at]green.ch

I don't do much of chasing down addresses so I can't advise you on what to do with the information. I would reply to register.com and tell them that their address is listed as an abuse contact for jeftexint.com at abuse.com and they should change it if they don't want reports about jeftexint.com.

You can also contact abuse.net and tell them that the upstream for jeftexint.com is abuse[at]green.ch. And you can email the deputies or post in spamcop.routing. The only problem with doing any of that is that abuse.net and the deputies want to know that you know what you are talking about and I am not sure how to tell them.

You can also add that contact address to your reports about jeftexint.com until it gets changed.

Miss Betsy

Link to comment
Share on other sites

I have been having the exact same problem lately. For the record, this is what I just sent to the register.com contact and to the SpamCop deputies:

SpamCop reports about spam from 80.253.80.0/24 erroneously going to abuse[at]register.com?

Dear Ms ****, dear SpamCop Deputies,

**** <****[at]register.com> wrote:

> Please note that the following domains and IPs are not with Register.com, reports for these need to be forwarded to another party, other than Register.com

>

> [...]

>

> IP addresses:

> 80.253.80.10

> 80.253.80.11

> 80.253.80.13

> 80.253.80.15

> 80.253.80.17

> 80.253.80.20

> 80.253.80.21

> 80.253.80.23

> 80.253.80.24

> 80.253.80.26

> 80.253.80.30

> 80.253.80.34

> 80.253.80.35

> 80.253.80.41

> 80.253.80.43

> 80.253.80.44

> 80.253.80.50

The reason that the SpamCop spam reporting service addresses spam complaints about spam from 80.253.80.0/24, owned by JEFTEX-NET/jeftexint.com, to abuse[at]register.com, is that abuse.net lists that address as an additional contact for "abuse from the domain jeftexint.com".

Unfortunately, the semantics of "abuse from the domain XYZ" that is employed by abuse.net are not well defined. In this case, the spam does not originate "from the domain jeftexint.com", but from an IP address owned by an ISP one of whose domains happens to be jeftexint.com, which itself is registered through register.com.

I don't think that register.com should be receiving reports about spam originating from JEFTEX-NET IP addresses. The larger issue is that abuse.net needs to fix their wishy-washy semantics of "abuse from the domain XYZ". Until this gets resolved, I recommend that register.com ask that their abuse address be removed from the abuse.net abuse contact listing for jeftexint.com, and that SpamCop stops using the abuse.net database in such an ad-hoc way.

Regards,

Julian Mehnle,

a concerned long-time SpamCop user.

Edited by Julian Mehnle
Link to comment
Share on other sites

I have been having the exact same problem lately. For the record, this is what I just sent to the register.com contact and to the SpamCop deputies:

Hi Julian,

that's it! As far as I see:

The originating IP is owned or hired by jeftexint; jeftexint's abuse address is not responding;

register.com is jeftexint's registrar, and register's abuse address is shown by abuse.net -

so why shouldn't they get reports regarding their customer?

Maybe SC's deputies should look for a better abuse address in this case;

maybe register should penalize their customer jeftexint?

Toni

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...