H_Toni Posted February 16, 2008 Share Posted February 16, 2008 Hi, there's a lot of spam coming from jeftexint.com; SC sends reports to devnull as well as register.com. Now I got some replies from register.com: Please note that the following domains and IPs are not with Register.com, reports for these need to be forwarded to another party, other than Register.com What I'm supposed to do? Is there some wrong information in SC's database, directing reports to a wrong address? One of these submissions was (as an example): http://www.spamcop.net/sc?id=z1660680269zb...bad3a7a1750595z (Hope I copied the right url) -- Toni Link to comment Share on other sites More sharing options...
Miss Betsy Posted February 16, 2008 Share Posted February 16, 2008 The reason that spamcop is sending reports to register.com is that their abuse address is listed at abuse.net as an abuse address for jeftexint.com. The upstream for jeftexint.com seems to be abuse[at]green.ch I don't do much of chasing down addresses so I can't advise you on what to do with the information. I would reply to register.com and tell them that their address is listed as an abuse contact for jeftexint.com at abuse.com and they should change it if they don't want reports about jeftexint.com. You can also contact abuse.net and tell them that the upstream for jeftexint.com is abuse[at]green.ch. And you can email the deputies or post in spamcop.routing. The only problem with doing any of that is that abuse.net and the deputies want to know that you know what you are talking about and I am not sure how to tell them. You can also add that contact address to your reports about jeftexint.com until it gets changed. Miss Betsy Link to comment Share on other sites More sharing options...
Julian Mehnle Posted February 17, 2008 Share Posted February 17, 2008 I have been having the exact same problem lately. For the record, this is what I just sent to the register.com contact and to the SpamCop deputies: SpamCop reports about spam from 80.253.80.0/24 erroneously going to abuse[at]register.com? Dear Ms ****, dear SpamCop Deputies, **** <****[at]register.com> wrote: > Please note that the following domains and IPs are not with Register.com, reports for these need to be forwarded to another party, other than Register.com > > [...] > > IP addresses: > 80.253.80.10 > 80.253.80.11 > 80.253.80.13 > 80.253.80.15 > 80.253.80.17 > 80.253.80.20 > 80.253.80.21 > 80.253.80.23 > 80.253.80.24 > 80.253.80.26 > 80.253.80.30 > 80.253.80.34 > 80.253.80.35 > 80.253.80.41 > 80.253.80.43 > 80.253.80.44 > 80.253.80.50 The reason that the SpamCop spam reporting service addresses spam complaints about spam from 80.253.80.0/24, owned by JEFTEX-NET/jeftexint.com, to abuse[at]register.com, is that abuse.net lists that address as an additional contact for "abuse from the domain jeftexint.com". Unfortunately, the semantics of "abuse from the domain XYZ" that is employed by abuse.net are not well defined. In this case, the spam does not originate "from the domain jeftexint.com", but from an IP address owned by an ISP one of whose domains happens to be jeftexint.com, which itself is registered through register.com. I don't think that register.com should be receiving reports about spam originating from JEFTEX-NET IP addresses. The larger issue is that abuse.net needs to fix their wishy-washy semantics of "abuse from the domain XYZ". Until this gets resolved, I recommend that register.com ask that their abuse address be removed from the abuse.net abuse contact listing for jeftexint.com, and that SpamCop stops using the abuse.net database in such an ad-hoc way. Regards, Julian Mehnle, a concerned long-time SpamCop user. Link to comment Share on other sites More sharing options...
H_Toni Posted February 17, 2008 Author Share Posted February 17, 2008 I have been having the exact same problem lately. For the record, this is what I just sent to the register.com contact and to the SpamCop deputies: Hi Julian, that's it! As far as I see: The originating IP is owned or hired by jeftexint; jeftexint's abuse address is not responding; register.com is jeftexint's registrar, and register's abuse address is shown by abuse.net - so why shouldn't they get reports regarding their customer? Maybe SC's deputies should look for a better abuse address in this case; maybe register should penalize their customer jeftexint? Toni Link to comment Share on other sites More sharing options...
H_Toni Posted February 19, 2008 Author Share Posted February 19, 2008 Interesting change in abuse.net: register.com has been removed, green.ch has been added. How long will it take until green get's dev/null'ed? Toni Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.