[Scrouting] Re: spambr@admin.spamcop.net bouncing?

[Mike Easter]

Tim McGraw wrote:
> Tim McGraw wrote:
>> Just so I have this straight.
>>
>> Whoever was to receive reports (telemar.net.br?) specifically requested
>> an admin.spamcop.net address.
>>
>> Straight out of the gate, they're bouncing?
>
> I've got it now: whoever requested reports go to antispambr at abuse.net,
> their redirect to admin.spamcop.net is disabled. abuse at oi.net.br is the
> party that is bouncing reports.

I'm reading this by line:

> [refresh/show] Cached whois for 189.24.88.202 : abuse at oi.net.br

lacnic shows the abuse contact for the IP block to be the abuse addy
above, which SC finds in a very roundabout way, not grokking the simple or
straightforward...

abuse-c:     CGR13 = abuse at oi.net.br

> Using abuse net on abuse at oi.net.br
> abuse net oi.net.br = antispambr at abuse.net, abuse at oi.net.br,
postmaster at oi.net.br, abuse at telemar.net.br, cert at cert.br,
mail-abuse at cert.br

... then SC uses abuse.net's 6 reg'd addresses for oi.net.br as the best
contacts

> Using best contacts antispambr at abuse.net abuse at oi.net.br
postmaster at oi.net.br abuse at telemar.net.br cert at cert.br mail-abuse at cert.br
> antispambr at abuse.net redirects to spambr at admin.spamcop.net

I would guess that abuse.net asks spamcop to handle the antispambr
internally, not send it to/via them.

> Reports disabled for spambr at admin.spamcop.net

... and spamcop's internal handling is to not, but disable.

> abuse at oi.net.br bounces (6 sent : 6 bounces)

The upshot of all of that is that lacnic/abusenet provides 6 addresses of
which 1 gets redirected which is then disabled and 1 bounces so it gets
devnulled, leaving 4, one to the domainname of the lacnic listed abuse
address in the form of pm, one to the telemar abuse, and 2 to cert.br
addresses.

The IP itself is classified by spamhaus as being in the PBL - ie those in
dynamic space.  Its rDNS is 18924088202.user.veloxzone.com.br


--
Mike Easter
kibitzer, not SC admin