[Scspamcop] Re: reporting errors with 66.148.65.146

[Mike Easter]

Scott Grayban wrote:
www.spamcop.net/sc?id=z1268657030zf3011d46e5937abd211051b0233eeab9z
>
> If you look closely you will see that the IP 66.148.65.146 is
> correctly parsed by SC but it fails to send the notification to
> abuse at hopone.net which I seem to be having to lately.

This is about the spamvertised website http://bramabear.com/magic/5/es/

The tracker sez:

Reports regarding this spam have already been sent:

Re: http://bramabear.com/magic/5/es/ (Administrator of network hosting
website referenced in spam)
   Reportid: 2227391267 To: admin at servint.com
   Reportid: 2227391268 To: postmaster at mailgravity.com
Re: z_User_Notification (User defined recipient)
   Reportid: 2227391269 To: abuse at hopone.net

... but the current parse sez:

If reported today, reports would be sent to:

... but that result doesn't notify any spamvertiser.

If you put in the naked url, you see

Parsing input: http://bramabear.com/magic/5/es/
Host bramabear.com (checking ip) = 66.148.65.146
host 66.148.65.146 (getting name) no name
Routing details for 66.148.65.146
[refresh/show] Cached whois for 66.148.65.146 : abuse at hopone.net
Using abuse net on abuse at hopone.net
abuse net hopone.net = abuse at hopone.net
Using best contacts abuse at hopone.net

> It is reporting that 66.148.65.146 is reported to abuse at hopone.net
> from the ARIN output but then in the reporting phase
> admin at servint.com is used as the abuse email and doesn't use
> hopone.net at all. I have to manually add that in.

Right now it is not possible to see that.  The cache sez;

Reports routes for 66.148.65.146:
routeid:26652483 66.148.64.0 - 66.148.127.255 to:abuse at hopone.net
Administrator found from whois records


> Is this a case of DNS poisoning here? I have had a lot of problems
> with hopone.net and them dealing with the spammers. They totally
> ignore you and I am wondering if they are deflecting the abuse
> reporting somehow.
>
>
> Comments from the SC admins?

I'm not an admin, but sometimes if the result is wrong according to the
RIR, then you should refresh the cache and see if the result is
improved.  Currently the cache is correct, ie has the hopone, not
servint.

-- 
Mike Easter
kibitzer, not SC admin