[Scspamcop] Re: reporting errors with 66.148.65.146

[Scott Grayban]

I just tried to submit a new spam and the same thing has happened again.
Refreshing the cache is not working.

SC admin need to look into this. I'll provide the original spam email if they
need it.

Something is very wrong here.

Mike Easter wrote:
> Scott Grayban wrote:
> www.spamcop.net/sc?id=z1268657030zf3011d46e5937abd211051b0233eeab9z
>> If you look closely you will see that the IP 66.148.65.146 is
>> correctly parsed by SC but it fails to send the notification to
>> abuse at hopone.net which I seem to be having to lately.
> 
> This is about the spamvertised website http://bramabear.com/magic/5/es/
> 
> The tracker sez:
> 
> Reports regarding this spam have already been sent:
> 
> Re: http://bramabear.com/magic/5/es/ (Administrator of network hosting
> website referenced in spam)
>    Reportid: 2227391267 To: admin at servint.com
>    Reportid: 2227391268 To: postmaster at mailgravity.com
> Re: z_User_Notification (User defined recipient)
>    Reportid: 2227391269 To: abuse at hopone.net
> 
> .... but the current parse sez:
> 
> If reported today, reports would be sent to:
> 
> .... but that result doesn't notify any spamvertiser.
> 
> If you put in the naked url, you see
> 
> Parsing input: http://bramabear.com/magic/5/es/
> Host bramabear.com (checking ip) = 66.148.65.146
> host 66.148.65.146 (getting name) no name
> Routing details for 66.148.65.146
> [refresh/show] Cached whois for 66.148.65.146 : abuse at hopone.net
> Using abuse net on abuse at hopone.net
> abuse net hopone.net = abuse at hopone.net
> Using best contacts abuse at hopone.net
> 
>> It is reporting that 66.148.65.146 is reported to abuse at hopone.net
>> from the ARIN output but then in the reporting phase
>> admin at servint.com is used as the abuse email and doesn't use
>> hopone.net at all. I have to manually add that in.
> 
> Right now it is not possible to see that.  The cache sez;
> 
> Reports routes for 66.148.65.146:
> routeid:26652483 66.148.64.0 - 66.148.127.255 to:abuse at hopone.net
> Administrator found from whois records
> 
> 
>> Is this a case of DNS poisoning here? I have had a lot of problems
>> with hopone.net and them dealing with the spammers. They totally
>> ignore you and I am wondering if they are deflecting the abuse
>> reporting somehow.
>>
>>
>> Comments from the SC admins?
> 
> I'm not an admin, but sometimes if the result is wrong according to the
> RIR, then you should refresh the cache and see if the result is
> improved.  Currently the cache is correct, ie has the hopone, not
> servint.
>