[Scspamcop] Re: Don't understand reporting address

[Mike Easter]

Patto wrote:
> Mike Easter wrote:
>> Patto wrote:
>>> 221.186.69.122 is NTT/OCN -> abuse at ocn.ad.jp
>>>
>>> Why does SpamCop want to report to report_spam at hotmail.com ?
>> It is a 'dumb' algorithm and it follows the algostrategies.

>> d. [E-Mail]                     kira_domain at hotmail.com

> Thanks, Mike, as always. You think it's worth to post an override over
> in 'routing'? (So far I have reported 5 today, unchecking the Hotmail
> address, and adding the OCN address.)

That answer depends on what your concept of 'worth it' means.

The result of notifying hotmail abuse addresses about this is worthless,
so that should be changed -- if anything, the best address would be
kira_domain because the IP and its tiny little block are not blocklisted
anywhere.  That is, the structure is a /29 (ISN) under a /24 OCN Open
Computer Network under a /13 NTT Comm, that is all .jp providers of 8
IPs under 256 IPs under half a million IPs.

The idea of notifying the parent OCN instead of kira_domain for the
little block is debatable to 'not really good' because of the rep of
ocn.ad.jp.  OCN is a large .jp provider with a lot of blocks much bigger
than this particular one.  They also have a reputation at spamhaus for
unresponsiveness and having large blocks listed and for hosting some
spamgangs.

There are 7 significant listings for ocn at spamhaus, 3 of them are
significant blocks for one spamgang one which are /26 /28 & /29
which/who spamhaus calls 'AWG aka youngjoo aka qline' and describes
him/hisgang as "Mainly spams Japan for DEAI (date == sex) sites."  The
oldest and largest of those listings goes back to 2005.  Not a pretty
picture of responsiveness of OCN to spamhaus listings for spamgangs.

This is about a spamvertised pr0n site's IP.  The question is how should
it be notified by spamcop reporters.  Personally I wouldn't notify about
a spamvertiser, but my guidelines aren't the same as spamcop's.  Spamcop
tries to make its reporters happy while not doing anything stupid.  The
reporter wants to notify.  Reporters also don't like contacts with
hotmail addresses and they aren't too wild about devnulling a notify.

Questions like these are the reasons I wouldn't make a good spamcop
routing 'director' even tho' I understand a lot about how to notify and
what is the spamcop philosophy and how does spamcop behave compared to
how reporters want it to behave.  I am too conflicted about what I
personally believe about notifying and what spamcop reporters expect
about notifying.


-- 
Mike Easter
kibitzer, not SC admin