Re: I'm a bit at a loss here... (9 Million questions - or less)

Galen wrote:

> a recently started webhosting
> company.

> I found the ISP section for SpamCop, signed up, configured it for
> hourly reports, and set it to the abuse@ email address. So far so
> good.

I'm not clear on what you configured to receive.  You configured to
receive reports about 'something' at some abuse@ address -- but I'm not
sure you will get reports, based on the below.

The way SC determines how to notify for a spam is to derive the
spamsource IP and find its regional internet provider listed contact, ie
arin, ripe, afrinic, lacnic, krnic, jpnic, whatever.  The domainname of
the contact might be used to obtain the abuse.net reg'd contact.

More importantly, for your purposes, for the spamvertiser, SC resolves
the IP of the spamvertised site, uses the RIR to determine a contact.
SC does not make notifies based simply on some domainname.

For example and for purposes of illustration, if SC were going to notify
as if the body of your message contained a spamvertiser, it would derive
this:

Parsing input: http://www.whathostingshould.be
Host www.whathostingshould.be (checking ip) = 69.16.211.62
host 69.16.211.62 (getting name) = creston.dailydns.com.
Routing details for 69.16.211.62
[refresh/show] Cached whois for 69.16.211.62 : [email protected]
Using abuse net on [email protected]
abuse net liquidweb.com = [email protected]
Using best contacts [email protected]

That liquidweb notify is based on the arin lookup for the IP block

whois -h whois.arin.net 69.16.211.62 ...
OrgName:    Liquid Web
NetRange:   69.16.192.0 - 69.16.223.255
OrgAbuseEmail:  [email protected]

> Is there some sort of method of filing a null-valued report so that I
> can process it and see how it's done?

I forge spams all the time and submit them to the parser and then cancel
the report.  That doesn't cause a report to get mailed, but it
demonstrates how SC would notify.  What are you trying to get notified
about?

The spamvertiser notify doesn't carry any penalty, just a notify to the
provider as described.  The spamsource counts toward the SCbl.

> Is anyone dumb enough to actually come in and SPAM this newsgroup?

Sure.  Tracking newsgroup spam is exceedingly difficult and more often
than not impossible.  A spamvertiser can be bulletproof, so if there is
an untraceable news spam which is spamvertising a bulletproof site,
nothing will happen.


-- 
Mike Easter
kibitzer, not SC admin