Re: Spmacop report not read

Robert Blair wrote:
>www.spamcop.net/sc?id=z940334745za669ca835deef8cfe1c547f5e7b614
> fcz

That is about the spamsource 74.136.215.199  no rDNS of  INSIGHT COMM

The arin contact is the walker.rj and there is no abuse.net reg'd addy.
The IP is a proxytrojan hitting spamtraps and CBL listed.

> Since Walker.rj is not interested in spamcop reports does anyone have
> a better reporting address?  The reported IP is an open proxy.

It doesn't matter whether walker.rj is notified or not, the IP report is
still counted toward the SCbl.  And the message you see doesn't
*necessarily* mean the username is not interested in SC reports -- there
are other mechanisms for expressing that more clearly.  What you are
seeing looks like an autoresponder -- it could even be the equivalent of
an 'out of office' autoack.

Arin lists 'other' contacts, not necessarily better

RNOCEmail:  [email protected]
RTechEmail:  <index>
OrgNOCEmail:  [email protected]
OrgTechEmail:  <same as 1>

whois -h whois.abuse.net insightcom.com ...
[email protected] (default, no info)

> Your message
>
>   To:      [email protected]
>   Cc:
>   Subject: [SpamCop (74.136.215.199) id:1746139602]Insider information
> that
> brings about tremendous p..
>   Sent:    Wed, 10 May 2006 18:51:42 -0400
>
> was not read

I don't know the 'meaning' of what looks like an autoresponder saying
not read.  You can't tell a good address from a bad address by trying a
rcpt to at that server, as it answers the target address the same way it
answers rcpt to a bogus addy.  It could be a temporary mailbox
condition.

Since there isn't a better notify than the arin contact, I wouldn't
bother with notifying an upstream or parent about an open proxy.  If you
are feeling very energetic, I suppose you could notify the other 3 arins
+ the default pm and the default abuse.

-- 
Mike Easter
kibitzer, not SC admin