[SC-Help] Re: hotmail address not parsed

[Mike Easter]

Fishter wrote:
www.spamcop.net/sc?id=z735057850zc689251947a71e1d447279e364c4250dz>

<419 - payload at hotmail account>

> Is there any reason why the above spam doesn't trigger any emails to
> hotmail.com when that address is mentioned twice in the body?

The SC parser reporter doesn't notify about email address payloads.

If you are a paid reporter you can add the hotmail abuse notify to the
SC report.  If you are a free reporter, you can manually notify hotmail
abuse.  SC will provide you the recommended notify address, sorta.  It
sez you could use abuse at microsoft.com if you weren't submitting via SC.

MS/hotmail are very unpredictable about their responsiveness at the
various abuse addresses, so I always use at least two.

In this case the abuse.net reg'd for the domainname is
abuse at hotmail.com -- whereas the RIR lookup on the IP for the domainname
is abuse at microsoft.com

Interestingly, the trailer on the 419 appears to be radaruol.com.br and
the relay which it came thru' is 200.221.11.147 rDNS zipmail.com.br all
of which live in

inetnum:     200.221.0/18
aut-num:     AS15201
abuse-c:     SEO50 = @uol.com.br
owner:       Universo Online S.A

whois -h whois.abuse.net uol.com.br ...
abuse at uol.com.br   denuncia at uol.com.br  (for uol.com.br)

.. who doesn't want to hear about their subscribers spamming.and they
are spamhaus listed.  They are AS15201 and their upstreams are

Upstream Adjacent AS list
    AS10429   Telefonica Empresas SA = security at telesp.net.br
    AS7738    Telecomunicacoes da Bahia S.A.=
whois -h whois.abuse.net telemar.net.br ...
antispambr at abuse.net   postmaster at telemar.net.br   abuse at telemar.net.br
admin at telemar.net.br mail-abuse at nic.br  (for telemar.net.br)
    AS5511    OPENTRANSIT France Telecom=
whois -h whois.abuse.net opentransit.net ...
noc at opentransit.net  abuse at opentransit.net postmaster at opentransit.net
(for opentransit.net)
    AS8167    TELESC - Telecomunicacoes de Santa Catarina SA =
abuse at NOC.BRASILTELECOM.NET.BR

So, if you are a free reporter, as long as you are going to go to the
trouble of making up a template for the additional notifies, you can
also notify the upstreams for the unresponsive mail provider.



-- 
Mike Easter
kibitzer, not SC admin