[SpamCop-List] Re: Spamcop misses actual target of redirect, engine gets confused?

[David Butler]

"Mike Easter" <MikeE at ster.invalid> wrote in news:cg3cqq$uja$1
@news.spamcop.net:

> David Butler wrote:
> www.spamcop.net/sc?id=z611487958zeb6304f4de84ea7bbe207361c691ada7z
> 
>> but the real Phishing site is
>> http://spgew4o0f.com*22795.da.ru?
> 
> If you use a GET on that site it redirects to http://vzx07.kir.jp/citi/
> which is the same as www7u.kagoya.net  210.134.48.118
> 
> whois -h whois.nic.ad.jp 210.134.48.118
> a. [Network Number]             210.134.48.0-210.134.49.0
> b. [Network Name]               KAGOYA
> g. [Organization]               Kagoya Japan Corporation
> m. [Administrative Contact]     SK1294JP
> n. [Technical Contact]          SK1294JP
> c. [Last, First]                Kitagawa, Sadahiro
> d. [E-Mail]                     support at kagoya.net
> whois -h whois.abuse.net kagoya.net
> No abuse address is registered with abuse.net
> 

Ah, the CRAWL command ??

And the folks at kagoya took it down but here it is AGAIN and same 
source!

I will post the Kagoya response..

http://www.google.ci/url?q=http://wfnhhq9ff.com*28939.da.ru/

SamSpade:

 Crawling http://wfnhhq9ff.com*28939.da.ru/
Server: wfnhhq9ff.com*28939.da.ru
Root URL: /
Fetching http://wfnhhq9ff.com*28939.da.ru/ ...
Redirecting to http://diamondcutter.kir.jp/citi/

Redirecting to http://err.kagoya.net/404.php

Parsing input: diamondcutter.kir.jp
host 210.134.48.116 (getting name) no name
No recent reports, no history available
Routing details for 210.134.48.116
[refresh/show] Cached whois for 210.134.48.116 : support at kagoya.net
Using abuse net on support at kagoya.net
No abuse net record for kagoya.net
Using default postmaster contacts postmaster at kagoya.net

(but ALL Kagoya records list support@ and that is who responded, I will 
post to .routing...)

David