[SpamCop-List] Re: Overflow in IP

[David Butler]

In article <c0orlt$5gu$1 at news.spamcop.net>, "Mike Easter" <MikeE at ster.invalid> 
wrote:

> Ant wrote:
> > 20021 mod 256 is 53. Is this what the parser should be doing?
> > Using the URL as is, gives a 404 immediately.
> > Using the modified URL gives a gateway timeout.
> >
> > Parse snippet:-
> > Resolving link obfuscation
> > http://vdifslfjzmvfb@20021.164.140.80/remove/
> >    chopping username "vdifslfjzmvfb@" from URL:
> >    http://20021.164.140.80/remove/ Fixing hex/octal/overflow
> >    ip:20021.164.140.80 = 53.164.140.78 host 53.164.140.78 (getting
> > name) no name
> 
> SC doesn't have any trouble finding out about 53.164.140.78 - which
> several deobfuscators agree with on the basis of your calculation.
> 
> The reason it doesn't give a report address is because it has
> 'internalized' the notify:
> 
> Tracking ip 53.164.140.78
> Routing details for 53.164.140.78
> [refresh/show] Cached whois for 53.164.140.78 : dns at debis.de
> Using abuse net on dns at debis.de
> No abuse net record for debis.de
> Using default postmaster contacts postmaster at debis.de
> postmaster at debis.de bounces (44 sent : 25 bounces)
> Using postmaster#debis.de at devnull.spamcop.net for statistical tracking.
> 
> according to what it explains about that:
> 
> Parsing input: 53.164.140.78
> host 53.164.140.78 (getting name) no name
> No valid email addresses found, sorry!
> 
> There are several possible reasons for this:
> The site involved may not want reports from SpamCop.
> SpamCop administrators may have decided to stop sending reports to the
> site to prevent listwashing.
> SpamCop uses internal routeing to contact this site, only knows about
> the internal method and so cannot provide an externally-valid email
> address.
> There may be no working email address to receive reports.

and why NOT try report to dns at debis.de ?