[SpamCop-List] Re: Overflow in IP
ob1dbNOSPAM at spamcop.net
Sun Feb 15 19:42:33 EST 2004
In article <c0orlt$5gu$1 at news.spamcop.net>, "Mike Easter" <MikeE at ster.invalid>
> Ant wrote:
> > 20021 mod 256 is 53. Is this what the parser should be doing?
> > Using the URL as is, gives a 404 immediately.
> > Using the modified URL gives a gateway timeout.
> > Parse snippet:-
> > Resolving link obfuscation
> > http://email@example.com/remove/
> > chopping username "vdifslfjzmvfb@" from URL:
> > http://20021.164.140.80/remove/ Fixing hex/octal/overflow
> > ip:20021.164.140.80 = 188.8.131.52 host 184.108.40.206 (getting
> > name) no name
> SC doesn't have any trouble finding out about 220.127.116.11 - which
> several deobfuscators agree with on the basis of your calculation.
> The reason it doesn't give a report address is because it has
> 'internalized' the notify:
> Tracking ip 18.104.22.168
> Routing details for 22.214.171.124
> [refresh/show] Cached whois for 126.96.36.199 : dns at debis.de
> Using abuse net on dns at debis.de
> No abuse net record for debis.de
> Using default postmaster contacts postmaster at debis.de
> postmaster at debis.de bounces (44 sent : 25 bounces)
> Using postmaster#debis.de at devnull.spamcop.net for statistical tracking.
> according to what it explains about that:
> Parsing input: 188.8.131.52
> host 184.108.40.206 (getting name) no name
> No valid email addresses found, sorry!
> There are several possible reasons for this:
> The site involved may not want reports from SpamCop.
> SpamCop administrators may have decided to stop sending reports to the
> site to prevent listwashing.
> SpamCop uses internal routeing to contact this site, only knows about
> the internal method and so cannot provide an externally-valid email
> There may be no working email address to receive reports.
and why NOT try report to dns at debis.de ?
More information about the SpamCop-List