[SpamCop.net - protecting the internet through technology]

[SpamCop-List] Did my ISP cache the DNS lookup?

N. Miller tdy at blackhole.invalid
Wed Feb 2 12:53:09 EST 2005


Last night I submitted a spam for processing. The SpamCop parser could not 
resolve the link in the body:

http://www.spamcop.net/sc?id=z727656642z65e35da3ee1532f978b0ec2c70625142z

Submitting the link to DNSStuff indicated no "A record" for the domain in 
the URL:

http://www.dnsstuff.com/tools/lookup.ch?name=www.mymedcart.com&type=A

At the time I was working on the spam, I tried that domain name in Sam Spade 
for Windows, which uses my ISP's DNS servers. The result then was:

02/01/05 21:41:54 dns www.mymedcart.com
Canonical name: www.mymedcart.com
Addresses:
  218.30.21.33

...and a safe browser actually pulled the raw data for the page from my 
Internet connection. Now SS is showing:

02/02/05 12:42:12 dns www.mymedcart.com
No DNS for this address
(host doesn't exist)

Did I get lucky, and find the host before my ISP's DNS system got caught up 
with a change? Just curious.

P.S. I did send a manual notify, using the Sam Spade template, on the 
assumption that, if I could get there from here, it would be a legitimate 
reason for the notify. SpamCop was only involved to the extent that I ran 
the IP address, only, to compare the notify recipients with the Sam Spade 
results. The SC notify only went to the spam source, not to the hosts. I did 
not make any material changes to the spam item to trick the parser into 
including the web host in the SC notify.

P.P.S. The Sam Spade date convention seems to follow U.S. practice: 
mm/dd/yy.

-- 
Norman
~Win dain a lotica, En vai tu ri, Si lo ta
~Fin dein a loluca, En dragu a sei lain
~Vi fa-ru les shutai am, En riga-lint


More information about the SpamCop-List mailing list