[SpamCop-List] Re: Gmail seems to be regularly in bl.spamcop.net

[Mike Easter]

No Spam wrote:
> Mike Easter wrote:

>>   from 216.139.164.163 by by13fd.bay13.hotmail.msn.com *sourceline
>>
>> SC calls the panamsat in .za the source, not hotmail.
>
>
> ???
> Sender relay: 216.139.164.163

I misspoke a little bit, but not very much.  I should have said

SC calls the 216.139.164.163 no rDNS in .za the source, not hotmail.

Here's the structure:

whois -h whois.arin.net 216.139.164.163 ...
Pan Am Sat   216.139.160.0 - 216.139.191.255
   TechEmail:  bsg at panamsat.com
Qkon QKON30   216.139.164.160 - 216.139.164.175
  TechEmail:  wbotha at qkon.com

panamsat's arin geographical addy is in GA, US

OrgName:    Pan Am Sat
OrgID:      PNAM
Address:    2857 Fork Creek Church Road
City:       Ellenwood
StateProv:  GA

whereas qkon's arin geographic addy is in Pretoria, ZA

OrgName:    Qkon
OrgID:      QKON
Address:    No 8 Pieter Street Highveld Technopark
City:       Pretoria
Country:    ZA

When I have a parent/child relationship like qkon/panamsat, I prefer to
notify the child about spamsource, unless something about the
responsiveness or the accessibility of abuse addresses causes me to
notify both the parent and the child.

In this case, the /24 is listed in spamhaus, so that is a good reason to
notify the parent, or even the parent's upstream, since panamsat has 14
different listings in spamhaus, ranging from single IPs to a /23 as well
as /24s.

> IP is not ZA?

Yes, the IP is Qkon which is in .za.    If you like domainname
registrations, not only is the arin geography in .za, but so is the
netsol registration.

> sentechsa.net is ZA = the recipient mailbox = mine
> (some of the good guys here too - 419legal etc, bad guys way north in
> .NG :-)

I didn't even look at sentechsa.

>> However, if you notify hotmail and microsoft and msn about that
>> item, it is extremely likely that they will terminate the account
>> which sent that, namely winner2005-08 at hotmail.com
>>
>
> Mail has gone out to abuse at hotmail .com re winner2005-08 at hotmail.com
> , will see ...

I'm not sure that hotmail is the right one.  Maybe.

> As regards gmail: I have noticed same. Now unless 1 + 1 != 2 ..
> The subject thread started off as "Gmail seems to be regularly in
> bl.spamcop.net" ???? What's hatched in the nest ??

Gmail is regularly in SC whereas hotmail is less likely because of the
gmail header stamp decisions by gmail.


-- 
Mike Easter
kibitzer, not SC admin