[SpamCop-List] Re: What's the deal with geocities parsing - no go ?

[Mike Easter]

Asterix wrote:
> Mike Easter

>> details for 66.218.77.68 <snip>
>> Reporting addresses:
>> network-abuse at cc.yahoo-inc.com
>
> Yes - I've been that, done there.

>>    To: network-abuse at cc.yahoo-inc.com (Notes)

> The point is that the links - and lots of similar links - are still
> alive and well, and all redirect to the real SPUR-M site at
> http://210.76.97.112/sm/ (in China of course).

210.76.97.112  rDNS mail.c-b-w.com.cn  is spamhaused as the /32.  It is
also listed in openrbl as an open smtp relay.

http://www.ordb.org/lookup/?host=210.76.97.112

Input IP 210.76.97.179 output .112

> Q: I received spam promoting a Yahoo! GeoCities site. What can I do?
> A: To help us prevent spam on Yahoo!, please forward the entire body
> and subject of the email to our Abuse team at abuse at yahoo-inc.com.
>
> And "be sure to include the headers" yadda yadda. Note the address!
> Seems to me that SC has the wrong reporting address for geocities
> sites.

SC's notify derives from the arin reg'd abuse contact:

whois -h whois.arin.net 66.218.77.68 ...
NetRange:   66.218.64.0 - 66.218.95.255
OrgName:    Yahoo!
OrgAbuseEmail:  network-abuse at cc.yahoo-inc.com

> What color is their hat ?

Go by your own experiences.

-- 
Mike Easter
kibitzer, not SC admin