On Saturday, October 8, 2005, 8:49:47 AM, Kevin McGrail wrote:
The 'article' seems to be a mirror complaint posted by Frank on nttp group spamcopy.routing where uk.geocities.com failes the spamcop test for abuse contact from both abuse.net and arin. Now I don't know Frank from nobody (haha) but I think the uk.geocities issue is a known issue that yahoo is working on.
Regards, KAM
Thanks. Frank has been on the SpamAssassin and SURBL lists for a long time. Everyone knows that Yahoo has not been handling their abuse very well, but they are making good progress on it lately. I can't reveal the details, but I know this for a fact, from several different aspects.
Jeff C. __
What does the article say please?
Subject: O/R: 66.218.64.0 -66.218.95.255:network-abuse@cc.yahoo-inc.com From: Frank Ellermann nobody@xyzzy.claranet.de Date: Thu, 06 Oct 2005 20:04:24 +0200 CC: network-abuse@cc.yahoo-inc.com Newsgroups: spamcop.routing
Hi, for the infamous uk.geocities.com series of spam runs SpamCop tries:
| Using abuse net on network-abuse@cc.yahoo-inc.com | abuse net cc.yahoo-inc.com = postmaster@cc.yahoo-inc.com | Using best contacts postmaster@cc.yahoo-inc.com | postmaster@cc.yahoo-inc.com bounces (7 sent : 7 bounces)
But ARIN apparently says that SC should use:
| "whois 66.218.77.68@whois.arin.net" [...] | Found AbuseEmail in whois network-abuse@cc.yahoo-inc.com | 66.218.64.0 - 66.218.95.255:network-abuse@cc.yahoo-inc.com
I recommend to block all mails containing any URL with FQDN uk.geocities.com in local URIBLs.
http://www.spamcop.net/sc?id=z812431135z90373e8638a8645cf7c1de6de25ebb36z
As always SpamCop needed at least five "reloads" to find the relevant IP for uk.geocities.com spam, and after that effort it should use some working abuse@ address at Yahoo!
Bye, Frank
Jeff C. -- Don't harm innocent bystanders.