SPAMCOP HOME · SPAMCOP FAQ · NEWSGROUPS · FORUM FAQ · WEBMAIL · SSL WEBMAIL · SPAMCOPWIKI


 Other words, data, places -->  SpamCop Pages V  FAQs & Words V  Newsgroups V  WebMail V  News-Recent Stuff V   Poll on menu

------>------> Latest and Current Announcements <------<------

Welcome Guest ( Log In | Register )

> This is a User to User Support Forum

The primary mode of support here is peer-to-peer, meaning users helping other users. (please remember this at all times!)
Another try:
This forum is composed of people who have used spamcop and those who are learning about anti-spam efforts.

 
Reply to this topicStart new topic
> Please help! 210.0.235.98 has been listed again!
Goldencard
post Nov 13 2005, 10:32 PM
Post #1


Newbie
*

Group: Members
Posts: 2
Joined: 10-November 05
Member No.: 4790



210.0.235.98 has been listed for three times. We called our ISP to solve the problem, we have been delisted for few days, but today we found we are listed again.

I have read the FAQ already. But we didn't do anything that make ourselves listed. Is it because we are using share IP with others? Or any other reasons?
Anything we can prevent to be listed again? Really annoying~
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
StevenUnderwood
post Nov 13 2005, 10:46 PM
Post #2


What Life?
Group Icon

Group: Membersph
Posts: 5207
Joined: 20-January 04
From: Whitinsville, MA USA
Member No.: 12



QUOTE(Goldencard @ Nov 13 2005, 10:32 PM)
210.0.235.98  has been listed for three times.  We called our ISP to solve the problem,  we have been delisted for few days, but today we found we are listed again.
*

Well, if you share that IP for outgoing email, your ISP has plenty of evidence to track down the source. Below are just the recent reports submitted by spamcop members. It is also possible that someone has an infected machine allowing spammers to use that machine to send their spew.

Report History:
--------------------------------------------------------------------------------
Submitted: Sunday, November 13, 2005 5:24:20 AM -0500:
Please Restore Your Account Access
--------------------------------------------------------------------------------
Submitted: Friday, November 11, 2005 1:47:27 PM -0500:
*** SPAM *** Account Information Needs To Be Updated
--------------------------------------------------------------------------------
Submitted: Thursday, November 10, 2005 9:12:11 PM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Thursday, November 10, 2005 1:07:12 AM -0500:
Account Information Needs To Be Updated
--------------------------------------------------------------------------------
Submitted: Thursday, November 10, 2005 1:07:12 AM -0500:
Account Information Needs To Be Updated
--------------------------------------------------------------------------------
Submitted: Wednesday, November 09, 2005 9:05:37 AM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Wednesday, November 09, 2005 1:14:29 AM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Monday, November 07, 2005 7:10:40 PM -0500:
Verify Your Account Information
--------------------------------------------------------------------------------
Submitted: Friday, November 04, 2005 3:56:02 AM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Thursday, November 03, 2005 1:13:44 PM -0500:
Update Your Account Information
--------------------------------------------------------------------------------


--------------------
Steven P. Underwood, DNRC
Whitinsville, MA
underwood+forum[at]spamcop.net

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Nov 13 2005, 11:28 PM
Post #3


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



If they were sent today, SpamCop Reports about hm3.hosting-mail.com [210.0.235.98] would be sent to (and have been sent to) Hutchison Whampoa Enterprises Limited's abuse[at]hgcbroadband.com - please contact that address and/or company to urge them to be more responsive and proactive in stopping the spam that has been coming from that server. Please also add to the woefully inadequate information at http://www.enom.com/domains/whois.asp?Doma...x=20&submit.y=4. Thanks!


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post Nov 14 2005, 12:30 AM
Post #4


What Life?
Group Icon

Group: Forum Admin
Posts: 13194
Joined: 22-January 04
From: Iowa
Member No.: 18



QUOTE(Goldencard @ Nov 13 2005, 09:32 PM)
210.0.235.98 has been listed for three times. We called our ISP to solve the problem, we have been delisted for few days, but today we found we are listed again.

Define "we" ....
QUOTE
I have read the FAQ already. But we didn't do anything that make ourselves listed. Is it because we are using share IP with others? Or any other reasons?
Anything we can prevent to be listed again? Really annoying~
*


One would think that you would know if you were running your own e-mail server, were paying for a dedicated e-mail server, or were simply using something provided as part of your user account with an ISP .... starting point for figuring that out would usually start with how much you are paying for this ISP's services.

http://www.spamcop.net/w3m?action=checkblock&ip=210.0.235.98
currently shows that user complaints are the primary reason for a SpamCopDNSBL listing.

http://www.senderbase.org/?searchBy=ipaddr...ng=210.0.235.98 shows that SpamCop isn't the only BL this IP is listed in ....
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.5 .. 2171%
Last 30 days .. 3.5 .... 131%
Average ........ 3.1

Noting the same scenario shown in so many other "why am I listed" posts in this Forum, there is an issue with that large increase in traffic ... however, back to "is this a shared server" ..????

http://forum.spamcop.net/forums/index.php?showtopic=4556 would suggest that the current traffic coming from the IP address is somewhere around 85 thousand e-mails a day (as compared to a developed average of maybe 2 thousand e-mails a day ... do these numbers match "your" outgoing e-mail loads? If not, then it would be an easy assumption that you are "sharing" that e-mail server with someone else. But then again, this should have already been discussed with your ISP ...????

If this your server, start checking your logs (e-mail, firewall, server, ...)
If this is your ISP's server, raise the complaint with them.

It's hard to guess at just "what" FAQ (entry) you've read .... It is seen that you apparently didn't read some of them developed "here" or read some of the "How to ..." items, else you'd have included more information in your original query .... For example, you say "we are blocked" ... yet, you don't provide any of the "blocked/error message data" . you then waffle a bit about knowing just exactly who the "we" might be (you or your ISP or something else) ... any of the (SpamCop) FAQs made available would have stated that it is the IP address that finds its way onto a BL, and its the use of that data/BL by the receiving ISP that may turn a BL listing into a Blocking action .... For example, you may send out 1,000 e-mails ... 200 of them hit an ISP that may be using the SpamCopDNSBL ... 160 of those ISPs have configured their systems to reject e-mail coming from an IP address found to be on the BL ..... 80 of those ISPs further chose to simply delete this e-mail, the remainder sending back an error message, of which only 60 make it past your ISP's incoming spam filters. And it's about these 60 messages that you then come in here and complain that "you are blocked" .....

How much of the above actually fits your situation, there's no way anyone on this side of the screen that can guess .... this is why the initial instructions on How to ask a question seem so extensive ... there's a lot of things in between you sending an e-mail and someone here trying to tell you why it was "blocked" .. most of those things are not controlled by anyone at SpamCop.net ....
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Goldencard
post Nov 14 2005, 01:53 AM
Post #5


Newbie
*

Group: Members
Posts: 2
Joined: 10-November 05
Member No.: 4790



Thanks very much for your help. I have already raised the complaint to ISP. Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98 is in blocked list.
Can anybody tell me why? Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000
Received: from unknown (HELO mike) (59.57.162.90)
by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000

Message-ID: <000701c5e8e6$2b9c1aa0$0100a8c0[at]mike>
MIME-Version: 1.0
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To:
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Nov 14 2005, 02:31 AM
Post #6


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



That would be due to dns propagation delays. Please keep trying. Thanks!


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Farelf
post Nov 14 2005, 02:47 AM
Post #7


What Life?
Group Icon

Group: Membersph
Posts: 6335
Joined: 23-February 04
From: Western Australia
Member No.: 491



QUOTE(Goldencard @ Nov 14 2005, 02:53 PM)
... Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.
Can anybody tell me why?  Thank you.
Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000
Received: from unknown (HELO mike) (59.57.162.90)
  by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000...
*
Could be several reasons, including exactly how the receiver is using the SCBL (and propogation delays as Jeff says) - whether it really is the SCBL doing the blocking (the message may be in error as to that detail), noting 210.0.235.98 is currently on the SORBS list and still showing a high level of activity (refer http://www.senderbase.org/?searchBy=ipaddr...35.98&showRBL=1 concerning both). "unknown (HELO mike) (59.57.162.90)" seems strange, its abuse address is abuse[at]fjdcb.fz.fj.cn and .cn is not noted for being at the forefront in the war on spam.

This post has been edited by Farelf: Nov 14 2005, 02:49 AM


--------------------
Plus ça change, plus c’est la même chose
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Nov 14 2005, 03:36 AM
Post #8


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



QUOTE(Farelf @ Nov 14 2005, 02:47 AM)
"unknown (HELO mike) (59.57.162.90)" seems strange, its abuse address is abuse[at]fjdcb.fz.fj.cn and .cn is not noted for being at the forefront in the war on spam.
*
Please note that the entire 59.57.0.0/16 network (64K IP Addresses) for China's Fujian Province appears (along with many other networks) to be afflicted with lack of RDNS - Chinanet's Hostmasters are not "following the INSTRUCTIONS" per Section "INSTRUCTIONS - Adding a host - Add the reverse IN-ADDR entry" of RFC1033 "DOMAIN ADMINISTRATORS OPERATIONS GUIDE", to wit:
CODE
INSTRUCTIONS...
  Adding a host.

     To add a new host to your zone files:

        Edit the appropriate zone file for the domain the host is in.

        Add an entry for each address of the host.

        Optionally add CNAME, HINFO, WKS, and MX records.

        Add the reverse IN-ADDR entry for each host address in the
        appropriate zone files for each network the host i[s] on.


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post Nov 14 2005, 02:54 PM
Post #9


What Life?
Group Icon

Group: Forum Admin
Posts: 13194
Joined: 22-January 04
From: Iowa
Member No.: 18



QUOTE(Goldencard @ Nov 14 2005, 12:53 AM)
Thanks very much for your help. I have already raised the complaint to ISP. Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98 is in blocked list.
Can anybody tell me why? Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000
Received: from unknown (HELO mike) (59.57.162.90)
by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000

Message-ID: <000701c5e8e6$2b9c1aa0$0100a8c0[at]mike>
MIME-Version: 1.0
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To:
*


I'm a bit confused. This Topic was started by asking about a SpamCopDNSBL listing of 210.0.235.98 .... but this last posting deals with an e-mail blocked that points back to 59.57.162.90 (which coincidentally matches another IP address showing for Moderators in this post) ...???? What's the connection between the two IP addresses? The immediate (and probably wrong, but based on the only data provided) assumption is that this e-mail was sent by other than an ISP's e-mail server and the receiving system has a configuration issue with pulling up the wrong error message based on the use of another BL, possibly one using a 'dial-up' list of IP blocks .....
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Nov 14 2005, 03:25 PM
Post #10


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



It appears that the latest quoted data is a bounce from 210.0.235.98 (ns3.hosting-mail.com, which originally received the message from Goldencard's computer "mike" at 59.57.162.90) saying that ns3.hosting-mail.com couldn't deliver to the final destination (one of goldencard.net's mailservers mail.goldencard.net or relay.hosting-mail.com) because ns3.hosting-mail.com's IP Address 210.0.235.98 was still listed by the SCBL. That should no longer be the case, as ns3.hosting-mail.com's IP Address 210.0.235.98 was delisted by the SCBL over 13 hours ago.


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Wazoo
post Nov 14 2005, 03:45 PM
Post #11


What Life?
Group Icon

Group: Forum Admin
Posts: 13194
Joined: 22-January 04
From: Iowa
Member No.: 18



All in how one defines "--- Below this line is a copy of the message." I guess. The "How to ..." stuff states that "we" would like to see the "rejection" notification rather than the e-mail that allegedly triggered a blocking action .... and I did caveat my remarks with "based on data provided" .... I read the "offered" e-mail as being a continuation of the "your e-mail was blocked" information, bot noting the suggested change in perspective to "here's the e-mail that was blocked" ....
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
Jeff G.
post Mar 26 2006, 12:10 PM
Post #12


T-shirt wearing out
Group Icon

Group: Membersph
Posts: 3730
Joined: 2-July 04
From: Northeast New Jersey (New York Metro Area), USA ... Please read my sig. :)
Member No.: 2041



QUOTE(Jeff G. @ Nov 14 2005, 03:36 AM)
Chinanet's Hostmasters are not "following the INSTRUCTIONS" per Section "INSTRUCTIONS - Adding a host - Add the reverse IN-ADDR entry" of RFC1033 "DOMAIN ADMINISTRATORS OPERATIONS GUIDE"
*
They are also not complying with "Every Internet-reachable host should have a name" and "Make sure your PTR and A records match" per Section 2.1 of RFC1912 Common DNS Operational and Configuration Errors.


--------------------
Best Regards, Jeff G. (full signature)
User is offlineProfile CardPM
Go to the top of the page
+Quote Post
dbiel
post Mar 26 2006, 05:42 PM
Post #13


Been There
Group Icon

Group: Membersph
Posts: 2557
Joined: 20-February 04
From: San Gabriel Valley CA USA (Los Angeles)
Member No.: 447



QUOTE(Goldencard @ Nov 13 2005, 10:53 PM)
Thanks very much for your help. I have already raised the complaint to ISP.  Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.
Can anybody tell me why?  Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net
*
There are several possible reasons why this can happen.
1) Not all users of the SpamCop BL are using real time versions. Some use cached versions that may take some time to update, so even it an IP shows as not listed in the real time list, it may still appear in some of the cached lists that have not been updated.
2) Some mail rejectors use standardized replies that are not always accurate. They may state that a message was blocked due to the SpamCopBL when in reality it was blocked for some other reason.
3) The IP address may have been on the SpamCopBL at the time when the message was bounced, but had been removed prior to the sender checking the list.

I realize that this is not much help, but maybe it will explain differences between being on the list vs off the list.


--------------------
This forum is a user support forum. The Moderators and Forum Admin are volunteers (not paid) and have no special direct relationship with SpamCop.net.
If you have been unable to receive the assistance you need here please see How To Contact SpamCop Staff
Thank you for your participation in our peer to peer, user based forums.
User is offlineProfile CardPM
Go to the top of the page
+Quote Post

Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

- Lo-Fi Version Time is now: 23rd April 2014 - 05:07 PM