tormentor Posted August 21, 2004 Share Posted August 21, 2004 Hi, I've recently moved my little site (posetteforever.com) from 100megswebhostings.com to Godaddy.com and I'm no more able to use any of my email addresses <something>[at]posetteforever.com because they seem blacklisted by spamcop.net. Also I noted that one of my alternative email address at hotmail is blacklisted by Spamcop too... The "funny" thing is that I never spammed anyone, I have only a little forum totally commercial-free and the forum send an email to the users only to advice for a reply to a post. More fun: I'm using spamcop since 1999 to report spam... Some times ago messages with my email address has been sent with a virus in it, probably a virus infected one or more of my users and was sending emails everywhere with the addresses it found in the pc... In any case NO spam has been really sent from me, and I don't understand why my address has been blacklisted, a simple control with the spamcop engine would have shown that the mail didn't belong to me... I've mailed at blproblem[at]admin.spamcop.net but no reply... I checked for my IP address (64.202.166.11 that is from godaddy.com) and it's not blacklisted... I don't know what to do, I'm really new at this problem. This is the message I got when I try to send an email: Account: 'toxxxx[at]posetteforever.com', Server: 'smtp.posetteforever.com', Protocollo: SMTP, Risposta del server: '553 82.52.73.* mail rejected due to excessive spam (Spamcop 82.52.73.250)', Porta: 25, Protezione (SSL): No, Errore del server: 553, Numero di errore: 0x800CCC79 (Sorry for the italian, I hope all is clear). I thought that that "Spamcop" refers to the Spamcop blacklist, but I can be wrong... Could anyone please help me a little ? Link to comment Share on other sites More sharing options...
flagginator Posted August 21, 2004 Share Posted August 21, 2004 I can't help you but I have a suggestion: Immediately edit your post above to MUNG your email address. Otherwise you will be getting a ton of spam on it. Never post your un-munged email address on a public web site like this. Munging means messing it up a bit so the harvesters and scammers can't grab it. :angry: Edit the post now. Change the address to something like this: 'tormentor [at] posetteforever.com' or 'tormentor at posetteforever dot com' or 'tormentor[at]posetteforever.com' Do it now while you await your answer. Link to comment Share on other sites More sharing options...
Wazoo Posted August 21, 2004 Share Posted August 21, 2004 Hi, I've recently moved my little site (posetteforever.com) from 100megswebhostings.com to Godaddy.com and I'm no more able to use any of my email addresses <something>[at]posetteforever.com because they seem blacklisted by spamcop.net. Also I noted that one of my alternative email address at hotmail is blacklisted by Spamcop too... First of all, you need to visit the FAQ and the "Why am I Blocked" item.You are starting off on the wrong foot. In any case NO spam has been really sent from me, and I don't understand why my address has been blacklisted, a simple control with the spamcop engine would have shown that the mail didn't belong to me... Repeat of the above. I've mailed at blproblem[at]admin.spamcop.net but no reply... I checked for my IP address (64.202.166.11 that is from godaddy.com) and it's not blacklisted... I don't know what to do, I'm really new at this problem. As the "my IP address" data and the error message don't match, I'm not sure what you'd expect anyone else to accomplish but looking into the wrong part of the database. Account: 'tormentor[at]posetteforever.com', Server: 'smtp.posetteforever.com', Protocollo: SMTP, Risposta del server: '553 82.52.73.* mail rejected due to excessive spam (Spamcop 82.52.73.250)', Porta: 25, Protezione (SSL): No, Errore del server: 553, Numero di errore: 0x800CCC79 This IP address appears to have (possibly) aged off of the SpamCopDNSbl ... if you head off to http://www.senderbase.org/?searchBy=ipaddr...ng=82.52.73.250 ... you'll see that over the last 30 days, there was a 1032% increase in traffic from this IP address ... but today's details show 0 traffic, -100% reduction ... Either Telecom Italia NET shut this system down, moved it to another IP address to get around the BLs, or worst case, SenderBase picked a strange time to re-start it's "daily count clock" ???? Link to comment Share on other sites More sharing options...
tormentor Posted August 21, 2004 Author Share Posted August 21, 2004 I already read all before posting here 82.52.73.250 is simply the dynamic IP I'm actually using , telecom Italia is my ISP (I think you can view my IP in the IPB control panel). I don't see the relation between having a lot of traffic and spam (I had a lot of traffic, I backed up and restored my whole site). It's impossible to have had 0% traffic today, I'm using the same IP just now... I'm noob at these kind of things and I'm only very, very sorry to be blacklisted, but I can solve easily the problem changing my SMTP to another server... I'll unplug my adsl modem this night and try again tomorrow with (probably) a different IP, but I'm sure nothing will change. Thank you for the suggestion fragginator, wilco P.S. Now I've 82.52.79.221 but the message is the same.... :angry: http://www.senderbase.org/search?searchString=82.52.79.221 Same statistics (+1032% -100%)... Confusing... Link to comment Share on other sites More sharing options...
Wazoo Posted August 22, 2004 Share Posted August 22, 2004 I already read all before posting here But you started with "my e-mail addresses are blocked" ... First, SpamCop blocks nothing .. second, e-mail addresses are not a part of the SpamCopDNSbl 82.52.73.250 is simply the dynamic IP I'm actually using , telecom Italia is my ISP (I think you can view my IP in the IPB control panel). I don't see the relation between having a lot of traffic and spam (I had a lot of traffic, I backed up and restored my whole site). It's impossible to have had 0% traffic today, I'm using the same IP just now... The IP you list is not the same as the one you're posting from. Any and all "traffic" in this discussion deals with e-mail traffic, nothing else. I'm noob at these kind of things and I'm only very, very sorry to be blacklisted, but I can solve easily the problem changing my SMTP to another server... That's part of the situation, though wondering what your options actually are. You have your connection IP, your web-site has its IP, and whatever e-mail server you're using (your ISP or your web-host) has an IP associated with that e-mail server(s) I'll unplug my adsl modem this night and try again tomorrow with (probably) a different IP, but I'm sure nothing will change. Thank you for the suggestion fragginator, wilco P.S. Now I've 82.52.79.221 but the message is the same.... :angry: Changing your connection IP address has little to do with any of this (you've not stated that you are running your own e-mail server from your machine, which would offer up another set of issues) http://www.senderbase.org/search?searchString=82.52.79.221 Same statistics (+1032% -100%)... Confusing... I'll admit that these numbers are a bit confusing to me also, and admitting that I don't have a contact point there to find out at present. Link to comment Share on other sites More sharing options...
tormentor Posted August 22, 2004 Author Share Posted August 22, 2004 Ok, I simplify all... I tried and tried all the things written in the FAQs but actually I still don't know why I'm blacklisted because nor my domain name nor my IP seems to be blacklisted in spamcop or elsewhere, and, above all, I never spammed anyone. (sorry for my bad broken english, I'm not english) Link to comment Share on other sites More sharing options...
Robert Slade Posted August 22, 2004 Share Posted August 22, 2004 I think that the problem may lay with your computer. It may have a virus or worm which is sending out mail without your knowledge. It is also possible that you did have a virus and it had left some ports open which are being used to relay spam. If you are not running a mail server on your computer, then something on 82.52.73.250 and then .221 is sending mail. The message you posted as far as I can tell is that a server at 82.52.73.* rejected a mail from 82.52.73.250 with a 553 code. Some ISPs quote the Spamcop list when they are rejecting mail rather than the correct reason for the reject. It looks like both the IP addresses you quoted, have had an increase in mail being sent, then dropped in the last 24hr. Neither of the above IP addresses are listed by Spamcop, but 221 is listed by dsbl. It looks like the problem is either your computer or your ISP's mail server rejecting mail when it shouldn't. Rob Link to comment Share on other sites More sharing options...
Merlyn Posted August 22, 2004 Share Posted August 22, 2004 Those look like dynamic IP's and you should not use a dynamic IP to send mail as most ISP's and email admins will not accept mail from a dynamic IP. Why don't you use your ISP's mailserver. Link to comment Share on other sites More sharing options...
Robert Slade Posted August 22, 2004 Share Posted August 22, 2004 Merlyn, I don't think he is, smtp.posetteforever.com is hosted by Godaddy and the mx records for the domain also point to Godaddy. However, re reading the posts, it is possible that the OP is using smtp to contact the severs, in which case godaddy maybe picking it his IP address as the source and adding it to the headers. What I don't understand is that it appears to be his ISP that is blocking the mail. Rob Link to comment Share on other sites More sharing options...
Merlyn Posted August 22, 2004 Share Posted August 22, 2004 That is the problem with obtaing incomplete information. Everyone tries to guess what the problem is. If they would post the reject message then it would be much easire to resolve. Maybe he will read this and get a clue. Link to comment Share on other sites More sharing options...
tormentor Posted August 22, 2004 Author Share Posted August 22, 2004 Thank you for your help. Even if I'm finding easier to change my addresses on another domain I own or by a free service I'll post here what I'm doing because I want to know what's happened... The error I wrote appears in the error window of outlook, so it's useless that I post here the message complete with the headers because it simply doesn't go out of my PC, and I'm not hosting anything at home, I'm using Godaddy for hosting my site and my domain is pointing there. My pc at home is only a normal costumer PC, and I've not viruses, I'm behind Norton Antivirus and firewall, paid and updated and I check for worms on a weekly basis. I'm simply using a SMTP from an other domain that I own and for now I'm able to post. Anyway, I lurked a lot in the meanwhile and probably my domain (posetteforever.com) is on a Spamassasin blacklist (and I don't know why :angry: ), I receive a [spam] in the subject header when something is coming form a mail address "[at]posetteforever.com". Here is a complete test message, sent using the SMTP of my ISP (never used it before...LOL), the "XXX" are from me: Received: (qmail 20783 invoked from network); 22 Aug 2004 21:03:23 -0000 Received: from smtp.virgilio.it (HELO vsmtp2alice.tin.it) ([212.216.176.142]) (envelope-sender <davideXXXXX[at]aliceposta.it>) by smtp05-02.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP for <torXXXXX[at]posetteforever.com>; 22 Aug 2004 21:03:23 -0000 Received: from ugo (82.52.72.73) by vsmtp2alice.tin.it (7.0.027) id 410E8881000DDEF1; Sun, 22 Aug 2004 23:03:18 +0200 Message-ID: <007501c4888b$6ebeb480$49483452[at]ugo> From: "Davide XXXXX" <davideXXXXX[at]aliceposta.it> To: <torXXXXX[at]posetteforever.com>, Subject: [spam] test1 Date: Sun, 22 Aug 2004 23:03:10 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-spam: Statistical 67% test1 That "X-spam: Statistical 67%" explains the "[spam]" in the subject, in another post from a different domain it says: X-MailScanner-Information: Please contact the ISP for more information X-MailScanner: Found to be clean I don't know from what belongs that "Statistical 67%" and where can I check for it, if there's a blacklist or something... I'm very curious to see one of "my" Spams because I never sent them, probably someone else, worm, virus or not, are sending them, but I assumed that the system like that of Spamcop or other system like that checked the "real" address before blacklisting. Am I wrong ? Sorry if my questions are stupid, I'm very noob with these things but I'm reading all that I find... P.S. Sorry for the delay in replying but I'm in a different time zone... Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 22, 2004 Share Posted August 22, 2004 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-spam: Statistical 67% You need to determine who is processing your incoming messages and complain to them. This appears to have NOTHING to do with spamcop and as I understand spamassassin, it does not use blocklists. Link to comment Share on other sites More sharing options...
dbiel Posted August 22, 2004 Share Posted August 22, 2004 My pc at home is only a normal costumer PC, and I've not viruses, I'm behind Norton Antivirus and firewall, paid and updated and I check for worms on a weekly basis.This statement is a very dangerous statement, but unfortunately is the type of assumption made by many using the internet. The fact that you are using a firewall and antivirus "functions" is a very good thing, BUT it does NOT provide 100% protection, nothing does that . It is still possible to become infected or hacked into. Just consider some of the most secure sites in the world that have been hacked into from time to time. As to the test message you posted, you originally stated I checked for my IP address (64.202.166.11 But you are apparently not using that address for your outgoing mail The IP addresses listed in your posted headers (I assume that you posted all of them) are 82.52.72.73 which belongs to OrgName: RIPE Network Coordination Centre OrgID: RIPE Address: Singel 258 Address: 1016 AB City: Amsterdam 212.216.176.142 which belongs to Telecom Italia Net Information from SORBS Database of servers sending to spamtrap addresses Address: 212.216.176.142 Record Created: Wed Jun 9 02:04:53 2004 GMT Record Updated: Thu Jul 29 23:58:14 2004 GMT Additional Information: Received: from vsmtp2.tin.it (vsmtp2alice.tin.it [212.216.176.142]) by mailhub2.uq.edu.au (8.12.11/8.12.11) with ESMTP id i6TJNuQG035047 for <>; Fri, 30 Jul 2004 05:23:56 +1000 (EST) Currently active and flagged to be published in DNS If you wish to request a delisting please do so through the Support System. Information received when parcing your message Parsing header: 0: Received: from smtp.virgilio.it (HELO vsmtp2alice.tin.it) ([212.216.176.142]) (envelope-sender <davideXXXXX[at]aliceposta.it>) by smtp05-02.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP for <x>; 22 Aug 2004 21:03:23 -0000 Hostname verified: vsmtp2alice.tin.it 0: Received: from ugo (82.52.72.73) by vsmtp2alice.tin.it (7.0.027) id 410E8881000DDEF1; Sun, 22 Aug 2004 23:03:18 +0200 No unique hostname found for source: 82.52.72.73 Additional information 82.52.72.73 IS LISTED BY: A Info ipwhois.rfc-ignorant.org 127.0.0.6 xbl.selwerd.cx 213.146.187.152 blackholes.five-ten-sg.com 82 53 49 108 interbusiness it misc spam TXT Info ipwhois.rfc-ignorant.org $ has inaccurate or missing WHOIS data at the RIP 212.216.176.142 IS LISTED BY: A Info dnsbl.sorbs.net 127.0.0.6 spamguard.leadmon.net tin it dialup xbl.selwerd.cx 213.146.187.152 blackholes.five-ten-sg.com tin it spam block.blars.org 127.1.0.1 TXT Info dnsbl.sorbs.net spam Received See: http://www.dnsbl.sorbs.net/lookup.shtml?212.216.176.142 Link to comment Share on other sites More sharing options...
Merlyn Posted August 23, 2004 Share Posted August 23, 2004 212.216.176.142 is a dialup range 82.52.72.73 is a dialup range There is not one valid email server between the two. Our servers would surely refuse this email. Something is missing here. Link to comment Share on other sites More sharing options...
dbiel Posted August 23, 2004 Share Posted August 23, 2004 212.216.176.142 is a dialup range 82.52.72.73 is a dialup range There is not one valid email server between the two. Our servers would surely refuse this email. Something is missing here. 15666[/snapback] The parcer did seem to come up with a vaild mailhostParsing header: 0: Received: from smtp.virgilio.it (HELO vsmtp2alice.tin.it) ([212.216.176.142]) (envelope-sender <davideXXXXX[at]aliceposta.it>) by smtp05-02.mesa1.secureserver.net (qmail-ldap-1.03) with SMTP for <x>; 22 Aug 2004 21:03:23 -0000 Hostname verified: vsmtp2alice.tin.it Link to comment Share on other sites More sharing options...
Merlyn Posted August 23, 2004 Share Posted August 23, 2004 Resolved 212.216.176.142 to smtp.virgilio.it and to vsmtp2alice.tin.it. tin.it.dialup.spamguard.leadmon.net says Dial-Up/Cable/DSL IP Range - Use your providers SMTP Gateway. Link to comment Share on other sites More sharing options...
tormentor Posted August 23, 2004 Author Share Posted August 23, 2004 I made a little mess in the first messages, so: I checked for my IP address (64.202.166.11 that is from godaddy.com) This IP is the Ip of the server where is my site on Godaddy , writing the message I considered (wrongly) it "my" IP at that moment The other IPs belongs from my dynamic IP and my ISP The first problem/alert was the message from Godaddy's SMTP server which seemed to involve Spamcop: '553 82.52.73.* mail rejected due to excessive spam (Spamcop 82.52.73.250)' It's the reason why I'm trolling here ... Next I changed my SMTP server and I was able again to send messages and I found a [spam] in the subject line of the message headers and I (presumed to have) found the reason in a "Spamassasin" which has nothing to relate with Spamcop, but I thought to ask something here because here there are experts in such kinds of things. if this is too much OT, I'll go away very fast, no problem. I'll check deeply for worms in my system, but I presume to not be infected, I received myself messages coming from "me" with a virus in it some times ago, so I assumed that some of my users at the forum has a virus in their pc and I sent a mass email to suggest a control on their system. Most probably this kind of messages which seemed to come from me has been inserted here in Spamcom and/or in other similar services and "I" am blacklisted now. But it's very hard to find where I'm blacklisted and to the way to be unblacklisted... Thank you for your help ! Link to comment Share on other sites More sharing options...
Robert Slade Posted August 23, 2004 Share Posted August 23, 2004 There is something very odd here, the code 553 is Domain does not exist. and the ip block 82.52.73.* is allocated to interbusiness.it not Godaddy. I will restate the previous comments from others. You should not be using a smtp server on a dynamic IP. Most ISPs will reject mail that originates that comes direct from a Dynamic IP. You should route your mail through your ISPs SMTP server. Rob Link to comment Share on other sites More sharing options...
tormentor Posted August 23, 2004 Author Share Posted August 23, 2004 My ISP SMTP server accepts only emails from the email address they have given to me (something like XXXXX[at]aliceposta.it), but if I try to use their SMTP with a different address (but with the same username, address, SMTP name for the server) it doesn't work, So I need to use XXXX[at]posetteforever.com for posting to my users or all will become messy (also, I would use my ISP email address rerely and only for personal uses, infact I never used it before) ... Now I'm using the SMTP of godaddy (smtp.starfieldtech.com) and the messages are going, but they arrives with [spam] in the subject line of the headers... Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 23, 2004 Share Posted August 23, 2004 Now I'm using the SMTP of godaddy (smtp.starfieldtech.com) and the messages are going, but they arrives with [spam] in the subject line of the headers... They may arrive in your email box with t [spam] in the subject because of the path they are taking to your inbox but may not be to others inboxes. You need to determine where that is being inserted before you can determine why it is being inserted. It will need to be one of the ISP's involved in the handling of the message from GoDaddy through your ISP. Good luck. Link to comment Share on other sites More sharing options...
Derek T Posted August 23, 2004 Share Posted August 23, 2004 My ISP SMTP server accepts only emails from the email address they have given to me (something like XXXXX[at]aliceposta.it), but if I try to use their SMTP with a different address (but with the same username, address, SMTP name for the server) it doesn't work, 15692[/snapback] Then take this up with your ISP and if they won't change it, change ISP's! Under no circumstances should you be running a mail-server on dynamic IP block. Link to comment Share on other sites More sharing options...
tormentor Posted August 23, 2004 Author Share Posted August 23, 2004 Thank you all for your replies ! I can't change my ISP, it's the only one with DSL here in a rural area... Anyway, I never used their mail server since two days ago when I had these kind of problems, simply I used services like softhome or the ones from the hosting company where I locate my site and my domains. Link to comment Share on other sites More sharing options...
Derek T Posted August 25, 2004 Share Posted August 25, 2004 Thank you all for your replies ! I can't change my ISP, it's the only one with DSL here in a rural area... Anyway, I never used their mail server since two days ago when I had these kind of problems, simply I used services like softhome or the ones from the hosting company where I locate my site and my domains. 15695[/snapback] I, too, live in a rural area and I, too, have only one option for DSL connection: British Telecom who own the 'phone lines. BUT that doesn't mean that I have to use BT as my ISP - I have to pay BT for the connection but who is at the other end of that connection is up to me. Does the same not apply in Italy? If the anwer to that is 'no' and you have to use that ISP, and if you insist on running your own mail server, could you not get the ISP to assign a STATIC IP to you? (I can). Link to comment Share on other sites More sharing options...
tormentor Posted August 25, 2004 Author Share Posted August 25, 2004 Mmmh... I understand what you mean, here in Italy things are a little differents, There is a company like BT, called Telecom Italia (TIN) who had the monopole of telecommunications (phone lines), now there are more companies, but their internet connection's performances are poor in comparison with TIN, There is a good company (Fastweb) with optical cable connections but it works only in metropolitan areas. Here I HAVE to pay a monthly subscription for the telephone line of 25€ (even if I use the prefix of another company to phone, the "last mile" is of TIN) and a monthly subscription of 37€ for a 640/128kB ADSL connection (24h). The only thing I could change is the ISP for ADSL but the other provider, as I said are very poor with their perfomances... And I don't really think that they are using a different method for their mail servers... I can't have a fixed IP (what a dream... I could have a stable site here in my PC)... Thank you for your reply ! Link to comment Share on other sites More sharing options...
Miss Betsy Posted August 25, 2004 Share Posted August 25, 2004 I don't really understand servers and hosts, etc., but I thought that although in some cases one has to use one provider to connect to the internet, one can contract with a good webhost to send one's email. I am not sure about whether you can have a static IP address that way; however, if it is a reliable web service, then it would be better than what you now have. If I am wrong, someone will correct me. Miss Betsy Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.