I'm involved with some domains hosted on the server host2.oneononeinternet.com [209.239.41.66], which is currently blocked in the SpamCop BL. Our server has generally kept it nose very clean....look here:

http://www.spamcop.net/w3m?action=checkblo...p=209.239.41.66

In fact, SpamCop is really the only one listing us...look here:

http://www.dnsstuff.com/tools/ip4r.ch?ip=209.239.41.66

I'm a long-time SpamCop user, so I logged in and found only this sparse information about the report history (in the last week):

Submitted: Friday, January 30, 2004 7:52:07 AM -0700:
Re: RE[o] please, confirm dfBgK
651956649 ( 209.239.41.66 ) To: abuse[at]alabanza.com

Submitted: Wednesday, January 28, 2004 6:54:06 AM -0700:
Re: Hello
639234995 ( 209.239.41.66 ) To: abuse[at]alabanza.com

So I sent a query to the Alabanza abuse desk (the host of my host), and filled out a trouble ticket with my host. They quickly responded with this:

"We removed the offending party months ago but have not been dropped from the abuse lists yet. We are working with Alabanza and all associated parties to try and get this resolved but it is not easy to get off these lists. Any suggestions?"

So, they're under the impression that there haven't been any recent reports. That's why I need a deputy to look at those two report ID's and give me more details, please. Due to the blocking, I have to go poking through all my Held Mail on the webmail system and individually move all the stuff that happens to pass through our website server....which is MOST of my mail, because it's sent to an address at that domain.

While we could theoretically be OK in 48 hours, as our BL listing expires, if there's still any spamming/reporting going on, we'll be back on the list, and so I'd like some help.

David T. in AZ

The IP has, in fact, only been on the list for a few hours. I can't see too many details, but it's just those 2 reports. They both appear to be some kind of autoresponder. From the subject, I would guess the second is an autoresponse to a MyDoom email. The first could will be an autoresponse to a spam. abuse[at]alabanza.com should, however, have received these reports and been able to see that.

The IP would fall of the list again in a matter of a few hours because it's just those 2 reports, but I thought I may as well delist it early, seeing as these reports aren't really of spam.

Thanks. The BL process needs a bit more work, IMO. Throwing out the baby with the bathwater comes to mind.

I really wish that there were a way for us "spamcop.net" email users to be able to define some exemptions to the BL other than simple "From" whitelisting, because we don't always know who the "From" will be. For example, most of the AOL users who send me messages use the AOL webmail interface, and that seems to be perennially on the BL, so I have to keep pulling those out of my Held Mail. Unfortunately the BL gets at my mail *before* my filters do, or I'd get those messages. We need more control of what is allowed through to our mailboxes.

I find this interesting. You say you sent a query to Alabanza, but the answer you got sure seems like it came from some other party ... specifically the "we're working with Alabanza" .... Can you take another look at that response and see/say who it "really" came from?



Years back, Alabanza was pretty well black-hat. They turned around quite a bit, but what you've implied in the above does cause interest. If they passed on your query to another party, have they been doing the same with the actual complaints? Or has Alabanza been doing something with the complaints, but for some reason only passed on your question to this unknown third-party?

I wonder if Jerry still works at Alabanza.

Wait...you missed something in my original post....to whit:

"I sent a query to the Alabanza abuse desk (the host of my host), and filled out a trouble ticket with my host."

See....my site is hosted with a hosting company that is hosted by Alabanza, making *both* of them involved. The response I received was to my trouble ticket with my own host, and not from Alabanza. I haven't heard back from them yet.



Well...many years back, when they were actually selling hosting directly, yes, but they've not been doing that for a LOOONNNNGG time, and have been very agressive with any abuse on a pretty consistent basis since then. When Jerry Gilyeat was in charge of their Abuse Dept., things were very good, but he has moved on. I think they're still doing a pretty good job. I've had both dedicated servers and many virtual hosting accounts under their auspices, and I know them very well.

However, the fact that two questionable submissions got our host machine on the BL is NOT A GOOD THING! Let's rachet the algorithm back to a little more sane level, please!