Help - Search - Members - Calendar
Full Version: Bouncing but ip not in block list?
SpamCop Discussion > Discussions & Observations > SpamCop Blocklist Help
boardtc
Emailing on one friend the last few weeks it always bounces, their sys admin says I need to the IP address removed from SpamCops database

I checked abd the domain (moonbade.com / 84.92.1.4) is noton your list?

Does anyone know what's stopping it?

Here's the bounce info :

Return-path: <tom.corcoran[at]moonbade.com>
Received: from [212.159.6.53] (helo=ptn-atmail02.plus.net)
by ptb-cgirelay01.plus.net with esmtp (Exim 4.34)
id 1FA7Rb-0008Hq-PO
for David.McGuinness[at]FINEOS.com; Fri, 17 Feb 2006 15:22:52 +0000
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: binary
Mime-Version: 1.0
From: Tom.corcoran <tom.corcoran[at]moonbade.com>
To: 'David McGuinness ' <David.McGuinness[at]FINEOS.com> (ext. 950)
Subject: Re: buster at the NFT
Reply-To: tom.corcoran[at]moonbade.com
X-Mailer: AtMail 4.01
X-Origin: 80.177.219.46
X-Uidl: D0A7D6543169D3119B3E00902789397E0A36A989[at]oasis006mscie
Date: Fri, 17 Feb 2006 15:22:35 +0000
Telarin
Hmm, are you sure 84.92.1.4 is the IP address of your SMTP server? I just did a quick lookup on registered MXs for moonbade.com, and they are all in the 212.159 or 195.166 subnets, and I don't see any RDNS entries for 84.92.1.4.

The full text of your rejection message rather than just the headers so we can see what YOUR servers IP address is will be needed for any futher troubleshooting.
Merlyn
Just a guess but it was probably due to spam/419's, advanced pay scams being sent through 212.159.6.53. It is not currently listed so it probably dropped off.

Submitted: Tuesday, February 14, 2006 4:48:12 PM -0500:
Hello
1658231618 ( 212.159.6.53 ) To: spamcop[at]imaphost.com
1658231597 ( 212.159.6.53 ) To: abuse[at]plus.net
Farelf
Nice work Merlyn!
QUOTE(Telarin @ Feb 18 2006, 12:14 AM)
Hmm, are you sure 84.92.1.4 is the IP address of your SMTP server?
*
Yes, confusing - all part of the same PlusNet network. Tom is the registrant of the moonblade.com domain. Tom, your friend's network should be passing your mail or justifying why not (being Irish isn't an excuse), you're not currently on SCBL.
StevenUnderwood
QUOTE(Farelf @ Feb 17 2006, 11:56 AM)
justifying why not (being Irish isn't an excuse
*
My server, my rules wink.gif
Jeff G.
The last mailserver in the chain, ptb-cgirelay01.plus.net [195.166.130.40] (the one that sent you the bounce message because it couldn't deliver your message to one of the mailservers for FINEOS.com) IS listed by the SCBL - please see http://www.spamcop.net/bl.shtml?195.166.130.40 and http://www.spamcop.net/w3m?action=blcheck&ip=195.166.130.40 for details (some reproduced below for posterity).
QUOTE
195.166.130.40 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 4 hours.

Causes of listing
  • System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
  • SpamCop users have reported system as a source of spam less than 10 times in the past week
Additional potential problems
(these factors do not directly result in spamcop listing)
  • System administrator has already delisted this system once
Because of the above problems, express-delisting is not available

Listing History
In the past 86.1 days, it has been listed 12 times for a total of 18.7 days

Other hosts in this "neighborhood" with spam reports
195.166.130.41
Although ptb-cgirelay01.plus.net [195.166.130.40] does not have Report History, its close neighbor ptb-cgirelay02.plus.net [195.166.130.41] does, as follows:
QUOTE
Submitted: Thursday 2006/02/16 09:39:43 -0500:
CONTACT PROCESSING AGENT
1660421886 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2006/02/16 09:39:42 -0500:
CONTACT PROCESSING AGENT
1660421897 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2006/02/14 12:36:39 -0500:
Hello
1658049626 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/12/06 09:57:35 -0500:
I AWAIT YOUR URGENT RESPONSE.
1577177191 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/12/03 03:32:57 -0500:
HELLO
1573585385 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1573585384 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/12/03 03:32:56 -0500:
HELLO
1573585348 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1573585342 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/12/01 07:13:59 -0500:
hello..
1571605927 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/12/01 06:38:11 -0500:
HELLO
1571587557 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1571587548 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/30 07:12:34 -0500:
URGENT RESPOND
1570528513 ( http:// www.middle-east-online.com/english/?id=1... ) To: abuse[at]gxn.net
1570528507 ( 212.159.6.132 ) To: spamcop[at]imaphost.com
1570528487 ( 212.159.6.132 ) To: abuse[at]plus.net
1570528480 ( 195.166.130.41 ) To: relays[at]admin.spamcop.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/11/29 09:06:30 -0500:
URGENT RESPONSE
1569531664 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Monday 2005/11/28 20:47:06 -0500:
URGENT RESPONSE
1569001682 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1569001676 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Monday 2005/11/28 14:16:22 -0500:
AWARD NOTIFICATION
1568724495 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1568724472 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Monday 2005/11/28 12:28:29 -0500:
AWARD NOTIFICATION
1568642279 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/11/26 01:40:30 -0500:
REPLY ME
1566040777 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/11/26 01:36:19 -0500:
Employment Offer
1566037955 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1566037954 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/11/26 01:29:28 -0500:
HELLO
1566034408 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1566034406 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 09:06:40 -0500:
HELLO
1566504428 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1566504417 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 05:52:46 -0500:
From Kim Liang
1565220533 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 02:46:41 -0500:
HELLO
1565191649 ( http:// www.metrocat.com ) To: chatree[at]isp-thailand.com
1565191648 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1565191647 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 02:24:06 -0500:
BE OUR BUSSINESS REPRESENTATVIVE
1565080770 ( Forwarded Spam ) To: [concealed user-defined recipient]
1565080769 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1565080768 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 01:06:26 -0500:
From Kim Liang
1565039692 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/11/24 22:38:50 -0500:
BE OUR BUSSINESS REPRESENTATVIVE
1564962068 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/11/24 18:03:37 -0500:
BUSINESS PROPOSAL(REPRESENTATIVE)
1564839889 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1564839888 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/11/24 07:22:54 -0500:
[Norton AntiSpam] Solenoids
1564823080 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1564823079 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 14:01:35 -0500:
Hello.
1563747534 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1563747529 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 08:37:11 -0500:
WINNING NOTIFICATION
1563504198 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 03:26:59 -0500:
Hello...
1563289370 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 01:34:21 -0500:
Hello...
1563227623 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/11/22 19:47:39 -0500:
HELLO
1563141226 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/11/22 17:48:47 -0500:
Hello.
1562974951 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1562974949 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Sunday 2005/11/20 19:34:09 -0500:
Solenoids
1561254834 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Sunday 2005/11/20 18:24:17 -0500:
**SPAM** Solenoids
1561223435 ( 195.166.130.41 ) To: spamcop[at]imaphost.com
1561223433 ( 195.166.130.41 ) To: abuse[at]plus.net
boardtc
Thanks everyone. I was hopeful with the last post but it bounced again today :-(

His network people have said it's my problem not there's. But i've not had this happen before. Do only some people use spamcop is that it?

Here are the headers from today.

Thanks for helping.

Cheers, Tom.

Subject:
Mail delivery failure: returning message to sender
From:
Mail Delivery System <Mailer-Daemon[at]ptb-cgirelay01.plus.net>
Date:
Mon, 20 Feb 2006 17:17:06 +0000
To:
tom.corcoran[at]moonbade.com
X-Account-Key:
account3
X-UIDL:
UID11525-1080073234
X-Mozilla-Status:
0001
X-Mozilla-Status2:
00000000
Envelope-to:
tom.corcoran[at]moonbade.com
Delivery-date:
Mon, 20 Feb 2006 17:17:09 +0000
Received:
from localhost ([127.0.0.1]) by ptb-mxcore01.plus.net with esmtp (PlusNet MXCore v2.00) id 1FBEeq-0006sZ-PZ for tom.corcoran[at]moonbade.com; Mon, 20 Feb 2006 17:17:08 +0000
Received:
from ptb-cgirelay01.plus.net ([195.166.130.40])by ptb-mxcore01.plus.net with esmtp (PlusNet MXCore v2.00) id 1FBEeo-0006s7-L1 for tom.corcoran[at]moonbade.com; Mon, 20 Feb 2006 17:17:06 +0000
Received:
from Debian-exim by ptb-cgirelay01.plus.net with local (Exim 4.34)id 1FBEeo-0003ix-85for tom.corcoran[at]moonbade.com; Mon, 20 Feb 2006 17:17:06 +0000
X-Failed-Recipients:
David.McGuinness[at]FINEOS.com
Auto-Submitted:
auto-generated
Message-ID:
<E1FBEeo-0003ix-85[at]ptb-cgirelay01.plus.net>
x-open-relay:
195.166.130.40 is in a black list at bl.spamcop.net
X-PN-VirusFiltered:
by PlusNet MXCore (v2.00)
X-Antivirus:
AVG for E-mail 7.1.375 [267.15.11/264]
MIME-Version:
1.0
Content-Type:
text/plain

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

David.McGuinness[at]FINEOS.com
SMTP error from remote mailer after MAIL FROM:<tom.corcoran[at]moonbade.com>:
host mail.fineos.com [217.173.101.209]: 553 5.3.0 Spam blocked see:
http://spamcop.net/bl.shtml?195.166.130.40

------ This is a copy of the message, including all the headers. ------

Return-path: <tom.corcoran[at]moonbade.com>
Received: from [212.159.6.58] (helo=ptn-atmail03.plus.net)
by ptb-cgirelay01.plus.net with esmtp (Exim 4.34)
id 1FBEei-0003ig-I3
for David.McGuinness[at]FINEOS.com; Mon, 20 Feb 2006 17:17:00 +0000
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: binary
Mime-Version: 1.0
From: Tom.corcoran <tom.corcoran[at]moonbade.com>
To: 'David McGuinness ' <David.McGuinness[at]FINEOS.com> (ext. 950)
Subject: Re: snowdon
Reply-To: tom.corcoran[at]moonbade.com
X-Mailer: AtMail 4.01
X-Origin: 80.177.219.46
X-Uidl: D0A7D6543169D3119B3E00902789397E0A36A9AF[at]oasis006mscie
Date: Mon, 20 Feb 2006 17:26:14 +0000
agsteele
QUOTE(boardtc @ Feb 20 2006, 11:33 PM)
553 5.3.0 Spam blocked see:
    http://spamcop.net/bl.shtml?195.166.130.40
*


Hi boardtc!

Did you follow the link provided in the error message you received? This points to 195.166.130.40

This IP address is currently listed in the SpamCop BL

Causes of listing

* System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
* SpamCop users have reported system as a source of spam less than 10 times in the past week

Additional potential problems
(these factors do not directly result in spamcop listing)

* System administrator has already delisted this system once

Because the admin for this IP has already used the quick delist function but the problem has not been resolved, this option is no longer available to you or the admin for your mail server.

The messages going to spam traps can only be viewed by SpamCop deputies. The messages that have been reported include subjects such as:

Submitted: Sat, 18 Feb 2006 21:03:25 GMT:
We are interested in employing your services

Submitted: Tue, 14 Feb 2006 20:26:09 GMT:
Dear Sir/Madam,

Submitted: Mon, 13 Feb 2006 19:28:43 GMT:
Dear Sir/Madam,

Submitted: Tue, 07 Feb 2006 16:14:04 GMT:
Establish a medaium

There are many more that look like spam. Plus.net needs to take a look at the issue. They have received notice of these issues at abuse[at]plus.net My experience is that their abuse department is responsible. Take it up with abuse and see if you can make progress as a customer.

Andrew
Miss Betsy
195.166.130.40 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 5 hours.
Causes of listing

* System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
* SpamCop users have reported system as a source of spam less than 10 times in the past week

Additional potential problems
(these factors do not directly result in spamcop listing)

* System administrator has already delisted this system once

Because of the above problems, express-delisting is not available
Listing History
In the past 89.2 days, it has been listed 14 times for a total of 20.8 days
Other hosts in this "neighborhood" with spam reports
195.166.130.41

Yes, only some ISPs use spamcop blocklist to block emails. It is your problem with your ISP. Ask him why he is allowing spam from 195.166.130.40.

If you don't want the hassle of trying to convince your ISP that he is irresponsible and incompetent and not providing you with reliable email service, you can always use some webmail address to email the person whose ISP is 'bouncing' your email. Yahoo is not a good choice, but hotmail and other free web mail are probably ok.

Miss Betsy
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.