From some PM traffic;

And of course the standard blurb that should have been "discovered" while the user was looking through the SpamCop FAQ here .... SpamCop can block nothing.

The best data I can dig up from so little information;
http://www.spamcop.net/w3m?action=checkblo...p=213.47.132.46
213.47.132.46 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 11 hours.

Causes of listing
System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

Looking for potential administrative email addresses for 213.47.132.46:

cannot find an mx for chello213047132046.31.11.vie.surfer.at
cannot find an mx for 31.11.vie.surfer.at
213.46.255.2 is an mx ( 10 ) for 11.vie.surfer.at
postmaster[at]11.vie.surfer.at bounces (11 sent : 11 bounces)
cannot find an mx for vie.surfer.at
213.46.255.2 is an mx ( 10 ) for surfer.at
postmaster[at]surfer.at bounces (11 sent : 11 bounces)

Listing History
In the past 262.7 days, it has been listed 2 times for a total of 5.4 days
Other hosts in this "neighborhood" with spam reports
213.47.131.200 213.47.131.203 213.47.133.17

http://www.senderbase.org/?searchBy=ipaddr...g=213.47.132.46
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ......... 4.3 .. 3294%
Last 30 days ... 3.2 ... 233%
Average ......... 2.7

(sure looks like a compromised system involved, unless there's some other explanation for this increase in traffic)

Real-time blacklists
list.dsbl.org Boycotted - http://dsbl.org/listing?213.47.132.46
bl.spamcop.net http://spamcop.net/w3m?action=checkblock&ip=213.47.132.46
dynablock.njabl.org Dynamic IP - http://www.njabl.org/cgi-bin/lookup.cgi?query=213.47.132.46

Looks again that the SpamCop.net issue was just the early warning sign, expect to see this IP address on other BLs shortly.

PM sent to advise of this posting.

I doubt he will show up here

First mail seen on 15th this month, on three real-time lists, dynamic space. This looks like a zombied machine on a broadband connection. He says 'I do not send spam' - if that's what he thinks he is mistaken, he's sending gigabytes of it.

With a bit of luck his provider will cut him off soon and give us all a break. But as it's chello I'm not holding my breath.

Hi, Wazoo,

You are not right or Your information is incorrect. Can You answer me following questions ?

1/ I am a cable modem user of UPC Austria. Do You know the hierarchy system of UPC and its internet connection ? I am part of one cell. In my case it is following cell:
213.047.132.1 and my "member number" is: 46, then I have IP address:
213.47.132.46, it means: I am 46th user in this cell.
If someone in our "cell" misuse this cell and makes an use under my IP, why do You think it´s me and abuse me ? You should close the entire cell, not one member only. Maybe then would our ISP be active against spam. I am without power against spam, I do not send it, I get it, mostly from USA.

2/ I tried to make the end of this problem on DBSL with following result:

DSBL: Send Removal Confirmation
Confirmation email refused. Please fix your server to accept removal request mail. DO NOT email us asking us to email to another address or to help you fix your server; we will not do either.

Result:
Message Report:
Sorry, I wasn't able to establish an SMTP connection. (#4.4.1)

Of course, You blocked my SMTP port, therefor no reaction or SMTP connection!!!!!

3/In the past 262.7 days, it has been listed 2 times for a total of 5.4 days,
If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 11 hours.

NOTHING was done and no automatically delisting was done. I reported some spam directly to Your site and in the meantime I was not present in Internet and my PC was shut down. How could I send spams ?!?!?!?

4/ Richard W. wrote: Once the spam stops, the IP will delist.

When ???? What does he understand under: ONCE THE SPAM STOPS ...

Within 1 month or one year or /or the period will be set through the god or USA
administrator/ ?

5/ my email SMTP is still blocked since 5 days ??? WHY ? Is there any activity to see ? Or You want to see it, because You want to see it? This is, what I mean under power misuse!!!

Eke

While I was doing research (again, having to guess at things, as no data was provided) and taking a break from shoveling snow, I see that in another set of posts (once again, in another Forum section, under an existing Topic/Discussion about a ComCast issue ..???) the follwing is copied here .... Deputies had also been contacted, RW responded, also pointing out the viral / infection scenario ..

Not copied over is yet another posting, once again accussing "me" of getting rich by blocking his/her e-mail ....

I can only work with data available .... the only info I had was your posting IP, which normally wouldn't be your e-mail server .. however, as it turned out to be listed, I pulled up some more data and provided that.

There are others here that live on your continent. Once again, all I can work with is what's seen .. started with an IP address, ended with an IP address ... and SenderBase is showing a 3,000%+ increase in traffic from that IP address in the last 24 hours. That to me is pretty much the end of the story, and apparently backed up by Richard's analysis of the e-mail that hit the spamtraps.

As in the data you sent to Richard (copied in a previous post) I don't follow how this ties to SpamCop.net yet.

Not a clue as to how / where you picked up this bit of silly stuff. The SpamCopDNSBL is nothhing but a list of IP addresses. Other ISPs use that list in trying to control their incoming spam spew. SpamCop.net itself recommends against using it in a "blocking" mode. Bottom line, it's the receiving ISP that is blocking anything. Do you actually run an e-mail server on a computer at this IP address?

Follow the links to the SpamCop FAQ here, the "Why am I Blocked?" FAQ entry .. eventually you will end up on a "What is on the SpamCop BL" entry, which offers up the process of listing / delisting, even offering up a bit of a mathmatecal equation to sort through.

I'm not following your argument at all, especially when you are accussing "me" of doing anything to your e-mail. SpamCop.net blocks nothing. If this IP address does in fact tie directly to your computer, then I'd suggest you follow the clues thus far offered and figure out what it's infected with.

My guess is that he is doing so, and doesn't know it! Classic zombie, on the evidence. If he had a brain he'd be dangerous.

Nothing is listening on Port 23 of that IP anyway.

Actually it seems that you are the one that still does not understand exactly what is happening. Your "cell" IP address 213.047.132.1 is not on the blocking list. Only your personal "member number" IP address 213.047.132.46 appears on the blocking list. The reason it is there is because spam is coming from it. Your are NOT personally sending it, your computer is doing it all by itself because someone has been able to take control of it. This could have happen a number of different ways but the most likely source was an infected email that you opened and it began taking over your computer.
We are sorry that this site is only in English as it appears that English is not your primary language. For me and many of the other users here, English is our only language. We are willing to try to help you, but you have to accept that the problem is inside your computer and that is what needs to be fixed first and unfortunately only you have direct access to it. You may need to get professional help to fix your computer, but it needs to be fixed and soon.

Hi,

super, super, do really think I am an idiot ?
SpamCop can block nothing and why do I get a following message?

Konto: 'pop.chello.at', Server: 'smtp.chello.at', Protokoll: SMTP, Serverantwort: '551 Mail from your IP address is currently blocked based on RBL listing', Port: 25, Secure (SSL): Nein, Serverfehler: 551, Fehlernummer: 0x800CCC79

Who is the author and authority for this RBL ??? Not Spamcop.net ?? The God ?

Are You pulling my leg ????

Now I tell suggest following to You :
I will close my PC for the period of at least 15 hours. /no power, no traffic, no activity/. What will You say then, if any traffic and/or activity will be reported ??
Maybe: We know you are there and when not, then you are there and if we are wrong, you are there etc.

Eke

Hi, Derek,

mission impossible.

No we do not think you are an idiot, just someone that does not yet understand how SpamCop and Blocking lists in general work.
SpamCop provides a list of IP address that have been reported as sending spam or have sent spam to SpamCop spamtraps. That list is made available free of charge to anyone that would like to use it.
The only ones that can actually block your mail are:
1) your ISP who can block out going mail if they so choose
2) the person you are sending your mail to or their ISP.
SpamCop itself can not block your mail.
When your computer stops sending spam it will automatically be removed from the SpamCopBL within a fairly short time period. The actual amount of time is based on a very complex formula that no one here fully understands, but can generally be stated as within 24 hours of the last report of spam being received.

Actually, I have no idea. I don't see anything about SpamCop.net in that message. Technically, the use of "RBL" used to specify that MAPS was involved. MAPS is not SpamCop.net.

http://www.spamcop.net/w3m?action=checkblo...=213.047.132.46
213.047.132.46 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 14 hours.

Apparently traffic still flowing as the last estimate was 11 hours .. but ...

21 March 2006 1836 GMT -6
http://www.senderbase.org/?searchBy=ipaddr...g=213.47.132.46 us now showing a reduction in traffic ....
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.2 .. 2849%
Last 30 days .. 3.2 ... 234%
Average ......... 2.7

21 March 2006 2022 GMT -6
Report on IP address: 213.47.132.46

Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.1 .. 2487%
Last 30 days .. 3.3 ... 234%
Average ........ 2.7

22 March 2006 0150 GMT -6
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ......... 4.1 .. 2428%
Last 30 days ... 3.3 ... 227%
Average ......... 2.7

I've seen other drop a heck of a lot faster ... wondering if the lease time is long enough that eke wil have the same IP address when things are powered back up .... or has it already changed hands?

Just a bit of a side-nitem feeding inro the 5-day thing;
Date of first message seen from this address 2006-03-15 ... kind of fits ....

22 March 2006 0405 GMT -6
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ......... 4.1 .. 2428%
Last 30 days ... 3.3 ... 227%
Average ......... 2.7

22 March 2006 0705 GMT -6
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.1 .. 2429%
Last 30 days .. 3.3 ... 227%
Average .........2.7

22 March 2006 1625 GMT -6
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ......... 3.9 .. 1432%
Last 30 days ... 3.3 ... 227%
Average ......... 2.7

23 Mar 2006
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ......... 3.0 .. 42%
Last 30 days ... 3.3 . 228%
Average ......... 2.7

Of course, a reduction does not necessarily mean a complete cessation.

Was just going with the "going to turn off the computer" ... that last post will be one of those that every now and then will be edited with later results ... the last one of these showed the massive drop in about 8 hours, ramp-up as soon as the system was fired up again ... yet the Topic went on for several more pages as even then that user wasn't yet convinced hat the problem was "in he house" .....

I'm having a problem with the error message offered up thus far ... with only what is showing, is it possible that it is chello itself blocking the attempted SSL connection? (and again, nothing to do with SpamCop.net)

It certainly appears that Chello is blocking SMTP connections from its own SCBL-listed customers. I guess that's one way to get its customers to pay attention to security.

nuff said!

If the cap fits...
Enough of an idiot to get infected and then blame the doctor for your illness, anyway.


Unfortunately, as we have seen recently on this forum, unless you turn off the cable modem and/or router too the spew may continue. It may be your modem/router that is infected rather than your PC.

See this thread http://forum.spamcop.net/forums/index.php?showtopic=6062
where what turned out to be problem was a hijacked wireless router. You could learn a lot about spam blocklists there. Also note the enquirer's attitude and imitate: that way you'll look less like an idiot.

See http://psbl.surriel.com/evidence?ip=213.47...=Check+evidence to see just a small sample of the 10,000+ emails per day that YOUR system is inflicting on the world.

From a PM;

I added in results seen by editing the contents of Linear Post #13 in this Topic. I find it odd that the numbers did a major drop "today" .. as compared to while everything was turned off ....

Unless he got a new IP address when rebooting.

I say that the spammers have more control of your system than you do.

And that you are an idiot.

Hi, Wazoo,

I think, it shows evidence of the fact, maybe was my PC hacked as I found out this RPC - remote process control was hacked in my PC. Everything was already closed and blocked by me.
It was very interesting that as postmaster server was 217.0.0.2 signed . Do You know this IP address ? This IP has tried to take control over my PC and network. For Your information some fact You can see, too:

SenderBase Results from 22.March 2006 at 10,00 AM:
Report on IP address: 213.47.132.46
Volume Statistics for this IP Magnitude Vol Change vs. Average
Last day 3.4 382%
Last 30 days 3.3 228%
Average 2.7

CIDR range 213.47.128.0/20
Why is this CIDR range so wide , whe n my IP is 213.47.132.46 and they are working with ..128.0/20 ? It is not my range.

Eke

P.S.
I tried already to answer You the same I am writing now and suddenly was everything away. Somebody didnt like it, what I wrote.

Derek,

next time make a use of one mirror, if You want to attack me, buta magyar.
Very special way of conversation, like Your UK. Instead to try to help someone You still attack me, thank You. Really british sense for seriousity. I am very sorry about You and Your next life in the future.


Your way of conversation is typical british honest and seriousity.
Try to get Your emotions under control /a gentleman can do that, but You are not one/.
Have a nice day a do not blame me. I did not fall down on Your niveau.

Eke

Hi, dbiel,

I have still the same IP.

Eke

Hi, Merlyn,

thank You, nice said. I hope You will have the same or similar experience in the future. And if You are really "A Spamcop advocate" then do not forget the primary rule of good advocate:
Protect the client instead of attack him.

Eke

eke, please note that because your first several posts were way off topic replies to a request for help on how to report spam your account was placed on "Moderator Preview" by the admin staff, which means that all your future posts had to be approved by a moderator before they became visible in the SpamCop Forums. That is the reason they seem to disappear after you post them. They are simply waiting to be approved first. Your more recent posts have been on topic and in the right forum. If this pattern continues, your account restriction will be removed.
Please note that none of your posts have been edited or deleted. Your off topic posts were moved to a restricted forum, all your other posts have been approved.
Also be aware of the fact that moderators are not alway on line or may be busy at the time you make a post so there can be a delay in approving posts.
Also please be aware that Moderators usually do not reply directly to PM messages but will rather post them in the forum.
The SpamCop Forums are a Peer to Peer forum and not a customer service forum.
All moderators including the forum admin are unpaid volunteers. Please keep this in mind at all times.
Reporting other peoples posts will only delay the removal of your restricted status.
Just as all of your negative remarks, that many of us do not appreciate have been approved and posted as written the posts of other users must also be permitted. Please remember that it was your posts that resulted in the negative reply by others. We will edit and remove foul (bad) language, but other than that, we try not to edit the posts of any individual but request that they be on topic (if a reply) and in the right forum if a new topic.

Please note that there are NO clients in the SpamCop Forums, only other users responding to posts from users like yourself.
When a user like yourself starts off in attack mode, it is not suprising that other users respond in kind.
If you expect customer service then you need to contact SpamCop directly.
So far no one who works for SpamCop has responded to any of your posts. It fact they respond to very few forum posts.
All replies have been from other users of SpamCop most of who take great offence at what you have written, so it is not suprising that they reply in a very negative tone.

Especially when they have been proved right all along.
He now admits that his system was hacked and was sending spam.
No chance of an apology for all his personal attacks on Wazoo in particular and the USA in general, I don't suppose?

I'm still wondering why the dropoff seems to have occurred long after you say that everything was disconnected. But, based on the continuing drop, it appears that you have done something to resolve the problem. Thanks. I'll go with language issues being involved in my not really understanding "everything was closed and blocked" though.

Not sure what exactly is meant there, but ... just another IP address to me .. data and abise addresses if you want to follow up and make complaints ...
whois -h whois.ripe.net 217.0.0.2 ...
inetnum: 217.0.0.0 - 217.5.127.255
netname: DTAG-DIAL13
descr: Deutsche Telekom AG
country: DE
admin-c: DTIP
tech-c: DTST
status: ASSIGNED PA
remarks: ******************************************************************
remarks: * Abuse Contact: http://www.t-com.de/ip-abuse in case of Spam, *
remarks: * Hack Attacks, Illegal Activity, Violation, Scans, Probes, etc. *
remarks: ******************************************************************
mnt-by: DTAG-NIC
source: RIPE # Filtered

person: DTAG Global IP-Addressing
address: Deutsche Telekom AG
address: D-90492 Nuernberg
address: Germany
phone: +49 180 5334332
fax-no: +49 180 5334252
e-mail: ripe.dtip[at]telekom.de
nic-hdl: DTIP
mnt-by: DTAG-NIC
source: RIPE # Filtered

person: Security Team
address: Deutsche Telekom AG
address: Germany
phone: +49 180 5334332
fax-no: +49 180 5334252
e-mail: abuse[at]t-ipnet.de

Your IP address is found in a block of IP addresses assigned to chello.at
Trace 213.47.132.46 ...
63.209.170.102 RTT: 41ms TTL:208 (level3-upc-us-nyc01a-rd1-gige-2-0.aorta.net ok)
213.46.160.125 RTT: 119ms TTL:208 (fr-par-rc-02-pos-4-0.chellonetwork.com bogus rDNS: host not found [authoritative])
213.46.160.250 RTT: 138ms TTL:208 (at-vie15a-rd1-pos-14-0.aorta.net ok)
213.46.173.134 RTT: 138ms TTL:208 (at-vie15a-ra1-ge-4-1-0.aorta.net ok)
213.46.173.114 RTT: 142ms TTL:208 (No rDNS)
212.17.99.197 RTT: 141ms TTL:208 (No rDNS)
212.17.99.137 RTT: 139ms TTL:208 (No rDNS)
212.17.99.34 RTT: 139ms TTL:208 (No rDNS)
212.17.116.10 RTT: 163ms TTL:208 (at-vie-pe-cr11e-ge-14-1-1.upc.at ok)
* * * failed
and from http://www.dnsstuff.com/tools/tracert.ch?ip=213.47.132.46
There appears to be a firewall right after 212.17.116.10 (hop 15) that blocks ICMP, unwanted UDP, and unwanted TCP packets.
and that IP address tracks back ti;
whois -h whois.ripe.net 212.17.116.10 ...
inetnum: 212.17.116.0 - 212.17.116.63
netname: SK-13-UNIVIE-3
descr: Telekabel Wien GmbH
descr: Uni Wien Student-Connect
country: AT
admin-c: HTK1-RIPE
tech-c: HTK1-RIPE
rev-srv: ns1.telekabel.at
rev-srv: ns2.telekabel.at
status: ASSIGNED PA
mnt-by: TK-MNT
source: RIPE # Filtered

role: Hostmaster Telekabel Wien
address: UPC Telekabel Wien GmbH
address: Erlachgasse 116
address: A-1100 Vienna
address: Austria
phone: +43 1 96068 5000
fax-no: +43 1 96068 5666
e-mail: hostmaster[at]chello.at
remarks: trouble: help[at]chello.at
admin-c: AK991-RIPE
tech-c: MG111
tech-c: MS2509-RIPE
nic-hdl: HTK1-RIPE
mnt-by: CHELLO-MNT
source: RIPE # Filtered

As stated in my first PM to you as part of my iniital "warn" action (and copied as part of the first post in this Topc) ....
Your account has received a Warning flag, posting capabilities have been changed to require "Moderation" ... basically stating that no one else will see them unless/until a Moderator "approves" those posts.
A number of your posts have been moved to a non-public area due to content and placement, and your "Report this post" action seems a bit odd after handling your previous posts. As stated in a few other posts, hinted at in others, had you started out by asking for help, things would have gone a bit differently in here. Starting out by accusing "me" of getting rich by blocking your e-mail (in a discuasion about ComCast blocking someone else's spam report e-mail flow) wasn't the best introduction. Please see Section 8 - SpamCop's System & Active Staff

and while I'm thinking of it, this is what I expected to see yesterday/last night ....
Report on IP address: 213.47.132.46

Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 0.0 .. -100%
Last 30 days .. 3.3 ... 228%
Average ........ 2.7

and lest we forget .....
213.47.132.46 not listed in bl.spamcop.net

Things have worked as intended .... there was a source of spam spew, the IP address got itself listed in the SpamCopDNSBL .... in this case, the infected computer got fixed, and the IP address was removed from the SpamCopDNSBL after the spew stopped. Thanks for solving the problem.

Gone rather quiet on this thread, hasn't it?

Yes, well, the entire Forum has been rather quiet today.

Hi, Wazoo,

thanks for nice statement. I never attack a friendly man, unless he holds me for an idiot.
I tried to do my best to solve this problem, but I think it could be of advantage for Your Spamcop.net, if some "admins" could have their tongue under control.
You can understand it is not very nuff to be blocked a accused.
His remarks about my english knowledge are not fair. If he could speak so many languages as I can do /if even on my "english level" hi could be very happy, but OK,it is his problem. I do not want discuss with him, is not my niveau.
Sincerely
Eke

P.S.
Please, let me know, if You have seen any traffic from my IP address.

Hi, Jeff G.

yes, it is true. You and Wazoo have tried to explain something to me, the other was only attacking me. Really honest british way of fairness.

I am sorry if you miss understood my comments about your English in a previous post post#9 It was not an attack at you. The world is not an English only world and unfortunately this site is, which makes it difficult for those who are not fluent in English to clearly express themselves here and often leads to wrong interpretations and misunderstandings. The other points were meant to try to help you understand the fact that the problem was at your end of the connection (your computer, or router) which you eventually came to realize and then worked on repairing.
Had all of your original posts been approved, the war of words would have been much worse. Not that it is of any importance, I have been the one to approve the majority of your posts so that they would be visible in this topic which includes your last two posts.
Also remember that there are NO paid staff running this site. These forums are maintained by unpaid volunteers who are trying to help users like yourself and that many replies are simply from other users. None of us represent SpamCop, most of us do find it a useful tool, many of us are affected by the blocking list and find it a "necessary evil" to address the problem of spam which you were a part of when your computer connection was sending out mountains of it because you failed to take proper safe guards. Thankyou for taking steps to fix the problem at your end.

Your IP seems to be listed with other blocklists your provider does not have an abuse address for?
If you end up on SCBL it because your ISP is not acting on abuse reports (in this case not having a contact address and not getting them)

Pay for you to do a Security Check This is a Symantec site
Also go through my signature
If you have a Zombie Computer you will be (IMO) best format all drives as everything on that computer is avaiable to any thug that wants to know. This can be when you are at home when you are not, you address phone number, passwords bank details etc

If your computer is now fixed, you could look at these pages also:

Another explanation of why blocked
dnsbl.njabl.org Open proxy - click here to see your listing
dynablock.njabl.org Dynamic IP - click here to see your listing

Miss Betsy