I ticked the "CBL" box on my Spamcop service.
Spamcop blocked several emails arriving through IP 82.110.105.65 yesterday & the day before, on the grounds:
"CBLX-SpamCop-Checked: n.n.n.n n.n.n.n. 82.110.105.65 X-SpamCop-Disposition: Blocked cbl.abuseat.org"

- But, when I checked, none of the three IPs were listed on the CBL.abuse.org website.

- CBL support assisted with "of the three, only the last IP has ever listed. IP 82.110.105.65 was detected most recently at: 2006/06/23 08:xx UTC sending email in such a way as to strongly indicate that the IP itself was operating an open http or socks proxy, or a trojan spam package...."
- And with "the listing expired on June 29, 2006. I'd be very surprised if Spamcop reported it as listed by the CBL. The listing has been expired for almost a month, and SpamCop runs better than that... but yes, you need to take this up with SpamCop."

Since CBL indicate the other 2 IPs were never listed, is the application by Spamcop of a version of the CBL which was a month+ old, or intended another purpose, likely to be the reason for this discrepancy?

Are u there, Spamcop Support? The people from CBL show Spamcop's "CBL list" giving a false positive on an email; they checked that the only IP address in its header which ever appeared in the real CBL list was delisted a month ago. How so?

Another false positive has arrived (with Spamcop = "blocked" but CBL website = "not listed"), from email using other IP addresses. It's not feasible for me, a user, to keep asking CBL Support to explain why IP addresses not in their list are being shown as being in it by Spamcop .... can Spamcop please respond to the original incident?

Thanks - GusB

Amd you scrolled by this how many times?

This is a User to User Support Forum
The primary mode of support here is peer-to-peer, meaning users helping other users.
(please remember this at all times!)
Another try:
This forum is composed of people who have used spamcop and those who are learning
about anti-spam efforts.

Section 8 - SpamCop's System & Active Staff User Guide
Original SpamCop FAQ & Added Forum Items, Never up to date, changes often - contains entries on "contacting Staff"

You first posted, made remarks bout three items, chose only to post a single IP address. This post continues that mode, making a statement about further incident, but offer no details.

At this point in time, you are alone in complaining about this issue.
You have provided no data for any analysis to be performed .... for us "other users" that would be a Tracking URLs so that "we" can see what you see. If you are going to contact JT, he'd need to also see the e-mails in question. (For example, are all your samples coming from this 'single' IP address?)
There are a number of experienced SpamCop.net e-maI Account users here, a number of them also residing in the UK, if that makes a difference. While wearing my 'systems analyst' hat, I've been waiting for one of them to possible chime in here ... that hasn't happened. So basically, I'm stuck here with the lack of details provided by you, no one else either receiving e-mail from the same places, noticing that there is an issue, or simply not having the same problem with their account ....

On another track, data copied from a recent spamcop newsgroup post;

Then one can also see an interesting newsflash at http://cbl.abuseat.org/ that you didn't mention;

Timeframe doesn't quit match, but then again, there's that lack of data provided again ....????

I don't know how I missed this thread, but I just scanned my mailbox and do not have any that were caught by cbl so I can not test against their on-line one.

I suppose it is possible that the cache on whatever DNS server JT uses (his own???) has not cleared for some reason.

Agreed, that's one possiblity ... but not knowing if the same IP address, country of origin, ISP/Domain, etc. is involved, the same blade server is involved, possibly which version of the application might be involved, on and on ....

Just to repeat directly, Gus:

Please post (cancelled if they are not spam) tracking URL's for these specific messages you see being blocked by yhe cbl but which are not currently listed. Perhaps by comparing the messages we might see a trend you are missing between these messages.

Apols for the dodgy etiquette & thanks for the comments! FYI I'm new to forums; also new to the web parsing interface for producing tracking URLs for non-Spam (normally a Spamcop email service user) but learning fast ...

Here as Steven asked are the tracking URLs. Since it's not spam, message bodies & local-names in the email addresses are munged.

RE INCIDENT 1 - Here's the Tracking URL: http://www.spamcop.net/sc?id=z1019221677zf...79902bf5c4126ez . Spamcop presented "blocked. CBL.abuseat.org", which is a false positive as CBL Support confirmed in writing (also below) that none of the IP address were listed from a month before the incident till after it occurred. This is the issue I reported.

RE INCIDENT 2 - Here's the Tracking URL: http://www.spamcop.net/sc?id=z1019205689z1...e8c0323bbeb71cz Similar behavior as before: in theory this one could be explained by CBL delisting just after Spamcop interrogated the list: I can ask CBL Support to look at the history of these IP addresses also, if people think that's likely to be useful.

RE INCIDENT 1 - Here's email from CBL Support confirming that the IP addresses were not listed:-
>From: CBL Team [mailto:xxx]
>Sent: 31 July 2006 01:49
>To: xxxx
>Cc: xxxxl[at]cbl.abuseat.org
>Subject: Re: CBL listing for 82.110.105.65
>You write:
>> X-SpamCop-Checked: 192.168.1.101 82.110.105.33 82.110.105.65
>> X-SpamCop-Disposition: Blocked cbl.abuseat.org
>[Of the three, only the last IP has ever listed. The first one (192.168.x.x) is a private network IP, isn't routable on the >internet, and would never be listed.]
>The IP 82.110.105.65 was detected most recently at:
> 2006/06/23 08:xx UTC
>sending email in such a way as to strongly indicate that the IP itself
>was operating an open http or socks proxy, or a trojan spam package.

The X-SpamCop-Checked line will always quote all the potential ip addresses and it is always that last one that is the cause of the message being trapped.

In this case the CBL folk confirm that 82.110.105.65 was listed in the cbl so this is a correct action by your SpamCop mailbox given that you have asked it to check against the cbl.

The other two ip addresses are ones that your SC mail checked before the problem ip. Being in the checked list does NOT mean it is listed anywhere.

Andrew

I wanted to avoid information overload, but here's CBL's "very surprised" view, replying to me, of Spamcop's blocking of 82.110.105.65 a month after it came off the real list.
The views in the forum so far still seem to support a false positive - no algorithm's involved, it's listed or it is isn't, and it isn't....


From: CBL Team [mailto:cxxx[at]cbl.abuseat.org]
Sent: 31 July 2006 14:58
To: Axxxx[at]highup.co.uk
Cc: Cxxxx[at]cbl.abuseat.org
Subject: Re: CBL listing for 82.110.105.65

You write:
> * Many thanks for the information in your email below.
> This is very useful, but I 'm not sure what the
> current status of 82.110.105.65 is - could you please
> clarify whether this is actively on the the CBL list,
> or whether the behavior detected last month was as
> recent history of the IP which is however not now
> positively listed?

the listing expired on June 29, 2006.


> * If it's positively listed then (as in my email) this
> fact doesn't show on the CBL website, so does the
> website version need updating? [I can then approach
> the mail hosting service responsible for the IP]
> * If it's not positively listed, then I can take this
> up with my Spamcop service, which reported that it
> was and put Blocked cbl.abuseat.org in several
> email headers.

I'd be very surprised if Spamcop reported it as listed by the CBL.
The listing has been expired for almost a month, and SpamCop runs better than that.

But yes, you need to take this up with SpamCop.

--
Rxxx, CBL Team

Yes, it WAS listed but was cleared a month before the message was received.


You may have munged too much. Neither of these samples have the X-Spamcop-* headers showing they were blocked incorrectly or why.

Yes, Steven's right. From the unmunged versions run just now:
Incident 1
X-SpamCop-Checked: 192.168.1.101 82.110.105.33 82.110.105.65
X-SpamCop-Disposition: Blocked cbl.abuseat.org

Incident 2
X-SpamCop-Checked: 192.168.1.101 82.110.105.33 212.67.121.107 127.0.0.1 127.0.0.1 127.0.0.1 88.144.66.221
X-SpamCop-Disposition: Blocked cbl.abuseat.org

I don't have time for this right now. IF that was all you had munged out of the messages, then there is nothing to go on but to keep monitoring the situation.

In the future, please provide tracking URL's for the full messages. Spamcop munges the address for you in the tracking URL (even when you do not munge the reports). You can look at the tracking URL yourself if you wish before posting to be sure nothing you are trying to hide is released.

I gave up when I saw the same thing that Steven pointed out. I thought it was pretty clear that the 'real' data as a complete package was what 'we' were looking for. Couldn't find those specific lines, saw the Outlook/Eidora work-around in use, looked at possibly taking some data and trying to tun my own parse, but ... too much missing/inconsistent data involved. Went on to other issues.

Will do. Here are two better tracking URLs (the emails are not spam, so the local-names in "from" and "return path" addresses are munged):-

RE INCIDENT 1
http://www.spamcop.net/sc?id=z1019538452z1...b5c37b72f49b3bz
Spamcop flags "blocked. CBL.abuseat.org". This is not as per CBL's list, as CBL Support confirmed in two emails (posted) that none of the IP addresses have been listed by CBL since June 29 (to July 31, and a check at their website today confirms this status).

RE INCIDENT 2
http://www.spamcop.net/sc?id=z1019888603z4...c060161142c3eaz
Same problem as Incident 1. CBL Support confirms in an email (extract posted below) that none of these IP addresses have been listed since March 2006.

RE INCIDENT 2 - new email from CBL Support:-
"From: CBL Team [mailto:cbl[at]cbl.abuseat.org]
Sent: 04 August 2006 15:24
To: Axxx
Cc: 'CBL Team'
Subject: Re: Listed in Spamcop but not listed in CBL - 2
Of the IPs listed below, only 88.144.66.221 has ever been on the CBL, and that was almost 5 months ago.
At that time, it behaved as if it was infected with a virus."
>> X-SpamCop-Checked: 92.168.1.101 82.110.105.33 212.67.121.107
>> 88.144.66.221
>> X-SpamCop-Disposition: Blocked cbl.abuseat.org

Thank you for the updates. As mentioned previously, if an address is blocked, it will be the very last one listed in the X-SpamCop-Checked: line. That would be the only IP you would need to ask cbl (or any blocklist about.

I am sending an email to JT on this issue now. He will not be able to look at your account unless he can figure it out from the information already posted here, but he may not need to.

Noted, & thanks for the guidance throughout.
CBL came back today after my enquiry to them to say they'd approach Spamcop about the problem, so hopefully it'll get resolved shortly.

Actually had this under composition, but got involved with a bit of a local emergency .. so sent out much later .... possibly also over ran by events, but ...

As posted above, I'm a Spamcop email service user and so new to the web parsing interface, which in my usage I now require only for producing tracking URLs for non-spam emails e.g. for a forum. So I was new too to the 2-screen interface needed for Outlook, and to munging friendly senders' details from tracking URLs. Many thanks for the enabling help with several of these!


It looks like a quick solution to the substance of the CBL/Spamcop discrepancies. CBL updated me that they'd established with Spamcop that SpamCop was retrieving their copy of the CBL from a 3rd party, whose "copy of the CBL hasn't updated in months"...

Thanks for coming back with the reply. I assume JT is also taking care of this from his end.

Nice work GusB, thanks for your perseverence.

...And when you've confirmed that things are working correctly, please post that information here and one of the Forum Moderators will flag this thread as "Resolved." Thanks! <g>

Will report back when ok against the original incidents.

In the meantime, as the problem affects both CBL's & SC's reputations but its 3rd party origin means it can occur any time without SC or CBL knowing it has, I suggest that SC could usefully be asked:-
- the target time for changes in CBL's listing to be picked up by SC.
- whether it's feasible for SC to pick up CBL data from CBL rather than from a 3rd party.

I've not noticed CBL stop catch anything?
Perhaps it can be dropped altogether?

This from JT;

Can we please know the ongoing approx target time for changes in CBL's listing to be picked up by SC?

- The original incidents failed again just now (I'll repeat each day or two) but, without SC's approx target refresh time, it's not clear whether this observation is bad or just indifferent....

Well according to JT's own words: I would assume it should be working correctly already. If not, you should probably present the evidence (tracking URL's being the best way) to JT directly at support[at]spamcop.net

I'm not sure I understand .... the use of the CBL would be in "incoming" e-mail .... why/how/whatever would the "original incifents just filed again .. will try again in a few days ..." .... I don't follow that ... you have the means to 'create' new e-mail from the places you wish the filters/BLs to handle ...????

It's the most useless of the blocklists we use anyhow I vote for its removal. Do not see the point in installing junk just for the sake of it?

Not sure what you mean here. The CBL blocks TONS of stuff. It's a very fast, very accurate list of zombied and otherwise hacked machines. Because of the way they pick stuff up, they will often identify these hacked hosts before the SpamCop blacklist picks them up.

JT

So far not seen CBL catch much of anything. the highest recorded score goes to SpamAssasin SCBL then the country blocklists like China Brazil etc. Not see the need to pander to CBL. In fact would rather have if needed be another choice I know they tout themselves up but I rarely see them catch anything that is not already being stopped or in the SCBL (and I check)

IMO CBL are run by identities that have never been SpamCop friendly! Reality in-fact very active in trying over many years to bring SpamCop down so do take care (Not a wise choice to give them any credibility they are a poison pill)

Well, I will agree with you since SpamAssassin was changed to check first on my SpamCop account. Before that, however, CBL was my second biggest BL behind spamcop.

Skulduggery tactics with those attacking SpamCop is not new, As I am finding zero use of the CBL I expect mystically I will shortly As you but no one else already is?

Again today Spamassasin and SpamCop's Blocklist the only ones doing the blocking as usual CBL have no mention. They also go on about not listing mail servers?

Stupid concept as many spam friendly servers are improperly set-up conceal the IP source and I don't want or need their spam.

SpamCop does not block these incompetent fools straight away and always tries to inform them of their abuse problems

When SpamCop does a parse it checks with a number of blocking lists to see CBL are one of such (ineffective) list.
Even then they are slow and behind SpamCop Blocklist (SCBL) in listing IP's. I do not See it as a very good/effective blocklist at best

Not sure if the CBL list afflicts the running of the mail servers my problem is the antics of those that seem to be behind it in trying to harm SpamCop and would not miss seeing the CBL if removed

Good news! I recreated the original incidents today (by resubmitting for SC parsing the emails sent to me which SC had CBL-blocked before); and SC reported the relevant IPs as "not listed", in line with the real CBL.

The PARSER reporting an IP in CBL is completely different than the Smapcop webmail filters reporting it as being listed. The first case is only informational. The second case will cause a message to be sent to the Held Mail folder if the CBL is chosen.

All this time I thought we were discussing the second case (webmail filtering). If so, this test has no relevance. The test you describe is done on completely different systems on different sides of the US.

To recap, the original incidents involved checking SC's CBL-related filtering versus the "real" CBL list from CBL's website, and double-checking each time with the CBL organisation. This showed that SC's source for CBL listing was out of date, and JT stated that SC had taken steps to resolve this.

Tests for verifying the resolution were then done on the original (not re-mailed) emails, and SC's output from the final test was:-
(a) "82.110.105.65 not listed in cbl.abuseat.org" for one original email, and "88.144.66.221 not listed in cbl.abuseat.org" for the other; whereas...
( SC had originally given false positives (posted earlier) to these IPs, by outputting "blocked.cbl.abuseat.org" messages and placing the emails into "held mail".

Your comment suggests in effect that the output at ( a) above was from a subsystem of SC different to the one which produced (, so that:
- each subsystem may have used a base version of CBL different to the other
- the subsystem producing ( was not in fact verified by this test
- the test was thus not conclusive

If so, thanks for pointing this out.

Either way, I'll have to leave this now as the test was an "optional extra" - as much as I could devise as a user armed with the original emails only....

Please note that " smiley face" in my view of the above posting should read as "[b]"...

This fact exists in numerous places. You original complaint was an issue with the SpamCop.net e-mail account stuff which is handled on hardware owned, maintained by JT in Georgia, U.s. (east coast) ...

Your "checking" which does not relate to anything is being applied against the Parsing and Reporting system, which is harware owned, maintained by IronPort out in California, U.S. (west coast) ....

There is no connection for what you are trying to demonstrate. Please note my original reply to your "testing results" posting, when I was asking how you managed to create new e-mail from those same sources ....

Thank you for clearing that up. I knew we had found a problem with the spamcop mail service. I was just making sure that actually fixed your original complaint. This has now reached dead horse stage No more beatings, please.