Help - Search - Members - Calendar
Full Version: Blocked but not blocked??
SpamCop Discussion > Discussions & Observations > SpamCop Blocklist Help
HughSt
Hi,
New to forum but I hope you can help.

A colleague uses Lyris to check his newsletter, the newsletter has our URL (www.meta-nlp.o.uk) contained within it.

When our colleague processes his newsletters the following report is given by Lyris:

"This report evaluates the test message (reproduced below)
that you recently sent from Lyris ListManager. ListManager
filters your message through Spam Assassin, a popular anti-
spam program, to determine if it has characteristics typical of
unsolicited "spam" mail.

If your message fails a particular spam-detection test, Spam
Assassin assigns it a certain number of points. After all of the
tests are complete, your points are summed and presented
as a total score. Lower scores are better -- they indicate that
your message has fewer traits common to junk mail. Ideally,
you want to get your message close to 0 points.

Some of Spam Assassin's tests work the other way around: if
you pass them, they assign your message a certain number
of *negative* points. This helps reduce your overall score.

Your message's score: 2.511

If your score is greater than 5, we recommend that you revise
your message to conform better to industry anti-spam
criteria. Your score is comprised of points from the following
Spam Assassin tests:

0.1 FORGED_RCVD_HELO Received: contains a forged
HELO
1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a
relay in bl.spamcop.net
[Blocked - see <
http://www.spamcop.net/bl.shtml?64.62.197.77>]
0.6 URIBL_SBL Contains an URL listed in the SBL
blocklist
[URIs: meta-nlp.co.uk]

I have checked our IPAddress and MXaddress and cannot find any SPAM blockage. I would be grateful for any ideas of where to go next - I have emailed Lyris but no reply yet.
Many thanks

Hugh
agsteele
QUOTE(HughSt @ Sep 5 2006, 10:37 AM) *

1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a
relay in bl.spamcop.net
[Blocked - see <
http://www.spamcop.net/bl.shtml?64.62.197.77>]
0.6 URIBL_SBL Contains an URL listed in the SBL
blocklist

You are correct that the IP address quoted is not in the SCBL and doesn't appear to have any reports recorded for it.

Sometimes, reports attribute a listing the SpamCop blocklist whereas the listing is in an entirely different BL and the narrative incorrectly cites SpamCop.

At this point SenderBase also confirms that the provided IP address is not listed in any blocklists at all.

Perhaps it was a temporary error.

Andrew
dbiel
QUOTE(HughSt @ Sep 5 2006, 02:37 AM) *
Your message's score: 2.511
As you quoted below, that is a fairly low score and should not result in any message being blocked.
QUOTE

If your score is greater than 5, we recommend that you revise
your message to conform better to industry anti-spam
criteria. Your score is comprised of points from the following
Spam Assassin tests:
QUOTE

0.1 FORGED_RCVD_HELO Received: contains a forged
HELO
I would check you mail headers and make sure your servers are using valid "HELO" entries.
QUOTE

1.8 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a
relay in bl.spamcop.net
[Blocked - see <
http://www.spamcop.net/bl.shtml?64.62.197.77>]
This one is a bit more confusing. The link displays
QUOTE
64.62.197.77> is not a routeable IP address
QUOTE

0.6 URIBL_SBL Contains an URL listed in the SBL
blocklist
[URIs: meta-nlp.co.uk]
The phrase "SBL" is a bit confusing here as it generally applies to The Spamhaus Block List which does not contain URL's. It uses IP addresses. So it would appear that it is refer to the entire Spam Assassin phrase "URIBL_SBL" The following quote and link may be helpful
QUOTE
Spam URI Realtime BlockLists are a relatively recent technique and SpamAssassin 3.0 supports a relatively small number of SURBLs. SURBLs are configured much like RBLs. SpamAssassin 2.63 can use a different plug-in, described later. Details on SURBLs can be found at http://www.surbl.org.
HughSt
QUOTE(agsteele @ Sep 5 2006, 11:36 AM) *

You are correct that the IP address quoted is not in the SCBL and doesn't appear to have any reports recorded for it.

Sometimes, reports attribute a listing the SpamCop blocklist whereas the listing is in an entirely different BL and the narrative incorrectly cites SpamCop.

At this point SenderBase also confirms that the provided IP address is not listed in any blocklists at all.

Perhaps it was a temporary error.

Andrew

Thanks for your reply Andrew . The Ip address is that of Lyris! not ours. The siutaion is on-going for the last 2 months on checks carried out on 2 seperate newsletter.
Rgrds
Hugh
agsteele
QUOTE(HughSt @ Sep 5 2006, 12:19 PM) *
Thanks for your reply Andrew . The Ip address is that of Lyris! not ours. The siutaion is on-going for the last 2 months on checks carried out on 2 seperate newsletter.

Of course, your own IP could be listed (although not mentioned in the report provided). If you would like to provide your own mail server IP I'm sure someone will put it through the system and see if anything else shows up.

But at this point, with the information provided so far this is not a SpamCop BL listing.

Andrew
HughSt
QUOTE(agsteele @ Sep 5 2006, 12:33 PM) *

Of course, your own IP could be listed (although not mentioned in the report provided). If you would like to provide your own mail server IP I'm sure someone will put it through the system and see if anything else shows up.

But at this point, with the information provided so far this is not a SpamCop BL listing.

Andrew


Thanks again for the rapid response IPAddress 74.52.55.232 MX Addressess 74.52.67.242 & 69.93.124.50 Thanks
Hugh
agsteele
QUOTE(HughSt @ Sep 5 2006, 01:01 PM) *
Thanks again for the rapid response IPAddress 74.52.55.232 MX Addressess 74.52.67.242 & 69.93.124.50

None of these IPs are currently listed.

The first two IPs have no recent reports at all.

69.93.124.50 has had a very small number of reports (3 in total) and so infrequent that the IP would not have been listed. (The reports related to three misdirected bounces in June and August).

As an aside, the two reports from August appear to originate from your end with the subject "Considered UNSOLICITED BULK EMAIL from you".

If you, or anyone on your system, is bouncing spam back to the supposed sender then this could lead to your IP being listed. It hasn't yet, as far as I can tell, but could do so. Bouncing spam is not advised since most spam comes with a forged sender so the Email gets bounced back either to an innocent party or, worse, to a spamtrap and then causes almost instant listing.

HTH

For now, there is no evidence that you are currently or have recently been listed in the SCBL.

Andrew
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2009 Invision Power Services, Inc.