I am extremely upset and annoyed with this spamcop nonesense.

I am based in Thailand and my colleague is currently in South Africa, recruiting staff for our business in Asia. All our communication with candidates and new employees are by email and recently I have discovered that some people cannot receive email because the mail server is being blocked by spamcop.

I hate spam as much as the next man, but this overzealous 'solution' has gone too far. I wrote to one candidate urgently to stop him flying from Cape Town to Johannesburg for the interview, but he didn't get his email. When I discovered this, I tried to call him on his cell phone but he was already boarding and I won't be able to reach him until it's too late. I'm wondering whether he will have a legal case against spamcop?

The spamcop website is horrendously confusing, obviously designed by technical people. Most of the people who use email are regular people who have no idea what a 'mail server' is or even and 'IP address'.
---------------------------------------------------------------
Here is the returned message I received (edited to protect identities)
A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

xxxx[at]telkomsa.net
SMTP error from remote mail server after MAIL FROM:<consultant[at]fcinasia.com> SIZE=5623:
host mail.telkomsa.net [196.25.211.150]: 553 sorry, your mailserver [206.123.101.27] is rejected by See http://www.spamcop.net/bl.shtml

xxxx[at]absamail.co.za
SMTP error from remote mail server after initial connection:
host smtpserv.absamail.co.za [196.35.40.11]: 553 Your IP address 206.123.101.27 is blackholed by bl.spamcop.net.

------ This is a copy of the message, including all the headers. ------


Dear XXXX,

William has contracted pneumonia over the weekend and is in hospital.
Which of course means that there will be no interviews on Monday. I am terribly sorry for the inconvenience.

Please do not come to your appointment. Your meeting has been postponed to Wednesday 13th, same time same place. Hopefully William will have recovered sufficiently by then to be able to meet you.

Please contact me urgently if this is not convenient for you and I will try to find a time for you.

Many thanks in advance for your understanding.

Kind regards,

Gary Orman
consultant[at]fcinasia.com
-----------------------------------------------------
1. Please, as a matter of urgency, can someone help me to unblock the mail server (my IP address is 206.123.101.28 by the way, not 206.123.101.27 - so spamcop must be a severe anti-mail system indeed!)

2. What can be done to prevent spamcop from so aggressively blocking legitimate mail? I would suggest either to give mail the benefit of the doubt unless there has been a considerable number of complaints (over 1,000 say) against the mail sender - and not necessarily the mail server, which might be shared by many virtual accounts. Alternatively, a direct phone service where you can contact a support representative to unblock the mail server manually, and place your server on a white list. Another suggestion might be for blocked emails to be routed via a spamcop mail server so that the technicians can verify the emails for themselves and see that they are not spam.

I would prefer that spamcop be switched off completely. It's probably not going to happen though. I still get spam and I deal with it by placing spam (fairly aggressively) into a spam folder, keeping my white list updated, and scanning spam mail at the end of each day for legitimate messages.

Unfortunately, spamcop doesn't even give the recipient the choice whether to accept or reject messages or not. That's what makes spamcop in some ways worse than the spammers.

I'm sure the spammers hate spamcop, but I - as a legitimate email user - am beginning to hate spamcop even more, and I am now loath to use any kind of service that is in any way similar to spamcop. It annoys and inconveniences people and can seriously affect business and livelihoods.

So you barge in, ranting and raving, making outlandish claims, threatening legal action, spouting out many wrong facts .... and expect exactly what in return?

Right off the bat, wrong fact number one .... SpamCop.net cannot "block your e-mail"

Your timing sucks, huh? It sounds like there's even more to the story, but ....

???? There isn't that much data actually seen at the www.spamcop.net site, unless you actually try to use the Help link and try to read the 'official' FAQ there. Is this the site you are talking about?

On the other hand, you made it 'here' ... where in addition to a single-page-access-much-expanded version of the SpamCop FAQ .. we also offer a Dictionary, a Glossary, and that's not to mention the Pinned entry extracted from 'that' FAQ as a stand-alone document that attempts to explain "Why am I Blocked?" .. from all appearances, you jujmped right over all of this available data/help.


This is all that was actually needed ....

http://www.spamcop.net/w3m?action=checkblo...=206.123.101.27
206.123.101.27 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 9 hours.

Causes of listing
System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
SpamCop users have reported system as a source of spam less than 10 times in the past week

Appearances definitely lean towards a real spam spew problem ...

Listing History
In the past 2.6 days, it has been listed 3 times for a total of 2.1 days
Other hosts in this "neighborhood" with spam reports
206.123.101.20 206.123.101.21 206.123.101.24 206.123.101.29

And the neighborhood doesn't look all that healthy either ...

http://www.senderbase.org/?searchBy=ipaddr...=206.123.101.27
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ......... 4.3 .. 2140%
Last 30 days ... 3.4 ... 188%
Average ......... 2.9

Ouch!!!! These types if numbers are almost always indicative of a spammer abused e-mail server ....

Parsing input: 206.123.101.27
host 206.123.101.27 = server007.hostspectrum.com (cached)
host 206.123.101.27 = server007.hostspectrum.com (cached)
Routing details for 206.123.101.27
[refresh/show] Cached whois for 206.123.101.27 : noc[at]kcquest.com
Using abuse net on noc[at]kcquest.com
abuse net kcquest.com = postmaster[at]kcquest.com, abuse[at]yipes.com
Using best contacts postmaster[at]kcquest.com abuse[at]yipes.com

These folks would have received the reports ... have you talked to any of them yet?

Wondering about the Thailand, South Africa, Asia connection, but referencing an address associated with;
OrgName: Colo4Dallas LP
OrgID: COLO4
Address: 2000 Irving Blvd
City: Dallas
StateProv: TX
PostalCode: 75247
Country: US

NetRange: 206.123.64.0 - 206.123.127.255
CIDR: 206.123.64.0/18
NetName: COLO4-BLK1
NetHandle: NET-206-123-64-0-1
Parent: NET-206-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.COLO4DALLAS.NET
NameServer: NS2.COLO4DALLAS.NET
Comment:
RegDate: 2004-04-14
Updated: 2004-11-15

OrgTechHandle: NOC1718-ARIN
OrgTechName: NOC
OrgTechPhone: +1-214-630-3100
OrgTechEmail: support[at]colo4dallas.com

OrgName: KC Quest, LLC
OrgID: KQL
Address: 6701 W. Douglas
City: Wichita
StateProv: KS
PostalCode: 67209
Country: US

NetRange: 206.123.100.0 - 206.123.103.255
CIDR: 206.123.100.0/22
NetName: KQL-COLO4-100704
NetHandle: NET-206-123-100-0-1
Parent: NET-206-123-64-0-1
NetType: Reassigned
NameServer: NS1.KCQUEST.COM
NameServer: NS2.KCQUEST.COM
Comment:
RegDate: 2004-10-07
Updated: 2004-10-07

OrgTechHandle: NOC1469-ARIN
OrgTechName: Network Operations Center
OrgTechPhone: +1-316-409-9963
OrgTechEmail: noc[at]kcquest.com


Funny, the only information actually provided is the rejection notice you say you received .... hard to guess from this side of the screen as to how the wrong IP address could get into the picture .... on the other hand, what might you mean by "my IP address" ..???? Neither IP address matches the IP address you used to post here ...????

http://www.senderbase.org/search?searchString=206.123.101.28 doesn't really indicate any noticable e-mail traffic ....

????? SpamCop.net cannot "block legitimate e-mail" .... Try doing a bit more research, especially on the part where SpamCop.net does not recommend the use of the SpamCopDNSBL in a "blocking fashion" .. noting that this is something under the "receiving ISP's control" .....

Yeah right .... facts all off-base, no concept on what is actually happening, but willing to offer ideas that are simply out of this world .... The SpamCopDNSBL does in fact operate on a math model comparing the amount of traffic "seen" and the compalints/spamtrap hits ... explained in the SpamCop FAQ .... this list is "automatic" .. manual intervention is extremely rare, based on an ovbious screw-up somewhere (and the numbers seen above pretty much rule out any mistake in this situation) .... "re-routing via a spamcop server" implies that SpamCop.net actually handles your e-mail .. repeat .. SpamCop.net can not "block your e-mail" ....

Basically, your ignorance is showing. That can be cured by doing some actual research. Try the SpamCop FAQ 'here' ... read some of the previous Topics/Discussions in existance 'here' ... use some of the other tools placed 'here' for your benefit .... talk to "your ISP" ... talk to the "receiving ISP" ...

The SpamCop DNSBL is only a list .. how it's used is not under SpamCop.net's control ....

With respect, Wazoo, I as a regular user sending out email to my colleagues and clients should not have to plow through pages of technical data in order to resolve this issue. I did not threaten legal action; I merely expressed my annoyance that I am having to go through all this in order to communicate - quite legitimately - with people who are personally known to me. I believe, however, that the candidate who has flown unncessarily from Cape Town to Johannesburg as a result of missing my email *may* have a legal case against spamcop, and my sympathies would be with him.

I am certainly puzzled by your assertion that spamcop does not 'block' email. I thought that was the primary purpose of spamcop. If this is not the case then I seriously misunderstand the intentions of this organization and I apologize. Why do the emails come back to me stating that my mailserver is on the SpamCop black list? Who is legally responsible, then, for blocking my mail and what recourse do I have to remedy the situation. The FAQ and other pages that I keep going round and round to aren't clear to me. Perhaps because I am not much of an expert in mail technology.

Most people would not have made it 'this far' as you suggest. This is a serious enough issue for me to try to get to the bottom of as our company is dealing with several hundred potential candidates from South Africa who have responded to our ads in the Sunday Times. It is not fair to them if our emails don't get through.

I have another hat as a UK registered journalist, and I also smell a good story here. I know it's something that the Sunday Times would be very interested in covering. Journals liked Wired or The Economist might also want to run a feature on how the anti-spam movement can cause more harm than good.

Trying to work through your statistics, are you saying that a mere 3 'reportings' over a couple of days is enough to blacklist a mailserver? Surely that is overzealousless gone mad!? Nevertheless, I am concerned if there is any hint of spam originating from me in some way and would like to resolve the matter.

I rent a virtual server with Kionic.com in the USA. When I ping my website I get 206.123.101.28, so I don't know how 206.123.101.27 is mixed up in this business. Of course there are going to be thousands of users with similar addresses - it's a virtual server after all. Were you able to find any instances of my IP 206.123.101.28 actually being reported for spam? If so, I'd be interested in finding out how this could happen and how to rectify it. If, as one suggestion in the FAQ pointed out, it's a virus then it's a serious matter that has to be dealt with.

Maybe everybody's mail on the Kionic servers go through this (.27) mailserver...?

I'm also a little puzzled as to the 'average' reporting statistic. Are you saying there are 3 reports on average every day regarding SPAM specifically? In my humble opinion, 3 isn't a lot. Surely it would be better to block serious spammers with 1,000s of reports, not a mere 3???

I don't really understand the rest of the reported data. I discovered that kcquest is also kionic, so I will try to speak to my hosting provider as well. I did try contacting hostspectrum.com, but their home page simply states it's antispam policy and emails to their postmaster bounces back.

Yes, I am ignorant about this issue. It is extremely condescending of you to slag me off about that because many many others wouldn't have even got this far. I am grateful, however, for your comprehensive reply and perhaps you can suggest how it is that spamcop blocks email yet doesn't. Surely if my (our) mailserver is on your blacklist then it gets blocked? Isn't that the purpose of the list???

Are you saying that I must somehow try to negotiate with Kionic, telkomsa and absamail if I want to send email to their respective customers?

The point is that it shouldn't be up to regular innocent users sending legitimate emails to have to go round the houses, contacting various ISPs to have this issue dealt with.

Frankly, I prefer to deal with spam myself rather than have Nanny do it for me.

Thank you for you efforts in dealing with this matter.

Gary Orman (my real name)

Hi Gary!

As Wazoo has explained, the receiving ISP is the one that chooses to make use of the SpamCop BL. Typically ISPs choose to block rather than filter causing the issue you describe.

Looking at the failure messages you provide above I'd say your South African contact is working through an ISP who has chosen to block based on the SpamCop BL. So your colleague probably has it within his power to address the problem with his/her ISP.

That said, many ISPs choose to use the SCBL because it is very responsive to spam problems and helps them reduce the load of spam flowing through their servers. This saves them money on bandwidth and Email storage.

You also have the opportunity to work towards resolving the problem from your own end. You appear to be sending your Email through an ISP that, for whatever reason (could be accidental or intentional) has a flow of spam flowing through the server. You could work with an ISP that does not have such problems and your Email would flow freely. There are many such ISPs you could switch to in order to avoid the problem but still retain your current incoming Email address.

Andrew

Did you at least look at the data offered by following the link intentionally placed in your way .... Start Here - before you make your first Post .. if so, what is it that didn't catch your eye about what SpamCop.net is? You are not familiar with a Credit Reporting Agency?

SpamCop.net's primary function is an automated tool to allow the reporting of spam to the ISP/Admin of the system that is sending that bad e-mail. The problem is that there are too many ISPs/Admins that either don't care or are technically challenged and can't figure out how to stop it. This led to the creation of the SpamCopDNSBL, which is used for the benefit of folks using a SpamCop.net e-mail account. However, this list has also been made available for use by others. It is this use by others that has impacted you, due to the spew being seen from the ISP that you're using to send e-mail from.

Start with the "Why am I Blocked?" entry. Then ask a specific question.

Been there, done that .. you are way late to the game .... as a "reporter" you should know how to do research ... try looking up SpamHaus ... they are even more famous that SpamCop, but I get the feeling you've never heard of them either ..???

I have no idea where you pulled the number "3" from .... the SpamCop FAQ here has an entry to "What is on the List?"

A "web server" is rarely also an "e-mail server"

Slagging you off, yet spending way too much time typing up a reply, doing the research, providing you with data ...???? Something wrong with that picture .... and just so you know, I am strictly volunteer here ...

Don't know what to tell you then. One ISP shouldn't be allowing spammers to commandeer their e-mail servers. One ISP has decided to ignore SpamCop.net recommendations to not use the SpamCopDNSBL in a blocking fashion. You are in the middle. You have apparently placed way too much trust in handling business affairs with a communications vehicle that is famous for things going wrong .... a backhoe cutting a cable here, a fire melting wires there, a storm knocking a datacenter off-line, a disk drive failing somewhere, etc. etc. etc. Have you a written guarantee from anyone that says "your e-mail will go through, no matter what!" ????

I'm not telling you to do anything. Only pointing out that your perception of what SpamCop.net is, how the SpamCopDNSBL works, and the way e-mail travels around the 'net' is flawed. Suggestions and data have been provided, that's all .... As you are using a "shared" server, you are at the mercy of all the other users also using that same server ... and the "blocking action" you are complaining about will only happen if/when you attempt to send e-mail to an ISP that has chosen to use the SpamCopDNSBL in a "blocking fashion" .. this is not a universal condition ...

If you are a reporter, then think about this: There are two people in an email transacation. One is the sender and one is the receiver. spam causes the receiver time and money to sort it, scan it, delete it. Even then sometimes legitimate email is missed and deleted by error. spam can only be controlled by the sending end. Some internet service providers are proactive and stop spam before it leaves the sending end. Others are irresponsible or incompetent so spam continues. Why should not the sender of spam be the one to take time and money to find a responsible, competent email service provider rather than the receiver? Of course, there are always errors so that if the sender talks to his email service provider, the problem may be fixed immediately. If not, then it is the sender who can make his email safe for the receiver to receive.

There are various ways of filtering spam. However, blocklists are the natural, mannerly way of controlling spam on the internet. Especially blocklists that return a message explaining that the sender is using an IP address that is sending large amounts of spam to innocent people. The person who really can do something is notified.

I recently sent an email from my home email address to my work email address. I have my work email address email popped to an OE account. When I got to work, there was no email. After determining that I really had sent it to the correct address (which took time), I finally discovered in the spam folder on the webmail. I could not find out from the webmail provider why they had determined it was spam (more time). I called my email service provider and they said that they were unaware of any blocklists. (more time) I checked for myself and my IP address was not on any blocklists. (more time) Now I wonder what caused that email to go to the spam folder? How many of my emails have not been delivered to other people? I have no way of knowing because I don't know why that email was sent to the spam folder when other emails have been delivered (including spam email). So, I had to spend a lot of time hunting for an email, trying to discover why it was not delivered, and now I am unsure that other emails were ever delivered to other people. I am not a spammer. I am an end user like yourself.

On the other hand, if I had received a message as you have, I would know what emails had not been delivered and why. I would have known exactly whom to contact to correct the problem. And I could select a competent, responsible email provider so that I could have reliable email.

Some people prefer to receive all email and have it tagged because of business reasons. They have determined that the time and money to sort it is worth it. Most end users don't want to spend time and money to sort spam. They would prefer to have their email service provider take care of it. I would. However, I want them to use blocklists so that my correspondents know that the email has not been accepted. I expect my correspondents to be upset that they are contributing to the spam problem by paying an email provider who is incompetent or irresponsible. I expect them to be upset to know that in order to receive an email from them, I also will be getting lots of spam. It is like asking me to accept dirty, greasy packages crawling with bugs whenever they send me a package by carrier.

In the interests of balanced reporting, you need to include my viewpoint in whatever you write.

Miss Betsy

For your infornation there are many spam reports by users in addition to spamtraps:


You might want to educate your ISP on why misdirected bounces are abusive and should be avoided.

Correct. YOU should be dealing with your ISP who has the server that is blocked because they allow spam to be sent from that server. You are not getting the services you are paying them for.

All of the messages below (and more) have been seen as spam by users and has been reported to the addresses listed below. Mail has also been seen leaving that server and going to addresses which have never been used to send email (spamtraps). Both of these are things your ISP needs to deal with before it is added to more blocklists.

Blocking SERVERS is the only way to do it because the sender address is easily forged (which is likely why there are spamtrap hits).

host 206.123.101.27 = server007.hostspectrum.com (cached)

Reporting addresses:
postmaster[at]kcquest.com
abuse[at]yipes.com


Report History: Removed as it was provided by dra007

Bottom line...the OP is an indirect victim of spammers and bad ISPs, but NOT of SpamCop. The server in question is spewing out all sorts of noxious crap, including not only UUBEs hitting spamtraps, but apparently also Nigerian scams. The website in question ought to be moved to a different provider who is doing a better job of controlling what goes out of their servers.

On a more general level, however, it would probably be helpful if someone at IronPort could be convinced to edit the text found at:

http://www.spamcop.net/bl.shtml

so that people going to that URL from within ISP-generated rejection messages would get a better picture of what's really going on. Especially problematic is this:



That sentence states that "SpamCop...use(s) the SCBL to block...unwanted email." That is incorrect. SpamCop doesn't block email, as we all know. Changing "block and filter" to "block or filter" would be more correct, but still not effectively communicate to puzzled users what's really going on. The page needs some work, and we, as active users/helpers ought to push IronPort into making some changes/additions there.

DT

Coincidentally, I just discovered two e-mails from Miss Betsy this morning in the spam folders of a GMail account ... not sent from a SpamCop.net account, not recived by a SpamCop.net account, and the SpamCopDNSBL was not in use ... but some e-mail that wasn't handled per "my wishes" ... the oddity that previous e-mail between us had worked just fine but something triggered a "spam" classification has no obvious clues as to how/why this happened either .....