SpamCop Discussion > Blacklisted - another Wanadoo customer

Full Version: Blacklisted - another Wanadoo customer

SpamCop Discussion > Discussions & Observations > SpamCop Blocklist Help

wineraks

Sep 20 2006, 04:51 AM

I'm not a user of spamcop but my domain name & IP address is being used by a spammer as the "address from" in mails. I'm getting the usual bounced mails back to my catchall account which has now being going on for several months. This I can deal with.

What has now happened is that the IP address has been blacklisted by spamcop & I am having trouble sending genuine emails to folk who use spamcop.

I've reported this to my provider, & am waiting on their reply.

Can anyone suggest anything that I can do to sort this out.

Thanks

Mike

StevenUnderwood

Sep 20 2006, 05:33 AM

QUOTE(wineraks @ Sep 20 2006, 05:51 AM)

Please reveal the IP address you believe is listed so we can investigate. Your charge that a spammer is forging your IP address in spam is serious and we want toget the parser fixed if it is true. Usually turns out that your server IP address has a virus or related problem.

wineraks

Sep 20 2006, 05:37 AM

Hi Steven

The IP address is 193.252.22.157

If you could investigate that would be great. I've no truck with spamcop, you obviously do a decent job, I just want to find a workable solution

Cheers
Mike

StevenUnderwood

Sep 20 2006, 05:50 AM

QUOTE(wineraks @ Sep 20 2006, 06:37 AM)

The IP address is 193.252.22.157

If you could investigate that would be great. I've no truck with spamcop, you obviously do a decent job, I just want to find a workable solution

Thank you. That is a Wanadoo IP address. Ip you search for Wanadoo here, you will find lots of examples of their problems. Since it is not your IP address (unless you are Wanadoo support) there is not going to be much you can do. Many have tried to educate Wanadoo what they are doing to the internet community. They are doing the very same thing that is causing you to receive so many misdirected bounces to invalid addresses, some of them being spamtrap addresses.

Causes of listing
System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
SpamCop users have reported system as a source of spam about 90 times in the past week
It appears this listing is caused by misdirected bounces. We have a FAQ which covers this topic: Why auto-responses are bad (Misdirected bounces). Please read this FAQ and heed the advice contained in it.

THe examples of spam coming from that IP address recently...

CODE

Report History: 
--------------------------------------------------
Submitted: Wednesday, September 20, 2006 5:32:19 AM -0400: 
Undelivered Mail Returned to Sender 
1929736041 ( 193.252.22.157 ) To: abuse[at]francetelecom.com 
1929736040 ( 193.252.22.157 ) To: abuse#fsmail.net[at]devnull.spamcop.net 
1929736035 ( 193.252.22.157 ) To: abuse[at]wanadoo.fr 
1929736034 ( 193.252.22.157 ) To: abuse[at]uk.wanadoo.com 
1929736028 ( 193.252.22.157 ) To: abuse#freeserve.com[at]devnull.spamcop.net 
1929736022 ( 193.252.22.157 ) To: postmaster#fsmail.net[at]devnull.spamcop.net 

--------------------------------------------------
Submitted: Wednesday, September 20, 2006 3:58:32 AM -0400: 
YOU HAVE WON!!CONTACT OUR CLAIMS OFFICER 
1929610637 ( 193.252.22.157 ) To: spamcop[at]imaphost.com 
1929610626 ( 193.252.22.157 ) To: abuse[at]francetelecom.com 
1929610623 ( 193.252.22.157 ) To: abuse#fsmail.net[at]devnull.spamcop.net 
1929610618 ( 193.252.22.157 ) To: abuse[at]wanadoo.fr 
1929610616 ( 193.252.22.157 ) To: abuse[at]uk.wanadoo.com 
1929610613 ( 193.252.22.157 ) To: abuse#freeserve.com[at]devnull.spamcop.net 
1929610610 ( 193.252.22.157 ) To: postmaster#fsmail.net[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 2:27:50 AM -0400: 
NOTIFICATION OF FINAL RESULTS / VERIFICATION FORM 
1929504352 ( 193.252.22.157 ) To: abuse#fsmail.net[at]devnull.spamcop.net 
1929504344 ( 193.252.22.157 ) To: abuse[at]wanadoo.fr 
1929504337 ( 193.252.22.157 ) To: abuse[at]francetelecom.com 
1929504327 ( 193.252.22.157 ) To: abuse[at]uk.wanadoo.com 
1929504319 ( 193.252.22.157 ) To: postmaster#fsmail.net[at]devnull.spamcop.net 
1929504300 ( 193.252.22.157 ) To: abuse#freeserve.com[at]devnull.spamcop.net 

--------------------------------------------------
Submitted: Wednesday, September 20, 2006 1:18:20 AM -0400: 
REF No: UKNL-L/200-26937 
1929406464 ( 193.252.22.157 ) To: spamcop[at]imaphost.com 
1929406459 ( 193.252.22.157 ) To: abuse[at]francetelecom.com 
1929406455 ( 193.252.22.157 ) To: abuse#fsmail.net[at]devnull.spamcop.net 
1929406448 ( 193.252.22.157 ) To: abuse[at]wanadoo.fr 
1929406440 ( 193.252.22.157 ) To: abuse[at]uk.wanadoo.com 
1929406436 ( 193.252.22.157 ) To: abuse#freeserve.com[at]devnull.spamcop.net 
1929406433 ( 193.252.22.157 ) To: postmaster#fsmail.net[at]devnull.spamcop.net 

--------------------------------------------------
Submitted: Wednesday, September 20, 2006 12:51:10 AM -0400: 
HOPE THIS DAY FINDS YOU WELL. 
1929380347 ( 193.252.22.157 ) To: abuse[at]uk.wanadoo.com 
1929380344 ( 193.252.22.157 ) To: abuse#fsmail.net[at]devnull.spamcop.net 
1929380341 ( 193.252.22.157 ) To: abuse[at]francetelecom.com 
1929380340 ( 193.252.22.157 ) To: abuse#freeserve.com[at]devnull.spamcop.net 
1929380335 ( 193.252.22.157 ) To: abuse[at]wanadoo.fr 
1929380330 ( 193.252.22.157 ) To: postmaster#fsmail.net[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 12:45:55 AM -0400: 
=?UTF-8?Q?Euromillion_Loteria_Espa=C3=B1ol_International?= 
1929367330 ( 193.252.22.157 ) To: mole[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 12:44:00 AM -0400: 
Contact: Mr.Van Clapton. 
1929370035 ( 193.252.22.157 ) To: mole[at]devnull.spamcop.net 

------------------------------------------------
Submitted: Tuesday, September 19, 2006 9:53:14 PM -0400: 
REPRESENTATIVE NEEDED 
1929438544 ( 193.252.22.157 ) To: spamcop[at]imaphost.com 
1929438542 ( 193.252.22.157 ) To: abuse[at]francetelecom.com 
1929438541 ( 193.252.22.157 ) To: abuse#fsmail.net[at]devnull.spamcop.net 
1929438537 ( 193.252.22.157 ) To: abuse[at]wanadoo.fr 
1929438536 ( 193.252.22.157 ) To: abuse[at]uk.wanadoo.com 
1929438534 ( 193.252.22.157 ) To: abuse#freeserve.com[at]devnull.spamcop.net 
1929438529 ( 193.252.22.157 ) To: postmaster#fsmail.net[at]devnull.spamcop.net 

Report History: 

Don't Display UUBE

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 6:43:04 AM -0400: 
Undelivered Mail Returned to Sender 
1929804778 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

--------------------------------------------------
Submitted: Wednesday, September 20, 2006 5:32:19 AM -0400: 
Undelivered Mail Returned to Sender 
1929736041 ( 193.252.22.157 ) To: abuse[at]francetelecom.com 
1929736040 ( 193.252.22.157 ) To: abuse#fsmail.net[at]devnull.spamcop.net 
1929736035 ( 193.252.22.157 ) To: abuse[at]wanadoo.fr 
1929736034 ( 193.252.22.157 ) To: abuse[at]uk.wanadoo.com 
1929736028 ( 193.252.22.157 ) To: abuse#freeserve.com[at]devnull.spamcop.net 
1929736022 ( 193.252.22.157 ) To: postmaster#fsmail.net[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 5:23:09 AM -0400: 
Undelivered Mail Returned to Sender 
1929720085 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 5:10:18 AM -0400: 
Undelivered Mail Returned to Sender 
1929701943 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 5:01:11 AM -0400: 
Undelivered Mail Returned to Sender 
1929690951 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 4:57:46 AM -0400: 
Undelivered Mail Returned to Sender 
1929687866 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

--------------------------------------------------
Submitted: Wednesday, September 20, 2006 4:42:44 AM -0400: 
Undelivered Mail Returned to Sender 
1929669116 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

---------------------------------------------------
Submitted: Wednesday, September 20, 2006 4:40:44 AM -0400: 
Undelivered Mail Returned to Sender 
1929666272 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

--------------------------------------------------
Submitted: Wednesday, September 20, 2006 4:33:27 AM -0400: 
Undelivered Mail Returned to Sender 
1929656188 ( 193.252.22.157 ) ( UUBE ) To: uube[at]devnull.spamcop.net 

P.S. how do you shring the code box in this app?

wineraks

Sep 20 2006, 06:13 AM

QUOTE(StevenUnderwood @ Sep 20 2006, 05:50 AM)

? Sorry, you've lost me there with that last bit.

Cheers. From what you say it looks as though Wanadoo/Orange aren't going to be particularly helpful here, if indeed they respond to my complaint. Does this mean the only real solution is to change ISP?

Miss Betsy

Sep 20 2006, 06:31 AM

Just to clarify to Mike. The IP address you gave belongs to wanadoo. I gather from Mike's first post that this is his IP address. If he shares the IP address with other people, it is the other people who are 'bouncing' emails to other people's catchalls. If he doesn't share it, then he is accepting email and sending bounces, not only to other people's catchalls, but to spam traps. In other words, return paths can be forged (or spoofed), but IP addresses cannot be.

The email address in the return path which brings bounces to Mike's catchall has nothing to do with the IP address being listed by spamcop. Return path addresses are easily forged - which is why sending bounces to the return path is bad.

IP addresses that indicate who /received/ the email and the IP address it was received from should not be able to be forged. Subsequent IP addresses in the headers can be forged - that's the reason for spamcop. The parser is an automated way of reading headers and deciding which header after the received header actually sent the email. However, IIUC, forging IP addresses in the headers don't actually /make/ the email go to those addresses or have anything to do with how the email got to one's inbox. They are like comment lines in code - they don't do anything. So when the parser gets to a header line that doesn't do anything, the header line before that is the one that sent the email. (strictly a layman's explanation!)

Miss Betsy

wineraks

Sep 20 2006, 08:09 AM

Miss Betsy

I'm afraid much of your "layman's" explanation has gone over my head, layman junior here I guess.

The mails we receive have been bounced back to fictional addresses with our domain suffix, which we accept through our catchall. I don't know where they have originated from & the full headers don't give me anything I can understand. The bounces appear to be due to them going to unknown addresses, adresses with spamguards that bounce, & sometimes automated responses when user is absent. I'm guessing that more mails actually get through to their destinations showing us as the originator, & these are the ones being reported to spamcop.

I am not aware of our IP address being shared, but that could be the case. I have had a reply from my ISP but not really addressing the issue.

Mike

Telarin

Sep 20 2006, 08:27 AM

Ok, lets start with:
Is that IP address shared?
A quick nslookup gives me 193.252.22.157 = smtp2.wanadoo.co.uk
This sounds like the name of a wanadoo mail server to me, I would say with 99% certainty that this is a shared mail server, probably used by thousands of wanadoo customers.

Now, to clarify some points. You receiving misdirected bounces because a spammer spoofed your IP address, and your IP address being listed, are two seperate issues, and are most likely not related.

The list posted by Steven shows some samples of traffic seen from the IP address of your shared mail server. This piece of information (originating IP address) is the ONLY piece of a message which is not easily forgable, and is therefor the only piece of information on which spamcop can reply. It is trivial for a spammer to forge the from address, the supposed name of the mail server, times, etc. Only the IP address is reliable, so we can be certain that these messages are coming from the mail server you use, though you most likely have nothing to do with them, since this server is used by many customers.

Spamcop works off a point system, so a shared server like yours would have to send a lot more spam than a server used by a small company to get itself listed, there is really no excuse for the level of poor management required to get a server listed. Again, this is nothing you have direct control over, the problem is Wanadoo, so don't construe this as me griping at you personally.

You'll notice that many of the messages that Steven listed for us have the subject "Undelivered Mail Returned To Sender". This means that when Wanadoo's server receive a message they can't deliver, whether it be because the user doesn't exist, has a full mailbox, whatever, the server is happily accepting the mail, and then trying to send a "Sorry we couldn't deliver your message" message to whoever the email says it is from.

Unfortunately, as has been pointed out, most of these message are spam that uses a forged "FROM:" address, which means the "Undeliverable" notification, goes to whoever happens to actually own the forged address.

This is unacceptable behavior for a mailserver, as it simply turns spam into more spam with each one of these post-facto bounces.

The proper behavior is for the receiving mail server to decide if it can deliver the message while it is talking to the sending server, and if it can't, rejecting the message outright during the transaction. This makes the sending server responsible for delivering the NDR (Non-Delivery Response) to its user, and prevents the generation of a message to an innocent 3rd party.

Unfortunately, many ISPs are still stuck in the early 90s when spam was not really a significant problem, and these post-facto bounces were acceptable.

Now interestingly, you receiving a number of misdirected bounces yourself gives you a perfect example of how this type of configuration can cause a problem. I had a spammer use one of my addresses for what must have been a massive spam run one day, as I received somewhere in the neighborhood of 1000 of these misdirected bounces in a 24 hour period.

bobbear

Sep 20 2006, 08:40 AM

QUOTE(Telarin @ Sep 20 2006, 02:27 PM)

The proper behavior is for the receiving mail server to decide if it can deliver the message while it is talking to the sending server, and if it can't, rejecting the message outright during the transaction. This makes the sending server responsible for delivering the NDR (Non-Delivery Response) to its user, and prevents the generation of a message to an innocent 3rd party.

Yes, but what address does the sending server use for delivering its NDR?

wineraks

Sep 20 2006, 08:44 AM

Thanks for that Telarin/Will. I see what you are getting at & understand a bit more as to how it works. We have, some time ago, had a couple of these massive bursts of misdirected bounces as you describe, each lasting about 12-24 hours, then finishing. Now, however, we are getting about 200 a day, every day, without any let-up.

My real problem is that the activity is causing our IP address (which from what you say is probably shared) to be blacklisted with spamcop. this ahving the effect that at least 2 of our contacts cannot now receive emails from us.

We use webfusion as a mailserver (I think that's their role), are they to blame here, or is it Orange/Wanadoo as our ISP?

I am really after a way of working around this & try & find a solution, before more contacts become non-contactable. I'm no IT expert, just trying to muddle through while I make a living from selling wine.

Telarin

Sep 20 2006, 08:46 AM

QUOTE

Yes, but what address does the sending server use for delivering its NDR?

The sending server does not use an address for delivery of the NDR. Since it is the originating users server, it would deliver it directly to their mailbox without sending an SMTP message.

On the other hand, if the sending server is a trojanned machine, which is the source of the vast majority of spam, it simply ignores the failure and moves on to the next victim, so no NDR is generated at all (since there is nowhere for it to go anyway).

QUOTE

We use webfusion as a mailserver (I think that's their role), are they to blame here, or is it Orange/Wanadoo as our ISP?

It depends, do you use webfusion for both your incoming AND outgoing mailserver? Many people use a host for their incoming only, but use their ISPs outgoing mailserver. This appears to be the case in your situation, as the IP that is listed is a Wanadoo address. You might want to ask webfusion if you can set your mail program to use them as your outgoing (sending) server as well, that way you would not be at the mercy of Wanadoo's poor mailserver configuration practices.

wineraks

Sep 20 2006, 09:00 AM

QUOTE(Telarin @ Sep 20 2006, 08:46 AM)

Webfusion are our incoming server, & as you guessed our ISP is our outgoing one. That sounds like a good idea to see if we can change to webfusion for outgoing mail. Fingers crossed we can. Thanks very much for that.
Mike

Wazoo

Sep 20 2006, 09:01 AM

QUOTE(wineraks @ Sep 20 2006, 04:51 AM)

I'm not a user of spamcop but my domain name & IP address is being used by a spammer as the "address from" in mails.

Non-agreed to use of "your e-mail address" in this kind of e-mail is basically identified as "Forged From: / Reply-To addresses" The word "spoofing" has some basic technical definitions when talking about Internet traffic .... you have not made your case to show "spoofing" going on. No information you've yet supplied suggests that someone is hacking bits at the packet level to "spoof any IP address" ....

Item #1: this Topic was started in the "Reporting Help" Forum section. Now moverd to the Blocklist Help Forum.

Item #2: the Subject line has been changed, so as to not help in the spread of the mis-use of technical terms, thus confusing others coming in later ....

QUOTE

I'm getting the usual bounced mails back to my catchall account which has now being going on for several months. This I can deal with.

What has now happened is that the IP address has been blacklisted by spamcop & I am having trouble sending genuine emails to folk who use spamcop.

Your incomng spam is one subject matter area, the use of a catch-all account is another. A SpamCopDNSBL listing would be based on the spam/spew seen coming "from" an e-mail server, which is a subject all it's own.

If the IP address involved was "actually your IP address" .. then there just might be a connection between those three separate items. However, it appears that you are just a user of a large ISP's services, so you are not actually "in control" of any IP address involved.

I would suggest that if you want to get to the heart of the matter and understand what's actually happening, you're going to have to do some research, learn how e-mail works, learn how to read headers .... the SpamCop FAQ (links at the top of the page) is a start, the repeated stand-alone "Why am I Blocked?" entry tries to explain a lot, there is a Dictionary & Glossary provided for those techy words ... and of course, there's the numerous Topics / Discussions from folks that have been there before you ....

bobbear

Sep 20 2006, 09:29 AM

QUOTE(Telarin @ Sep 20 2006, 02:46 PM)

On the other hand, if the sending server is a trojanned machine, which is the source of the vast majority of spam, it simply ignores the failure and moves on to the next victim, so no NDR is generated at all (since there is nowhere for it to go anyway).

Thanks from me too for that helpful aside - I didn't know what happened in that common spam situation.

wineraks

Sep 20 2006, 09:30 AM

Believe me, I'm learning fast here.

I now know that the IP address I've quoted is Orange/Wanadoo's mail server, over which I obviously have no control. Our own IP address is 62.136.41.218, which it appears is also on some blacklists, I know not why yet.

I agree we have 2 issues here. My incoming returned mail I can filter out by losing my catchall address & that will be addressed shortly. I realise that has nothing to do with the spamcop listing.

I have tried to change my outgoing server to webfusion, only to find orange/wanadoo have Port 25 blocked. Now I'm stumped again & do not know if there is anything else I can do.

I don't know what I have to do to prove spoofing is going on here, & I'm not sure if I need to. I'm just reporting on what I see & what the effects are. I appreciate your time on this btw, thanks.

Mike

Telarin

Sep 20 2006, 09:36 AM

Port 25 blocking is not terribly uncommon and there are several things you can do about it:

Call the ISP and ask if you can be unblocked as you need to send through your hosts SMTP server for business reasons. I've found the vast majority of ISPs that block port 25 have no problem opening it up at customer request.

Talk to webfusion and see if you can use something other than port 25. As port 25 blocking has become more common, it has also become more common for hosts to make another port available for their customers that experience this problem from their ISP.

wineraks

Sep 20 2006, 09:48 AM

QUOTE(Telarin @ Sep 20 2006, 09:36 AM)

Thanks again. I've mailed my ISP to ask for the port to be unblocked, & will see what happens there.
Mike

DavidT

Sep 20 2006, 09:53 AM

QUOTE(wineraks @ Sep 20 2006, 07:30 AM)

Our own IP address is 62.136.41.218, which it appears is also on some blacklists, I know not why yet.

I think that's actually the IP of your own connection to the Internet (dialup, broadband, or whatever), which is controlled by "energis.com" which is in turn under Wanadoo. If you look up that IP at Robtex (formerly RBLS):

http://www.robtex.com/rbls/62.136.41.218.html

Your IP is listed on mutiple "dynamic" blocking services, because lots of spam comes from dynamic (dialup and individual broadband connections) IP space. It's not good to transmit email directly from your PC's Internet connection to the mail servers of your recipients. It's better to go through intermediary servers which are designed for that purpose and are not listed on blocklists.

My ISP blocks port 25 for good reasons...if my computer were to become infected, it could initiate SMTP sessions to innocent third parties all over the world and send them spam or worms. So, I either allow my ISP to relay my outbound email through their mail servers, or I use an alternate SMTP port on the web servers associated with my other addresses, but those web servers are configured in such a way as to limit the sharing of IPs that transmit email, resulting in no blocklisting.

The better course of action is to route your mail through Webfusion, although it would be a good idea to get the IPs of their transmitting servers and have us run them through our SpamCop tools to see how clean they are. As long as your PC hands off to another *outbound* mail server before trying to deliver the mail to the servers that receive the mail, it shouldn't matter that your IP is listed on the various "dynamic (dialup) space" blacklists. The reason for those lists is so that *receiving* servers can check to see if they are being offered mail directly from a dynamic IP, but if you route your mail through a clean intermediary outbound server, you should be OK.

DT

StevenUnderwood

Sep 20 2006, 09:59 AM

QUOTE(wineraks @ Sep 20 2006, 09:44 AM)

My real problem is that the activity is causing our IP address (which from what you say is probably shared) to be blacklisted with spamcop. this ahving the effect that at least 2 of our contacts cannot now receive emails from us.

QUOTE(wineraks @ Sep 20 2006, 09:44 AM)

We use webfusion as a mailserver (I think that's their role), are they to blame here, or is it Orange/Wanadoo as our ISP?

The IP address you supplied (I assume from the error message) is a Wanadoo address. They are allowing misdirected bounces to be sent from that server.

QUOTE(wineraks @ Sep 20 2006, 09:44 AM)

I am really after a way of working around this & try & find a solution, before more contacts become non-contactable. I'm no IT expert, just trying to muddle through while I make a living from selling wine.

A work around is to get the receiving party to whitelist your address. That is, you are asking them to accept your messages and maybe all the other junk coming from your mail server. It is their right to say no. Then your only workaround is to find another way to send your email.

wineraks

Sep 20 2006, 10:11 AM

QUOTE(StevenUnderwood @ Sep 20 2006, 09:59 AM)

You receiving misdirected bounces at a catch all is NOT related to your IP address being listed. If wanadoo used a catch-all, they would not have this problem. The listing is because the server you listed (193.252.22.157 and maybe others) is SENDING misdirected bounces just like them. Perhaps a large part of your problem receiving those bounces is related to Wanadoo as well.

The IP address you supplied (I assume from the error message) is a Wanadoo address. They are allowing misdirected bounces to be sent from that server.
A work around is to get the receiving party to whitelist your address. That is, you are asking them to accept your messages and maybe all the other junk coming from your mail server. It is their right to say no. Then your only workaround is to find another way to send your email.

I realise the first two points, no worries there (apart from the fact it is happening). I've tried the latter with one contact who says they cannot (or maybe will not) & another contact is trying to do just that, though whether they will when they realise what other junk they will get I don't know.

It appears as though my best bet is to get all mail out through a different server.

DavidT

Sep 20 2006, 10:15 AM

QUOTE(wineraks @ Sep 20 2006, 08:11 AM)

It appears as though my best bet is to get all mail out through a different server.

Yes, and to reiterate the point, you don't want it being transmitted directly from your PC to the receiving servers of your recipients. The reason to have your ISP make an exception to outbound SMTP blocking would be if your webhost offers you access to their SMTP services and they can't offer you an alternate port. In many cases, an alternate port, such as 9925, can be used.

DT

DonX

Sep 24 2006, 05:41 PM

I am not certain if this is the correct forum to post in but my emails have been bouncing for a while now, ever since one of the ISP Wanadoo/Orange servers was added to the SpamCop blacklist. All my emails bounce straight back with the message:

"591 Your host [193.252.22.156] is blacklisted by bl.spamcop.net;
NOW PLEASE GO TO http://noc.zenon.net/rbl/ (in reply to RCPT TO command)"

I have checked at the webpage and the server is indeed blocked:
http://noc.zenon.net/pcgi/rbls-lookup.pl?IP=193.252.22.156
http://noc.zenon.net/pcgi/rbls-lookup.pl?IP=193.252.22.157

I also found an entry on the topic, titled 'Mail blocking blacklists', at this webpage if that is of any use:
http://technology.guardian.co.uk/weekly/st...1694488,00.html

I have emailed Orange/Wanadoo and Spamblock, without responce as yet, but just wanted to know if there was something else I should do to resolve this issue or someone I would need to contact? I really need to be able to send emails again as I rely on being able to stay in contact for my work.

Thank you.

Moderator Edit: merged this "new" post into an existing Topic/Discussion on the same subject, same IP address. PM not sent as the poster was "already here"

Wazoo

Sep 24 2006, 05:57 PM

QUOTE(DonX @ Sep 24 2006, 05:41 PM)

The word "all" is a bit extreme technically. SpamCop.net cannot block "any" of your e-mail .. any 'blocking action' would be done at a receiving ISP that chose to use the SpamCopDNSBL data in a blocking fashion, which is not a 100% scenario. All e-mail to that ISP, OK, it gets blocked. E-mail sent somewhere else, it's hard to say what happens, but ....

QUOTE

"591 Your host [193.252.22.156] is blacklisted by bl.spamcop.net;
NOW PLEASE GO TO http://noc.zenon.net/rbl/ (in reply to RCPT TO command)"

I have checked at the webpage and the server is indeed blocked:
http://noc.zenon.net/pcgi/rbls-lookup.pl?IP=193.252.22.156
http://noc.zenon.net/pcgi/rbls-lookup.pl?IP=193.252.22.157

Seems odd to cite the SpamCopDNSBL but send folks to some other page to check status ..????

QUOTE

I also found an entry on the topic, titled 'Mail blocking blacklists', at this webpage if that is of any use:
http://technology.guardian.co.uk/weekly/st...1694488,00.html

The question is, have you read / looked at the SpamCop.net FAQ 'here' ?????

QUOTE

I have emailed Orange/Wanadoo and Spamblock, without responce as yet, but just wanted to know if there was something else I should do to resolve this issue or someone I would need to contact? I really need to be able to send emails again as I rely on being able to stay in contact for my work.

See the data in the Topic this post was merged into, the countless other discussions that have preceded this one, the SpamCop.net FAQ, on and on ....

StevenUnderwood

Sep 24 2006, 08:43 PM

The link you should have been provided with: http://www.spamcop.net/bl.shtml?193.252.22.156

193.252.22.156 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 23 hours.

Causes of listing
System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
SpamCop users have reported system as a source of spam about 200 times in the past week
It appears this listing is caused by misdirected bounces. We have a FAQ which covers this topic: Why auto-responses are bad (Misdirected bounces). Please read this FAQ and heed the advice contained in it.

Farelf

Sep 24 2006, 09:13 PM

QUOTE(StevenUnderwood @ Sep 25 2006, 09:43 AM)

The link you should have been provided with ...

Noting there is a link on the Zenon.Net/Зенон Н.С.П. reference but it is not exactly obvious.

QUOTE(DonX @ Sep 25 2006, 06:41 AM)

... I really need to be able to send emails again as I rely on being able to stay in contact for my work.

We're not SpamCop staff so I hope you won't think it snide if I mention I personally keep this resource list to hand, for any emergency I may encounter - http://www.emailaddresses.com/email_web.htm Unfortunately a certain class of spammers likes using "free services" too - besides which it doesn't look very professional. As I say "For emergency."

A more satisfactory tack (considering urgency) - you may find that some or all of your key contacts can have you whitelisted at their end.

agsteele

Sep 25 2006, 03:15 AM

It is, perhaps, worth noting again that Orange/Wanadoo/Freeserve currently has a major problem passing on UUBE.

I suspect, but have no proof, that the problem is with a number of their customers. However, the failure of the ISP to tackle the problem means other, innocent, customers are feeling the effects.

I don't see any resolution since the continuing stream of junk via Orange is maintaining the SCBL listing.

As an aside, I see that: 193.252.22.156 listed in bl.spamcop.net (127.0.0.2)

* System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
* SpamCop users have reported system as a source of spam about 200 times in the past week

So the problem is not solely UUBE. I also see that this IP is listed in SORBS so the problems are only going to get worse for Orange/Wanadoo customers.

Andrew

NikkiM

Sep 25 2006, 05:02 AM

Hi

I keep getting messages when sending emails to a variety of contacts. Couple of typical return messages are shown below - please help I don't know what to do??!! I've spoken with Orange and they've told me to register my with SpamCop which I've done......

Please help me, thanks, Nikki

This is the SMTP Server program at host me.freeserve.com.

I'm sorry to have to inform you that your message could not be be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can delete your own text from the attached returned message.

The SMTP Server program

<v-jrowl[at]microsoft.com>: host mailc.microsoft.com[205.248.106.32] said: 550
5.7.1 Email rejected because 193.252.22.156 is listed by bl.spamcop.net.
Please see http://www.spamcop.net/bl.shtml for more information. If you
still need assistance contact gtsrbl23[at]microsoft.com (in reply to RCPT TO
command)
This is the SMTP Server program at host me.freeserve.com.

I'm sorry to have to inform you that your message could not be be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can delete your own text from the attached returned message.

The SMTP Server program

<Sue.Rowe[at]boyleandco.com>: host post2.cyberquest.co.uk[194.29.218.20] said: 451
Blocked - see http://www.spamcop.net/bl.shtml?193.252.22.157 (in reply to
RCPT TO command)

agsteele

Sep 25 2006, 05:13 AM

Hi Nikki!

You'll see a long correspondence about this issue immediately below this thread you started. I think the answers to your question will be there... http://forum.spamcop.net/forums/index.php?showtopic=7131

In fact I expect the moderators will merge your question with that set of answers.

Andrew

[done, Nikki PM'd]

StevenUnderwood

Sep 25 2006, 02:51 PM

QUOTE(NikkiM @ Sep 25 2006, 06:02 AM)

I've spoken with Orange and they've told me to register my with SpamCop which I've done......

Please speak with them again and tell them the problem is SERVER related and there is nothing the individual users can do to solve the problem.

Have them read this thread for the recent discussion about the problem, including proff they are sending misdirected bounces all over the internet.

http://forum.spamcop.net/forums/index.php?...ost&p=48048

Charles7001

Nov 7 2006, 05:10 PM

At least three of my friends with "freeserve" or "fs" email addresses sending email to me (a "onetel.net" address) are getting messages like this:

"[color=#000099]This is the SMTP Server program at host me.freeserve.com.

I'm sorry to have to inform you that your message could not be
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The SMTP Server program <********@onetel.net>: host mx.onetel.net.uk[212.67.121.123] said: 554
Service unavailable; Client host [193.252.22.157] blocked using bl.spamcop.net;
Blocked - see http://www.spamcop.net/bl.shtml?193.252.22.157 (in reply to
RCPT TO command)"

One friend has tried de-listing but to no avail. I asked OneTel if they are using SpamCop and they say no, so it seems neither I nor my friends can resolve this issue. Should I close my OneTel account and try another?

Telarin

Nov 7 2006, 05:19 PM

QUOTE

The SMTP Server program <********@onetel.net>: host mx.onetel.net.uk[212.67.121.123] said: 554
Service unavailable; Client host [193.252.22.157] blocked using bl.spamcop.net;
Blocked - see http://www.spamcop.net/bl.shtml?193.252.22.157 (in reply to
RCPT TO command)"

There are several ways to approach this problem.

First you can try to get Onetel to whitelist your friends, however, since they aren't even aware that they are using SpamCop (and according to this error, they are), that is unlikely.

The second and better approach would be to get your friends using Wanadoo to try convince their ISP to clean up their act so they can avoid being listed. However, given past responses from Wanadoo, this is unlikely to be successful as well.

It seems that your best solution would be to encourage your friends to find a more responsible provider, or to email you from a free hotmail or gmail account.

Wazoo

Nov 7 2006, 07:05 PM

QUOTE(Charles7001 @ Nov 7 2006, 04:10 PM)

At least three of my friends with "freeserve" or "fs" email addresses sending email to me (a "onetel.net" address) are getting messages like this:

Kind of ignoring the alleged issue with OneTel not having a clue .... but the main issue is the freeserve ISP ... and because of that, this "new" Topic is going to be merged with one of those monster discussions already in place about freeserve/orange/whatever ....

PM sent to advise of the new location ...

Farelf

Nov 7 2006, 07:32 PM

QUOTE(Charles7001 @ Nov 8 2006, 06:10 AM)

"This is the SMTP Server program at host me.freeserve.com.

I'm sorry to have to inform you that your message could not be
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The SMTP Server program <********@onetel.net>: host mx.onetel.net.uk[212.67.121.123] said: 554
Service unavailable; Client host [193.252.22.157] blocked using bl.spamcop.net;
Blocked - see http://www.spamcop.net/bl.shtml?193.252.22.157 (in reply to
RCPT TO command)"

OneTel isn't trying hard enough yet. Perhaps they mean that IP address is not listed right this moment but whatever they are doing is indistinguishable from giving you the run around. The blocking is not their "fault" - it is Wanadoo's for hosting spammers - but you have a right to competent advice and recognition of the problem, maybe an offer to set you up with whitelisting or something (an opportunity to charge you slightly more perhaps). Providers like OneTel using the SCBL in this way THEN denying it are not fighting spam, they are sweeping it under the carpet, hoping, it seems, not to be caught in the act. You should challenge their bland assertion with the evidence of that (full) bounce message and see what they can do off the back foot.

OneTel is not the "real" problem but neither have they been as helpful as they could be.

turetzsr

Nov 7 2006, 07:37 PM

QUOTE(Farelf @ Nov 7 2006, 07:32 PM)

<snip>
OneTel isn't trying hard enough yet. Perhaps they mean that IP address is not listed right this moment but whatever they are doing is indistinguishable from giving you the run around. The blocking is not their "fault" - it is Wanadoo's for hosting spammers - but you have a right to competent advice and recognition of the problem, maybe an offer to set you up with whitelisting or something (an opportunity to charge you slightly more perhaps). Providers like OneTel using the SCBL in this way THEN denying it
<snip>

...That may be the case: another possibility is that they are being disingenuous but truthful -- not using the SpamCop BL but configuring their rejection message to say that they are.
...Either way, they need a two-by-four "upside the head" (Wanadoo needs an eight-by-eight for the same purpose).

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.