Hello,

I start explaining my issue, On friday 3 Nov we got blacklisted in some lists, after check our network (we use NAT ip) we found a computer with a virus sending spam. We solve the problem and start the proccess to delisting in spamcop and others blacklists. But today i find that we are blacklisted again in spamcop and in other places, spamcop don't give any reports about the issue but in other lists the evidences that they showme about the new blacklisting reports mails with date 3 Nov. And my question is: Could i be blacklisted again in spamcop by old reports with date 3 Nov ? Because i read in faq that spamcop uses reports from the last 7 days, and them Was the One time delisting futile ? have I to wait until 10 Nov to be surely delisted?

Thanks in advance.

PD: Sorry for my bad english.

The only IP address known about at this time is your posting IP address. If this is the one in question, appearances are that you have not finished fixing the problem, so yes, you wasted the one-time opportunity for a quick de-listing from the SpamCopDNSBL.

http://spamcop.net/w3m?action=checkblock&a...p=213.201.63.68
213.201.63.68 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 16 hours.

Causes of listing
System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

Listing History
In the past 98.7 days, it has been listed 3 times for a total of 28 hours

http://www.senderbase.com/?searchBy=ipaddr...g=213.201.63.68
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.1 .. 916%
Last 30 days .. 2.6 ... -68%
Average ........ 3.1

Thanks for the quick response, i apreciate very much the data that you give me because it shows me that the issue wans't resolved, i will continue working in it.


When i wrote the first message i didn't put the ip affected because i don't come here to ask for a solution, only wants to know if is possible to get blacklisted again for reports happened before a delisting action, last week reports count to be blacklisted. Perhaps i didn't explained well my dudes.

But i very pleased with your attendace, thanks again.

In answer to your specific question, generally, no, you won't be listed for reports of spam sent prior to your delisting. Spamcop will only accept reports of spam received in the last 48 hours, and I believe once you delist, they don't count spam received prior to that delisting toward another listing, though it may lower your reputation and make it easier to get listed by spam received after the delisting.

Another data point: 1455 GMT -6
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.1 .. 920%
Last 30 days .. 2.6 ... -68%
Average ........ 3.1

Current at time of posting

Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 4.2 ... 1093%
Last 30 days 2.7 ... -66%
Average 3.1

As I see during yesterday and today it seems that mail traffic from my ip is growing slowly, but i'm checking strictly it through the firewall which manage the NAT and don't see any strange, i'm worried about this because our principal partner uses spamcop blacklist and they were blocking our mails. The issue, similar as Nov 3 Issue, which cause the re-blacklisting was solved and we are delisted again,the problem is that we have to give Internet access to a division of our company which don't have antivirus installed in their computers and my bosses don't let me to cut it. I'll see closely this affaire. Thanks again for the help.

Regards

Obviously we cannot say whether this division is the cause of your problem or even part of your problem. But, if your statement that they don't have anti-virus installed is true then there are many that would argue that they should not be allowed to connect to the Internet. Not having proper anti-virus protection and similar security installed is exceedingly irresponsible. Certainly this gives a greater chance of a PC being infected and spewing junk to everyone else.

Your bosses need to understand that they need to take a far better approach to security or your servers will continue to reside on many blocklists. Some are far harder to get off than the SCBL.

Andrew

Then traffic must be getting out that your firewall isn't seeing ...
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.3 .. 1425%
Last 30 days .. 2.7 .... -62%
Average ........ 3.1

Per the data suggested at SenderBase's "Magnitude" Explained this IP address is now seen as passing over 20,000 e-mails a day (and that's only what is seen by the 'connected' ISPs) .... is your boss or someone in charge of that 'other division' actually involved in sending out this much more increased traffic? Do you need to point your boss 'here' to see what's going on from the other side of the screen?