Jump to content


Photo

Please help! 210.0.235.98 has been listed again!


  • Please log in to reply
12 replies to this topic

#1 Goldencard

Goldencard

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 13 November 2005 - 10:32 PM

210.0.235.98 has been listed for three times. We called our ISP to solve the problem, we have been delisted for few days, but today we found we are listed again. I have read the FAQ already. But we didn't do anything that make ourselves listed. Is it because we are using share IP with others? Or any other reasons? Anything we can prevent to be listed again? Really annoying~

#2 StevenUnderwood

StevenUnderwood

    What Life?

  • Membersph
  • PipPipPipPipPipPip
  • 5,215 posts

Posted 13 November 2005 - 10:46 PM

210.0.235.98  has been listed for three times.  We called our ISP to solve the problem,  we have been delisted for few days, but today we found we are listed again.

View Post

Well, if you share that IP for outgoing email, your ISP has plenty of evidence to track down the source. Below are just the recent reports submitted by spamcop members. It is also possible that someone has an infected machine allowing spammers to use that machine to send their spew.

Report History:
--------------------------------------------------------------------------------
Submitted: Sunday, November 13, 2005 5:24:20 AM -0500:
Please Restore Your Account Access
--------------------------------------------------------------------------------
Submitted: Friday, November 11, 2005 1:47:27 PM -0500:
*** spam *** Account Information Needs To Be Updated
--------------------------------------------------------------------------------
Submitted: Thursday, November 10, 2005 9:12:11 PM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Thursday, November 10, 2005 1:07:12 AM -0500:
Account Information Needs To Be Updated
--------------------------------------------------------------------------------
Submitted: Thursday, November 10, 2005 1:07:12 AM -0500:
Account Information Needs To Be Updated
--------------------------------------------------------------------------------
Submitted: Wednesday, November 09, 2005 9:05:37 AM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Wednesday, November 09, 2005 1:14:29 AM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Monday, November 07, 2005 7:10:40 PM -0500:
Verify Your Account Information
--------------------------------------------------------------------------------
Submitted: Friday, November 04, 2005 3:56:02 AM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Submitted: Thursday, November 03, 2005 1:13:44 PM -0500:
Update Your Account Information
--------------------------------------------------------------------------------
Steven P. Underwood, DNRC
Whitinsville, MA
StevenPUnderwood[at]gmail.com

-No trees were killed in the sending of this message. However, a large number of electrons were terribly inconvenienced.-

#3 Jeff G.

Jeff G.

    T-shirt wearing out

  • Membersph
  • PipPipPipPipPip
  • 3,730 posts

Posted 13 November 2005 - 11:28 PM

If they were sent today, SpamCop Reports about hm3.hosting-mail.com [210.0.235.98] would be sent to (and have been sent to) Hutchison Whampoa Enterprises Limited's abuse[at]hgcbroadband.com - please contact that address and/or company to urge them to be more responsive and proactive in stopping the spam that has been coming from that server. Please also add to the woefully inadequate information at http://www.enom.com/...x=20&submit.y=4. Thanks!
Best Regards, Jeff G. (full signature)

#4 Wazoo

Wazoo

    What Life?

  • Forum Admin
  • 13,198 posts

Posted 14 November 2005 - 12:30 AM

210.0.235.98  has been listed for three times.  We called our ISP to solve the problem,  we have been delisted for few days, but today we found we are listed again.

Define "we" ....

I have read the FAQ already. But we didn't do anything that make ourselves listed.  Is it because we are using share IP with others? Or any other reasons?
Anything we can prevent to be listed again?  Really annoying~

View Post

One would think that you would know if you were running your own e-mail server, were paying for a dedicated e-mail server, or were simply using something provided as part of your user account with an ISP .... starting point for figuring that out would usually start with how much you are paying for this ISP's services.

http://www.spamcop.n...ip=210.0.235.98
currently shows that user complaints are the primary reason for a SpamCopDNSBL listing.

http://www.senderbas...ng=210.0.235.98 shows that SpamCop isn't the only BL this IP is listed in ....
Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day ........ 4.5 .. 2171%
Last 30 days .. 3.5 .... 131%
Average ........ 3.1

Noting the same scenario shown in so many other "why am I listed" posts in this Forum, there is an issue with that large increase in traffic ... however, back to "is this a shared server" ..????

http://forum.spamcop...?showtopic=4556 would suggest that the current traffic coming from the IP address is somewhere around 85 thousand e-mails a day (as compared to a developed average of maybe 2 thousand e-mails a day ... do these numbers match "your" outgoing e-mail loads? If not, then it would be an easy assumption that you are "sharing" that e-mail server with someone else. But then again, this should have already been discussed with your ISP ...????

If this your server, start checking your logs (e-mail, firewall, server, ...)
If this is your ISP's server, raise the complaint with them.

It's hard to guess at just "what" FAQ (entry) you've read .... It is seen that you apparently didn't read some of them developed "here" or read some of the "How to ..." items, else you'd have included more information in your original query .... For example, you say "we are blocked" ... yet, you don't provide any of the "blocked/error message data" . you then waffle a bit about knowing just exactly who the "we" might be (you or your ISP or something else) ... any of the (SpamCop) FAQs made available would have stated that it is the IP address that finds its way onto a BL, and its the use of that data/BL by the receiving ISP that may turn a BL listing into a Blocking action .... For example, you may send out 1,000 e-mails ... 200 of them hit an ISP that may be using the SpamCopDNSBL ... 160 of those ISPs have configured their systems to reject e-mail coming from an IP address found to be on the BL ..... 80 of those ISPs further chose to simply delete this e-mail, the remainder sending back an error message, of which only 60 make it past your ISP's incoming spam filters. And it's about these 60 messages that you then come in here and complain that "you are blocked" .....

How much of the above actually fits your situation, there's no way anyone on this side of the screen that can guess .... this is why the initial instructions on How to ask a question seem so extensive ... there's a lot of things in between you sending an e-mail and someone here trying to tell you why it was "blocked" .. most of those things are not controlled by anyone at SpamCop.net ....

#5 Goldencard

Goldencard

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 14 November 2005 - 01:53 AM

Thanks very much for your help. I have already raised the complaint to ISP. Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98 is in blocked list. Can anybody tell me why? Thank you. Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net --- Below this line is a copy of the message. Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000 Received: from unknown (HELO mike) (59.57.162.90) by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000 Message-ID: <000701c5e8e6$2b9c1aa0$0100a8c0[at]mike> MIME-Version: 1.0 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: quoted-printable X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal In-Reply-To:

#6 Jeff G.

Jeff G.

    T-shirt wearing out

  • Membersph
  • PipPipPipPipPip
  • 3,730 posts

Posted 14 November 2005 - 02:31 AM

That would be due to dns propagation delays. Please keep trying. Thanks!
Best Regards, Jeff G. (full signature)

#7 Farelf

Farelf

    What Life?

  • Membersph
  • PipPipPipPipPipPip
  • 6,828 posts

Posted 14 November 2005 - 02:47 AM

... Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.
Can anybody tell me why?  Thank you.
Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000
Received: from unknown (HELO mike) (59.57.162.90)
  by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000...

View Post

Could be several reasons, including exactly how the receiver is using the SCBL (and propogation delays as Jeff says) - whether it really is the SCBL doing the blocking (the message may be in error as to that detail), noting 210.0.235.98 is currently on the SORBS list and still showing a high level of activity (refer http://www.senderbas...35.98&showRBL=1 concerning both). "unknown (HELO mike) (59.57.162.90)" seems strange, its abuse address is abuse[at]fjdcb.fz.fj.cn and .cn is not noted for being at the forefront in the war on spam.

Edited by Farelf, 14 November 2005 - 02:49 AM.

Plus ca change, plus c'est la meme chose

#8 Jeff G.

Jeff G.

    T-shirt wearing out

  • Membersph
  • PipPipPipPipPip
  • 3,730 posts

Posted 14 November 2005 - 03:36 AM

"unknown (HELO mike) (59.57.162.90)" seems strange, its abuse address is abuse[at]fjdcb.fz.fj.cn and .cn is not noted for being at the forefront in the war on spam.

View Post

Please note that the entire 59.57.0.0/16 network (64K IP Addresses) for China's Fujian Province appears (along with many other networks) to be afflicted with lack of RDNS - Chinanet's Hostmasters are not "following the INSTRUCTIONS" per Section "INSTRUCTIONS - Adding a host - Add the reverse IN-ADDR entry" of RFC1033 "DOMAIN ADMINISTRATORS OPERATIONS GUIDE", to wit:
INSTRUCTIONS...
   Adding a host.

      To add a new host to your zone files:

         Edit the appropriate zone file for the domain the host is in.

         Add an entry for each address of the host.

         Optionally add CNAME, HINFO, WKS, and MX records.

         Add the reverse IN-ADDR entry for each host address in the
         appropriate zone files for each network the host i[s] on.

Best Regards, Jeff G. (full signature)

#9 Wazoo

Wazoo

    What Life?

  • Forum Admin
  • 13,198 posts

Posted 14 November 2005 - 02:54 PM

Thanks very much for your help. I have already raised the complaint to ISP.  Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.
Can anybody tell me why?  Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000
Received: from unknown (HELO mike) (59.57.162.90)
  by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000

Message-ID: <000701c5e8e6$2b9c1aa0$0100a8c0[at]mike>
MIME-Version: 1.0
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To:

View Post

I'm a bit confused. This Topic was started by asking about a SpamCopDNSBL listing of 210.0.235.98 .... but this last posting deals with an e-mail blocked that points back to 59.57.162.90 (which coincidentally matches another IP address showing for Moderators in this post) ...???? What's the connection between the two IP addresses? The immediate (and probably wrong, but based on the only data provided) assumption is that this e-mail was sent by other than an ISP's e-mail server and the receiving system has a configuration issue with pulling up the wrong error message based on the use of another BL, possibly one using a 'dial-up' list of IP blocks .....

#10 Jeff G.

Jeff G.

    T-shirt wearing out

  • Membersph
  • PipPipPipPipPip
  • 3,730 posts

Posted 14 November 2005 - 03:25 PM

It appears that the latest quoted data is a bounce from 210.0.235.98 (ns3.hosting-mail.com, which originally received the message from Goldencard's computer "mike" at 59.57.162.90) saying that ns3.hosting-mail.com couldn't deliver to the final destination (one of goldencard.net's mailservers mail.goldencard.net or relay.hosting-mail.com) because ns3.hosting-mail.com's IP Address 210.0.235.98 was still listed by the SCBL. That should no longer be the case, as ns3.hosting-mail.com's IP Address 210.0.235.98 was delisted by the SCBL over 13 hours ago.
Best Regards, Jeff G. (full signature)

#11 Wazoo

Wazoo

    What Life?

  • Forum Admin
  • 13,198 posts

Posted 14 November 2005 - 03:45 PM

All in how one defines "--- Below this line is a copy of the message." I guess. The "How to ..." stuff states that "we" would like to see the "rejection" notification rather than the e-mail that allegedly triggered a blocking action .... and I did caveat my remarks with "based on data provided" .... I read the "offered" e-mail as being a continuation of the "your e-mail was blocked" information, bot noting the suggested change in perspective to "here's the e-mail that was blocked" ....

#12 Jeff G.

Jeff G.

    T-shirt wearing out

  • Membersph
  • PipPipPipPipPip
  • 3,730 posts

Posted 26 March 2006 - 12:10 PM

Chinanet's Hostmasters are not "following the INSTRUCTIONS" per Section "INSTRUCTIONS - Adding a host - Add the reverse IN-ADDR entry" of RFC1033 "DOMAIN ADMINISTRATORS OPERATIONS GUIDE"

View Post

They are also not complying with "Every Internet-reachable host should have a name" and "Make sure your PTR and A records match" per Section 2.1 of RFC1912 Common DNS Operational and Configuration Errors.
Best Regards, Jeff G. (full signature)

#13 dbiel

dbiel

    Been There

  • Membersph
  • PipPipPipPip
  • 2,558 posts

Posted 26 March 2006 - 05:42 PM

Thanks very much for your help. I have already raised the complaint to ISP.  Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.
Can anybody tell me why?  Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

View Post

There are several possible reasons why this can happen.
1) Not all users of the SpamCop BL are using real time versions. Some use cached versions that may take some time to update, so even it an IP shows as not listed in the real time list, it may still appear in some of the cached lists that have not been updated.
2) Some mail rejectors use standardized replies that are not always accurate. They may state that a message was blocked due to the SpamCopBL when in reality it was blocked for some other reason.
3) The IP address may have been on the SpamCopBL at the time when the message was bounced, but had been removed prior to the sender checking the list.

I realize that this is not much help, but maybe it will explain differences between being on the list vs off the list.
This forum is a user support forum. The Moderators and Forum Admin are volunteers (not paid) and have no special direct relationship with SpamCop.net.
If you have been unable to receive the assistance you need here please see How To Contact SpamCop Staff
Thank you for your participation in our peer to peer, user based forums.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users