Why am I listed?

[sevenn]

How can I go about finding specifics as to why a server I administer, 205.161.0.2, is listed in spamcop? We're an ISP and don't do any sort of email marketing or (knowningly) allow any customers to either. Specifically, I would like the headers of any offending messages.

Thanks.

[turetzsr]

Hi, sevenn!

...Please try some of these to find answers to your questions:

• SpamCop - Help for spam report recipients
  
• Pinned: FAQ Entry: Why is my email blocked?
  
• SpamCop FAQ: How can I be de-listed
  
• Pinned: Why Am I Blocked FAQ
  

If you have any questions after perusing these, please do return here to post follow-ups.

[Chris Parker]

How can I go about finding specifics as to why a server I administer, 205.161.0.2, is listed in spamcop?  We're an ISP and don't do any sort of email marketing or (knowningly) allow any customers to either.  Specifically, I would like the headers of any offending messages.

I do not see anything obvious going on. Try sending an email to deputies <at> spamcop.net

[sevenn]

<in reply to turetzsr>

Thanks for the links, but I really don't see any information on obtaining a copy of the reports or offending email. When I lookup the ip address, I get the following:

Causes of listing

SpamCop users have reported system as a source of spam less than 10 times in the past week

If I don't know what activity caused it to be listed in the first place, I cannot stop that activity.

I've never run an open relay or proxy server.

[Miss Betsy]

There are spamcop web pages for ISPs that explain how to get reports sent to you. I don't know how to find them now, but I stumbled across them once.

Since the spammers started using information in the reports to evade the blocklist, the only way to see the cause is to get the reports sent to you (or if the hits are on a spamtrap, there are no reports, then you have to email the deputies who will tell you what the problem is - usually autoresponses to virus or an exploited machine).

Miss Betsy

[StevenUnderwood]

If you followed the TraceIP link, it would have told you that reports were sent to:

Reporting addresses:

abuse[at]sprint.net

You should check with them to determine what the reports state. If you own that IP space, you should also register an abuse address with abuse.net so you can get the reports directly.

[dra007]

Query bl.spamcop.net - 205.161.0.2

That is the first place to look! Then, maybe here:

Report on IP address: 205.161.0.2

....or here:

Multi DNSBL Lookup 205.161.0.2 http://openrbl.org/ip/205/161/0/2.htm

[sevenn]

Well, the IP is no longer listed. I've emailed deputies[at] dep_route[at] and abuse.net so maybe I'll receive the abuse reports in the future.

Thanks for the help.

[turetzsr]

<in reply to turetzsr>

Thanks for the links, but I really don't see any information on obtaining a copy of the reports or offending email.

<snip>

Hi, sevenn,

...Thanks for that feedback!

...Wazoo: do we have a pinned FAQ that tells admins to e-mail the deputies and gives the deputies e-mail address? If not, can you add one? ty

[Wazoo]

The Faq-0-Matic entry for ISPs starts at http://www.spamcop.net/fom-serve/cache/75.html .... and there are actually a couple of e-mail addresses in there that don't get referenced anywhere else, so that an ISP request for help should happen pretty quickly.

[turetzsr]

The Faq-0-Matic entry for ISPs starts at http://www.spamcop.net/fom-serve/cache/75.html ....  and there are actually a couple of e-mail addresses in there that don't get referenced anywhere else, so that an ISP request for help should happen pretty quickly.

...But nothing about asking the deputies....

[Miss Betsy]

IIUC, posters in the forum are encouraged to give the deputies address rather than the ones that people would have found if they had done what they should have done.

It might be a rough sorting technique. Those who follow the links probably know what they are doing and their problems can be handled quickly and easily. Those who can't follow links are going to take longer because they won't provide an IP address on the first email, they may have a long explanation about why they aren't relaying, etc.

IIUC, the deputies monitor all those email addresses.

Miss Betsy

[ESI]

I know that you get this question over and over, but I can't seem to find the answer on your site. Our IP address (69.2.241.19) has been listed with Spamcop (oddly just one day after we started using it ourselves).

I would really like to know how we got on the list so I can track down the offender and stop it. But there doesn't seem to be an easy way to do it. At least, I've read through all the FAQ's and the best that I've found is to wait a few days and it'll go away unless you receive another complaint.

Nevertheless, I hate spam and would really like to track down the reason that we're blacklisted. When I click on the link in the email that bounced, I gete taken to a page on your site that says you nevere give this information out. How can I root out the offender without some kind of information?

Thanks in advance.

-Jim

[Wazoo]

Actually, what shows at the page http://www.spamcop.net/w3m?action=checkblock&ip=69.2.241.19 is;

69.2.241.19 listed in bl.spamcop.net (127.0.0.2)

Causes of listing

System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

And, yes, this question is asked often, thus the Pinned FAQ in this Forum Why Am I Blocked? FAQ, Please read before posting

And of course, the many, many previously posted problems from way too many others that have found their way here, due to the same circumstances. The guidance you seek is even within this very Topic.

[ESI]

Thanks for your response. I read the FAQ at http://forum.spamcop.net/forums/index.php?showtopic=972 and it speaks in vague generalities. I also went to the http://www.spamcop.net/bl.shtml page and all it says is that two emails from our system were caught by Spamcop traps and that is why we are in the system.

Well, frankly, that doesn't help. I would like to see the header (if for no other reason so that I can see if it really originated from here with my own eyes), I would even like to see what's in the email and which of my customers sent it. Then, at least, I could tell them to stop doing it or inform them that they have a virus or whatever. Without more information, I can't make any changes so that it doesn't happen again.

What you are doing is taking my willingness to stop spam and tossing it away, therefore allowing more spam to happen. So far as I can tell, my only remedy is to wait 48 hours and hope that whatever the cause of the blacklisting was won't happen again.

-Jim

[StevenUnderwood]

You can email deputies<at>spamcop.net and they can look at the message and possibly give you a hint as to why it is there. They will not give you too much information however to keep the spamtrap address secret.

69.2.241.19 listed in bl.spamcop.net (127.0.0.2)

Causes of listing

System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

SpamCop users have reported system as a source of spam less than 10 times in the past week

This tells us that spamtraps have received some email from your IP address. These could be virus message bounces or NDR messages sent to a forged envelope address. They could also be actal spam sent to an address scraped from a web site.

It also says that there have been humans who have reported receiving messages from this IP address. THose reports would have gone to:abuse[at]eschelon.com and

postmaster[at]eschelon.com

There used to be a test about the "newness" of an IP but I'm not sure that is still in use.

Listing History

In the past 6.1 days, it has been listed 2 times for a total of 2.6 days

Other hosts in this "neighborhood" with spam reports

69.2.242.3

These lines say it has been on the block list already 2 times in 2.6 days which also means it either dropped off or was taken off by a deputy for some reason but then was reported again. It takes at least 2 human reports or 1 spamtrap report to get on the list. It would seem the IP went on the list Monday.

It also says there is another address owned by the same ISP that has also had reports filed. This can mean that the ISP is slow to act on the reports it receives.

Good luck. Please post with any further questions you have.

[turetzsr]

<snip>

And, yes, this question is asked often, thus the Pinned FAQ in this Forum Why Am I Blocked? FAQ, Please read before posting

And of course, the many, many previously posted problems from way too many others that have found their way here, due to the same circumstances.  The guidance you seek is even within this very Topic.

...Since the best answers to this question seem to be:

• e-mail about these spam went to <abuse address>
  
• e-mail the deputies at deputies <at> spamcop.net
  

please consider adding at least the last item (and an explanation as to why the information isn't readily available and thus the need to go to the deputies in the first place) to the "Why Am I Blocked" pinned FAQ. I believe that this will minimize the amount of frustration. ty

[Miss Betsy]

Actually that information is in John's explanation for people who run servers - along with excellent advice on how to diagnose and solve the problems that got them here. If they have read his explanation, then they really don't have to post unless they want help in how to fix the problem themselves. The only improvement would be to put his link before the standard spamcop link.

Individual users who are blocked should contact their ISP first. If they need help in getting information to convince their ISP to /do/ something, forum posters should be able to help them without emailing the deputies. The ISP should be the one emailing the deputies.

Miss Betsy

[turetzsr]

Actually that information is in John's explanation for people who run servers

<snip>

...Yes, I meant it should be in a FAQ directed to admins.

...Where is John's explanation? I must have missed seeing it....

[Miss Betsy]

For people who are operating servers:

Am I really listed in the SpamCop Blocklist?:

You can check the status of any server by entering its address at http://www.spamcop.net/bl.shtml. The reason an IP address is listed can also be obtained from that page.

Please also see:

How can I get removed from SpamCop's blocking system?

John's explanation at John's revised post, for Why Am I Blocked FAQ

Merlyn's explanation at FAQ Entry: Why is my email blocked?

I don't have time to find out how to get the URL in here, but that link goes to John's post.

Miss Betsy

[turetzsr]

For people who are operating servers:

Am I really listed in the SpamCop Blocklist?:

You can check the status of any server by entering its address at http://www.spamcop.net/bl.shtml. The reason an IP address is listed can also be obtained from that page.

Please also see:

How can I get removed from SpamCop's blocking system?

John's explanation at John's revised post, for Why Am I Blocked FAQ

Merlyn's explanation at FAQ Entry: Why is my email blocked?

I don't have time to find out how to get the URL in here, but that link goes to John's post.

Miss Betsy

...Thanks, Miss Betsy.

...That link is http://forum.spamcop.net/forums/index.php?showtopic=673.

...No mention whatever of the deputies e-mail address until right near the end.

...Again, I ask that the deputies e-mail address be added to a pinned FAQ whose contents are directed to server admins. Perhaps I should clarify: I ask that the deputies e-mail address be added directly to the contents of a pinned FAQ whose contents are directed to server admins, where the likelihood of its being seen is much higher than it is now. TY.

[Miss Betsy]

If server admins follow the links on a spamcop report, they will know how to contact the deputies. If it is a spamtrap situation and this is the first time that they have encountered spamcop, then if they can't figure out how to get to the ISP page, they are probably better off reading John's post /before/ they email the deputies or posting here. I doubt very much if the deputies have any time to be handholding someone through all the steps of finding out what is wrong the way that volunteers do.

There are a number of server admins who just jump in the forum without reading, and are savvy enough to give enough information for someone to give them a hint and they are generally grateful and that's fine. Even if, sometimes, the only help is to tell them to email the deputies since the only thing they need to know is something a deputy knows.

As you can see I don't have a whole lot of patience with people who are supposedly professional acting unprofessionally. Spamcop is horrible for a non technically fluent person to navigate and, perhaps, it is just as bad for the techies. I can't speak for them. However, some of them seem to do just fine.

I also don't know what the spamcop policy is on help for admins. The spamcop reporting help policy was, at one time, the newsgroups. The forum was added because too many technically non-fluent didn't understand how to access a newsgroup. The deputies are for the technical problems that posters don't have access to.

If the spamcop policy is for server admins to talk to a spamcop employee, then I agree, the deputies email address should be the very first thing posted and all posts by other than deputies discouraged.

Actually, IMHO, the server admins should be directed to the newsgroups. There are many more posters there who have experience with servers and can give good advice and help troubleshoot.

Miss Betsy

[turetzsr]

...What I'm trying to avoid is:

Hi, sevenn!

...Please try some of these to find answers to your questions:

• SpamCop - Help for spam report recipients
  
• Pinned: FAQ Entry: Why is my email blocked?
  
• SpamCop FAQ: How can I be de-listed
  
• Pinned: Why Am I Blocked FAQ
  

  If you have any questions after perusing these, please do return here to post follow-ups.

followed by

<in reply to turetzsr>

Thanks for the links, but I really don't see any information on obtaining a copy of the reports or offending email.  When I lookup the ip address, I get the following:

Causes of listing

SpamCop users have reported system as a source of spam less than 10 times in the past week

If I don't know what activity caused it to be listed in the first place, I cannot stop that activity. 

I've never run an open relay or proxy server.

followed by

There are spamcop web pages for ISPs that explain how to get reports sent to you.  I don't know how to find them now, but I stumbled across them once.

Since the spammers started using information in the reports to evade the blocklist, the only way to see the cause is to get the reports sent to you (or if the hits are on a spamtrap, there are no reports, then you have to email the deputies [emphasis mine] who will tell you what the problem is - usually autoresponses to virus or an exploited machine).

Miss Betsy

followed by

Well, the IP is no longer listed.  I've emailed deputies[at] dep_route[at] and abuse.net so maybe I'll receive the abuse reports in the future.

Thanks for the help.

and

You can email deputies<at>spamcop.net and they can look at the message and possibly give you a hint as to why it is there.<snip>

...If one of the posts to which I provided links in my original reply had mention of e-mailing deputies <at > spamcop.net, the OP would have known what to do right away without all the intervening and possibly confusing and frustrating discussion, saving everyone a lot of time and effort.

[Miss Betsy]

And my point is that he didn't read the links 'for information' - he read them to find a way to look at the offending email because the information is there in John's link.

Which is why I probably didn't say 'email the deputies [at] this address' - the way I do other times. Even after all that, he still doesn't know that if the spam hits a spamtrap, he won't get a report. There is only so much one can do to give advice.

OTOH, since spamtraps don't send reports and only deputies can see what is there, I did suggest that the deputy address be added somewhere before the link for spamtraps. As you know nothing has been done and that thread never went anywhere with practical suggestions.

Miss Betsy