Sign in to follow this  
Followers 0
Wazoo

E-Mail spam submittals blocked by your ISP

87 posts in this topic

iinet.net.au (about to be) added to the list. Not a deliberate block but they apparently block outgoing using one or both of the same (IronPort & BrightMail) filters that are used by default for incoming mail.

Anything leaking through the filters should leak back out again when an attempt is made to report to SC but the filter rules are evidently updated frequently or incoming and outgoing are not necessarily synchronised but anyway the longer the interval between receipt and report the less likely it is for reporting to succeed and sometimes it just doesn't get through, no matter how short the gap. No NDNs are received, stuff just never arrives at SC or anywhere else.

I have seen it denied (by users) in Whirlpool that there are outgoing iinet filters per se but the proof of the pudding ... plus I have had it confirmed in email and 'phone discussions with iinet support staff at several levels.

Batching as opposed to single submissions makes no difference, copying in iinet staff addresses (suggested by support) doesn't work, even removing the headers (a test) doesn't work - though the IronPort filter would almost certainly include reputation scoring so presumably content filtering is part of the deal as well.

<vent>Australian providers are required to do certain things about spam:

... email service providers will address the sources of spam within their own networks, including actual spammers, misconfigured customer email servers and the virus-infected computers used to spread spam (known as ‘zombies’).
Pointing out to iinet that sweeping it under the carpet is possibly not meeting the spirit of the requirement (they should be enforcing their "CRA" - which is what they have instead of AUP/TOS) and even less so is interfering with those who are trying to do something a little more pro-active have thus far been countered with simulated incomprehension.

Indeed, why should they do otherwise? 99.9% of their customers are more than happy with the whole deal (including competitive pricing) and iinet's competitors are, assuredly, doing just the same (and the share/stock holders are, no doubt, delirious with joy). Needless to say my request to escalate the matter to the "product improvement" team have been met with blank silence.</vent>

Share this post


Link to post
Share on other sites

I send mail via my ISP's smarthost which is NTLWorld.com. I was a customer of NTL in the UK and they have been merged into Virgin Media.

I was having problems with email submissions, so I sent a copy of a virus report to a hotmail address and it didn't get through. I changed my setup to send emails directly to spamcop (i.e. not via my ISP) and email notification works again. So it seems that NTL/Virgin Media should also be added to the list of people deleting "spams".

Regards

NoSheds

[Edit - added, thanks - IIUC silent dropping may be indicative of IronPort device deployment, if so 'ironic' indeed]

Edited by Farelf

Share this post


Link to post
Share on other sites

Added WOW-WideOpenWest based on abrupt disappearance of batched submissions through that network (and restoration of the reporting path when re-routed through GMail) reported by user "Erik Ch. Ohrnberger" in News Groups:

Path: news.spamcop.net!not-for-mail

From: "Erik Ch. Ohrnberger" <x>

Newsgroups: spamcop.mail

Subject: Re: SpamCop reporting issues

Date: Tue, 24 Mar 2009 21:03:07 -0400

Organization: SpamCop

Message-ID: <gqbvsb$l0a$1[at]news.spamcop.net>

References: <gqau05$qmh$2[at]news.spamcop.net> <gqb4i7$k2k$1[at]news.spamcop.net>

Xref: news.spamcop.net spamcop.mail:22521

Farelf,

Thanks for your reply. Lots of good information in there.

I tried a test where I sent the spam reporting email with multiple

attachments through my GMail account, and this worked perfectly and cleanly.

I guess WOW has decided to spam check outbound email as well as inbound

email. Oh well. I don't think that I'll be able to convince them to

change their practices. I'm far from their ideal customer, as I have a

Linux mail server of my own dumping the outbound on their SMTP server to

deliver (Can't deliver it directly on my own, I keep triggering their zombie

spammer alert - but never mind that it's not one, their tools say it's one).

...

and
Path: news.spamcop.net!not-for-mail

From: "Erik Ch. Ohrnberger" <x>

Newsgroups: spamcop.mail

Subject: Re: SpamCop reporting issues

Date: Wed, 25 Mar 2009 11:01:28 -0400

Organization: SpamCop

Message-ID: <gqdjta$54e$1[at]news.spamcop.net>

References: <gqau05$qmh$2[at]news.spamcop.net> <gqb4i7$k2k$1[at]news.spamcop.net> <gqbvsb$l0a$1[at]news.spamcop.net>

Xref: news.spamcop.net spamcop.mail:22523

OK, job done.

I tweaked my macro so that it specifically uses my GMail account for sending

spam reports to spamcop, which doesn't block this type of spam reporting

email, so all is well and working again.

...

Thanks Erik :)

Share this post


Link to post
Share on other sites

I've just been reading all 8 pages in this topic, and it's, well, instructive to say the least. Some years ago I noticed that email forward-as-attachment submissions had become erratic: mst of the time they didn't reach SpamCop anymore. I tried subscribing to a couple of free mail service (yahoo.co.uk and gmail.com) and found out that I couldn't reach their SMTP servers. Experiment shows that any connection I try to make on ports 25 and 587 is blocked (doesn't get anywhere) except if it's addressed (on port 25 only) to relay.skynet.be or relay.belgacom.net (SMTP servers operated by my own ISP). This of course blocks direct-to-MX spam but AFAICT any outgoing mail detected as containing "spam" (even in an attachment) will be dropped on the floor. I can send various kinds of attachments including .jpg, .eml, plaintext, etc., provided, I suppose, that they don't look "spammy". My final reaction was to use the HTML form at www.spamcop.net, but since reporting huge lots of spam this way is not humanly possible, I report the spam latest first (on the assumption that the freshest spam is the most important to "catch in the act") and with a cut-off time (currently anything 8 hours old or more I move to Trash without reporting) for the same reasons. I don't know if there is a cause-and-effect relation or not, but now that I report only recent spam I've seen my spam amount go down spectacularly. Maybe the fact that I mostly use a From-line in [at]gmail.com (even though for the above reasons I send such mail through relay.skynet.be), and that Gmail's true-positives I neither count nor report, has something to do with this lowered spam count. The advantage of Gmail is that even though I normally get its mail by POP, there is also a webmail interface which includes a "spam" folder where I can reclaim any "false positives" and buttons (in spam and Trash, among others) which seem to contribute to Bayesian training of the spam filters on my account. OK, maybe this post may sound like a free ad for a competitor of the SC mail service, but the main point of this post was actually that I don't like (but haven't got the stamina to fight) the way Belgacom Skynet SA/NV of Belgium filters both incoming and outgoing email and also blocks all access to SMTP servers other than its own.

Note: Incoming spam at Belgacom Skynet I'm supposed to be able to filter or not to but it's all-or-nothing so for me it's "nothing": I prefer getting spam to losing any legit mail. No such setting for outgoing spam, "of course": I guess I'm just supposed to refrain from sending any, even in an .eml attachment addressed to SpamCop.

Share this post


Link to post
Share on other sites
...the main point of this post was actually that I don't like (but haven't got the stamina to fight) the way Belgacom Skynet SA/NV of Belgium filters both incoming and outgoing email and also blocks all access to SMTP servers other than its own.
I know how you feel Tony.

Thanks for the detailed situation report. I'm sure others will look at this topic in times to come and learn from it.

Share this post


Link to post
Share on other sites

Kimsufi is not listed in that list, yes it is very true, I have heard problems with spam from them, i.e. Many servers were canceled recently from resellers.

Share this post


Link to post
Share on other sites
Kimsufi is not listed in that list,

and still won't be at this point.

yes it is very true, I have heard problems with spam from them, i.e. Many servers were canceled recently from resellers.

"I have heard" doesn't quite equate to 'actual reality' ....

Not sure I follow the conection from "ISP blocking outgoing 'spam reports' " to the 'cancelled servers' action. Ratherm it more sounds like a proactive ISP/Host putting a stop to spam sourcing. But again, not enough specific data provided. in my opinion.

Share this post


Link to post
Share on other sites

sorry for question from newbie, last several month I reported spam as file attachments to e-mail submit.XxXxXxXxXxXxXxXx@spam.spamcop.net and received submittals, now I am sending spam and don't receive submittals - why? Does Spamcom request submittals every time? Or report spam without submittals? No errors about this received

Share this post


Link to post
Share on other sites

Slavoon4, There are two possibilities:

1) Your ISP/email host is looking at your submit emails and 'seeing' the word spam in the address/subject etc. or looking at the content and blocking your outgoing "spammy" email.

2) Your ISP/email host is looking at your incoming email from spamcop.net and thinking it is spam blocking the expected "submittals."

To know if 1) or 2) is happening, login to your reporting account.  If your submit emails are reaching SpamCop there will be a Notice to "Report Now" above the submit form. In that case 2) is true and you need to white list email from spamcop.net so they will not be blocked.

If your submit emails are not reaching SC you need to talk to your ISP so they do not block your emails.

Note I edited your post to remove you privet/unique 16 char email submitting account.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0