Yahoo! Mailservers Blocklisted

[Paranoid2000]

I cannot send emails to my wife because apparently the ISP that hosts her business email account uses SpamCop, and it is blocking Yahoo's mail servers and rejecting the emails.

I have sent these to Yahoo who says "it's not our fault!" and post a link to the Spamcop FAQ which says there is no way to have your server removed from the blacklist.

Well in this case it is their fault since they are not bothering to configure their server to stop bouncing emails to forged sender addresses. I include with my reports the following text "spam with forged sender address bounced to third party (see http://www.spamcop.net/fom-serve/cache/329.html#bounces and http://www.spamhaus.org/faq/answers.lasso?...20Spam%20Issues ) - actual source was..." so they cannot claim ignorance on this.

Of course, the key blame should lie on the spammers doing this - it is a deliberate attempt on their part to damage the credibility of blocklists like SpamCop and to try to discourage people from using them, which in turn should indicate how effective they are. However mail server administrators do need to adapt to these changes in tactics and Yahoo is (so far) refusing to do this, continuing to pollute the Internet with their bounces.

In this case, the best advice is to use another email provider who is more responsive and more responsible.

I think this policy is ridiculous. Millions of people use Yahoo; why blacklist the email server that passes the emails through?

Why should Yahoo be given special dispensation? If they serve millions of people then they should be more aware of the problems that misdirected bounces cause. SpamCop applies a higher threshold to known email servers before adding them to a blocklist so if Yahoo is present, it is because they are attracting more spam reports (I've sent a few).

Shouldn't the individuals' IP addresses be blacklisted? This is causing great headaches and is probably causing my wife customers as well.

If you mean the original spam source, then yes this should be blocklisted also - however if you view the Misdirected Bounces thread, you will see why this is not currently done by SpamCop.

Reporters can analyze bounces manually and add the originating ISP to the report, but this does require more time and expertise. Perhaps an interim solution for SpamCop would be to allow "experienced" reporters to flag reports as misdirected bounces and list the original IP address for blocklisting?

[Stan_qaz]

I would suggest you create a Yahoo e-mail account and use it for working with your Yahoo groups.

Until Yahoo quits sending the spam they get on to innocent people they are going to keep getting blocked.

I reported a bunch of their abuse of my mail this morning. Why should I have to sort through their garbage when they decide dump it on me?

[smyers]

I own a list at Yahoo Groups and have wondered for a long time why emails I send to the list end up blacklisted by using SpamCop's blacklist. I use MailWasher and if my own address is not whitelisted (friends list), I see the email is blacklisted by SpamCop's list. I have not seen the list emails blacklisted when coming from another member. Maybe that's coincidence.

Having just looked at the logs for my Yahoo Groups list, I find that there are over 100 fake requests to be unsubscribed. These requests are fake as there are no such members on my list and the addresses are obviously fake. My Yahoo Groups list is not publicized, so I'm also wondering how anyone outside my mailing list got the list address and the method with which to request removal. I suppose that someone whose computer was compromised could have leaked out my list address but that doesn't explain how the list keeps getting reported to SpamCop as a source of spam - unless you're right that it's the Yahoo outgoing email server IP that's really being blacklisted. I have asked my list members several times if any of them have reported the list emails as spam and apparently none of them have.

Do any of you have ideas as to how I could be getting so many fake unsubscribe requests? I give this info and ask this question because I think the folks at SpamCop should know what is happening. Maybe this information will help improve the situation with eliminating real spam and allowing legitimate email to get through.

Here's a portion of the unsubscribe requests listing. These fake requests started in May 2005 and are still ongoing. My list has never had many more than 20 members and none of the following addresses belong or belonged to any of them.

I hope that this information will help us get things back the way they should be.

Mar 19, 2006 9:02 am bdryivchgnln[at]correo1.com Unsubscribe requested

Mar 24, 2006 6:00 pm dzgqohbh[at]ciberaula.infase.es Unsubscribe requested

Mar 25, 2006 12:10 pm dgqwjwiuu[at]malaysia.net Unsubscribe requested

Mar 28, 2006 5:00 pm pqmip[at]hotmail.com Unsubscribe requested

Mar 29, 2006 3:02 pm exenokv[at]yahoo.com Unsubscribe requested

Apr 1, 2006 5:57 am cfmahdtfb[at]yahoo.com Unsubscribe requested

Apr 1, 2006 12:47 pm cmuvwxdeee[at]poczta.onet.pl Unsubscribe requested

Apr 2, 2006 9:38 pm pogol[at]yahoo.com Unsubscribe requested

Apr 8, 2006 10:41 pm gcjrxech[at]hotmail.com Unsubscribe requested

Apr 9, 2006 6:28 am andrea.schalk[at]cl.cam.ac.uk Unsubscribe requested

Apr 9, 2006 7:39 pm edwagdhyknmpzn[at]lomondplant.co.uk Unsubscribe requested

Apr 11, 2006 7:31 pm jqrzuxtrox[at]copyservis.cz Unsubscribe requested

Apr 13, 2006 7:38 am vrzgbsevzzopjo[at]hotmail.com Unsubscribe requested

Apr 14, 2006 12:37 am nirwoadcxtlhyc[at]hotmail.com Unsubscribe requested

Apr 15, 2006 10:09 pm ublbbkxqjbphp[at]lavoixdunord.com Unsubscribe requested

Apr 18, 2006 11:14 am hsdswpjpu[at]unitedservices.ab.ca Unsubscribe requested

Apr 19, 2006 6:58 pm uymkemgodmh[at]hotmail.com Unsubscribe requested

Apr 23, 2006 4:34 am jmhavscnubd[at]hotmail.com Unsubscribe requested

Apr 27, 2006 3:12 pm zgojhs[at]hotmail.com Unsubscribe requested

Apr 28, 2006 7:26 am ykznqjvu[at]unipos.co.za Unsubscribe requested

Apr 30, 2006 4:41 am jkzvstaxdro[at]stridh.net Unsubscribe requested

Apr 30, 2006 5:15 am adie[at]cix.compulink.co.uk Unsubscribe requested

May 1, 2006 4:00 am fkjxj[at]yahoo.com Unsubscribe requested

May 4, 2006 4:21 pm nglog[at]yahoo.com Unsubscribe requested

May 6, 2006 4:19 am uptbueganmlbb[at]cskinetgw.cskb.csk.co.jp Unsubscribe requested

May 9, 2006 2:43 pm psabovvnququvh[at]yahoo.com Unsubscribe requested

May 12, 2006 2:28 am pnlubzqhrqr[at]graphice.com Unsubscribe requested

May 17, 2006 8:29 am cnqjcexjgpci[at]aplusbrokerage.com Unsubscribe requested

May 20, 2006 5:50 am ovpvdsimvldidk[at]tofi.de Unsubscribe requested

[smyers]

I realized something I forgot to add to my last post. I see the possibility that spam is what is going to my list's unsubscribe address from those fake addresses. If that is what's happening, I wonder if that would cause the ultimate listing on the SpamCop BL? I have no idea whether Yahoo uses the number of unsubscribe requests to determine whether a list is spamming but this seems possible.

If someone who is not a subscriber sends an email to my list address, it is bounced. Apparently, though, if someone sends an email to the unsubscribe address for the list, it goes through. That is something, I think, which Yahoo should change. That doesn't mean that I think Yahoo will ever do anything helpful to prevent spam. Yahoo's privacy statement is very clear about collecting and using personal information. Yahoo is a great site for spammers or anyone or any country wanting to be outside the law. Just think about the information that has been given to foreign countries lately from sites like Yahoo. I'd change to another list provider but I don't know of any others which are still free.

Again, hopefully this will help us all get to the bottom of what's happening and find some resolution.

[Paranoid2000]

Do any of you have ideas as to how I could be getting so many fake unsubscribe requests? I give this info and ask this question because I think the folks at SpamCop should know what is happening. Maybe this information will help improve the situation with eliminating real spam and allowing legitimate email to get through.

What is happening is that the unsubscribe email address for your group has been harvested, added to a spam list and is receiving spam with forged sender addresses. Yahoo returns its standard unsubscribe message to this forged address, meaning that a third party receives an unsubscribe email they never requested. This also happens with subscribe messages.

Unless Yahoo provides you with the option of only sending messages to group member email addresses, there is little you can do (aside from considering a move elsewhere). The proper fix is up to Yahoo to implement - either discarding all incoming emails where the sender address does not match the originating domain or by using a spam filter on incoming mail and discarding any that are flagged as spam.

[ChrisJordan]

My name is Chris Jordan and apparently I'm on the SpamCop blocklist. My email is chris_p_jordan[at]yahoo.com and upon sending an e-mail I get a Mailer Daemon message like this...

_____________________________________________________________________

Hi. This is the qmail-send program at yahoo.com.

I'm afraid I wasn't able to deliver your message to the following

addresses.

This is a permanent error; I've given up. Sorry it didn't work out.

<rachael[at]sandscostner.com>:

207.162.213.21 failed on DATA command.

Remote host said: 554 Blocked - see

http://www.spamcop.net/bl.shtml?206.190.58.187

--- Below this line is a copy of the message.

Return-Path: <chris_p_jordan[at]yahoo.com>

Received: (qmail 2413 invoked by uid 60001); 9 Jun 2006 04:25:46 -0000

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.com;

h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding;

b=YaAI0sh3XbzCWrM5GTEAwUsSanrIj06xbBcNWsIoFldz6hFWFX0/2jCMCl+V2YuiBk/Ve0EnogC3xvCh02gA

wPrxcCagY0lhTNLE99sQ06HKD75YAtwBqbVvKNoUX5TQZTWHawQjszi/VAO1xRQ0NNDCLQamkCOADKzxl

jgMLSc=

;

Message-ID: <20060609042546.2411.qmail[at]web55308.mail.re4.yahoo.com>

Received: from [131.191.91.139] by web55308.mail.re4.yahoo.com via

HTTP; Thu, 08 Jun 2006 21:25:46 PDT

Date: Thu, 8 Jun 2006 21:25:46 -0700 (PDT)

From: c jordan <chris_p_jordan[at]yahoo.com>

Subject: XXXXXXXXXXXXXXXXXXX

To: XXXXXXX[at]sandscostner.com

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="0-862608196-1149827146=:2214"

Content-Transfer-Encoding: 8bit

--0-862608196-1149827146=:2214

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: 8bit

___________________________________________________________

I think it's cause it gave me one of those squiggly letter//digit tests and I misread a lower case y for a capital Y. I have no clue how to find my own IP address or anything like that I just want myself off the list. As a graphic designer I need to stay in contact with clients and not being able to send them messages from my email address makes that a bit difficult.

This is the second time it's happened. The last time I was able to send an e-mail was about four days ago [June 4th]

Please if theres anything I can do to fix this problem I want to know how.

Chris

Moderator Edit: Fixed the loooong line stuff, moved/merged this "new" post into the last big Yahoo discussion. PM sent to advise of the move/merge.

[Miss Betsy]

apparently I'm on the SpamCop blocklist

You are not on the spamcop blocklist. The mail server at Yahoo that you were using is on the spamcop blocklist because Yahoo doesn't care whether it sends unsolicited emails or not. The emails could be coming from your computer without your knowledge if your computer is infected with a trojan, but probably are not since the Yahoo server is used by many Yahoo customers.

The IP address is the number in the message - 207.162.213.21 - that said what was blocked.

Basically if you are doing business on the internet, you need to choose an internet email service that pays attention to ways to control spam - not only to prevent it from coming into your inbox, but also to prevent it from leaving their servers.

Yahoo is not being a good neighbor on the internet. Complaints to Yahoo from their customers might change their practices.

You can set up a hotmail account (or another free account) to use to reach your customers when a Yahoo server gets on the blocklist if you don't want to go shopping for another email account.

Miss Betsy

[StevenUnderwood]

Some of the spams coming from that server:

Report History:

--------------------------------------------------------------------------------

Submitted: Thursday, June 08, 2006 4:08:48 PM -0400:

Hello.

1786051733 ( 206.190.58.187 ) To: spamcop[at]imaphost.com

1786051717 ( http://messenger.yahoo.com/ ) To: network-abuse[at]cc.yahoo-inc.com

1786051710 ( 206.190.58.187 ) To: network-abuse[at]cc.yahoo-inc.com

--------------------------------------------------------------------------------

Submitted: Wednesday, June 07, 2006 4:05:17 PM -0400:

I CRAVE YOUR INDULGENCE TO READ THIS MAIL

1784178790 ( 206.190.58.187 ) To: network-abuse[at]cc.yahoo-inc.com

--------------------------------------------------------------------------------

Submitted: Wednesday, June 07, 2006 10:41:27 AM -0400:

YOUR IMMEDIATE CONTRACT PAYMENT FINAL NOTIFICATION

1783746848 ( 206.190.58.187 ) To: network-abuse[at]cc.yahoo-inc.com

--------------------------------------------------------------------------------

Submitted: Wednesday, June 07, 2006 4:15:48 AM -0400:

I CRAVE YOUR INDULGENCE TO READ THIS MAIL

1783250457 ( 206.190.58.187 ) To: network-abuse[at]cc.yahoo-inc.com

--------------------------------------------------------------------------------

Submitted: Wednesday, June 07, 2006 4:03:16 AM -0400:

EXPECTING YOUR PROMPT REPLY

1783226254 ( 206.190.58.187 ) To: network-abuse[at]cc.yahoo-inc.com

--------------------------------------------------------------------------------

Submitted: Tuesday, June 06, 2006 10:34:25 PM -0400:

YOUR IMMEDIATE CONTRACT PAYMENT FINAL NOTIFICATION

1782815722 ( 206.190.58.187 ) To: network-abuse[at]cc.yahoo-inc.com

--------------------------------------------------------------------------------

Submitted: Tuesday, June 06, 2006 10:28:07 PM -0400:

PART-TIME JOB OFFER.

1782856694 ( 206.190.58.187 ) To: mole[at]devnull.spamcop.net

[ChrisJordan]

wow thats pretty sh**ty... thx betsy.

[psychoxl99]

I am a spamcop user, however this is actually a problem I am having trying to send email to somebody else who is also a spamcop user, apparently using one of spamcop's paid email addresses.

Basically, I cannot send email to this person from my Yahoo account. Yahoo seems to be consistently blocked because it is frequently used by spammers to send spam. However, this basically means that anybody who has a Yahoo account cannot send email to anybody who has a spamcop account. Obviously, this is a big problem.

What can be done about this?

Moderator Edit: This "new Post/Topic" was posted into the Reporting Help Forum section with the title of "spamcop blocking all Yahoo email" ..... As seen in the text above, there is nothing queried about a "reporting issue" .. the fact that a "spamcop user" would make the statement that "all e-mail is blocked" seems very odd, as all SpamCop.net documentation clearly talks about the identification of an IP address involved making it into the SpamCopDNSBL, and even SpamCop.net recommennds against using that list as a "blocking" tool .... then the text goes into making assumptions on "anyone with a "spamcop account" .. also seemingly ignoring that there is a "whitelist" configuration available .... on and on ...

Bottom line, this post is going to be merged into one of the "huge" existing Yahoo Discussions ....

PM will be sent to advise of this Move/Merge with the suggestion that the data already covered in that Discussion needs to be read ....

[turetzsr]

I am a spamcop user, however this is actually a problem I am having trying to send email to somebody else who is also a spamcop user, apparently using one of spamcop's paid email addresses.

Basically, I cannot send email to this person from my Yahoo account. Yahoo seems to be consistently blocked because it is frequently used by spammers to send spam. However, this basically means that anybody who has a Yahoo account cannot send email to anybody who has a spamcop account. Obviously, this is a big problem.

What can be done about this?

• Complain to Yahoo. Only the sender can stop spam.
  
• Get a free MSN or Hotmail e-mail account. Microsoft seems a good bit better at keeping spam from leaving their network.
  
• Get a SpamCop e-mail account.
  

[StevenUnderwood]

I am a spamcop user, however this is actually a problem I am having trying to send email to somebody else who is also a spamcop user, apparently using one of spamcop's paid email addresses.

Basically, I cannot send email to this person from my Yahoo account. Yahoo seems to be consistently blocked because it is frequently used by spammers to send spam. However, this basically means that anybody who has a Yahoo account cannot send email to anybody who has a spamcop account. Obviously, this is a big problem.

What can be done about this?

If you are getting a bounce, then the recipient is not using a spamcop paid email account. Spamcop's email account accepts all messages then sorts what it thinks to be spam into a Held Mail folder.

They may be using an account protected by the spamcop blocklist configured to bounce or reject. They could also be forwarding through a spamcop paid email account to another account which is bouncing the message.

What is the domain of the account you are trying to send to? Parse the bounce message and supply the trackingURL here (cancel the report first, please) so we can see what is going on.

[psychoxl99]

If you are getting a bounce, then the recipient is not using a spamcop paid email account. Spamcop's email account accepts all messages then sorts what it thinks to be spam into a Held Mail folder.

They may be using an account protected by the spamcop blocklist configured to bounce or reject. They could also be forwarding through a spamcop paid email account to another account which is bouncing the message.

What is the domain of the account you are trying to send to? Parse the bounce message and supply the trackingURL here (cancel the report first, please) so we can see what is going on.

Hi - thanks for being willing to help me. The domain of the account I am trying to send to is CambridgeVineyard.org, and the Tracking URL is http://www.spamcop.net/sc?id=z997062152zeb...2c2d0e8035d377z

(I removed the content of the email before submitting the message since it is confidential).

In the meantime I will sign up for a free hotmail account, but I would like it more if I could find a way around this blocking mechanism.

Thanks!

[turetzsr]

<snip>

the Tracking URL is http://www.spamcop.net/sc?id=z997062152zeb...2c2d0e8035d377z

<snip>

Hi!

...Thank you for providing this.

...From what I see there is no evidence of:

... trying to send email to somebody else who is also a spamcop user, apparently using one of spamcop's paid email addresses.

<snip>

...Can you explain why you believe that to be the case?

[Telarin]

Unfortunately, the only real way "around" this blocking mechanism would be for Yahoo! to either:

a ) Clean up the spammers using the service, which will not happen because it is free and there is no kind of verification to create an account.

b ) List the original IP address of the sender in the headers so that Spamcop can list the original source IP address instead of the Yahoo! servers. This would require minimal alterations to their software, but they do not seem to be terribly concerned about the quality of service that they offer, so I doubt this will happen either.

However, looking at what you posted, the actual rejection seems to be occuring at 216.120.244.254 which is mx4.hrnoc.net and matches the MX records for CambridgeVineyards.org itself. The mail admin for that network should be able to whitelist you so you can send. If he can whitelist by email address, that is by far the easiest way. If he can only whitelist by IP, then they will need to whitelist the entire Yahoo! mailserver block, as you never know which server your messages might decide to take.

edit: Actually, looking at those original headers, it looks like Yahoo! IS stamping the users IP address in a Received: from line. Someone want to fire an email upstream and see if they plan on trusting the Yahoo! mailservers enough to start listing the origin IPs instead of the Yahoo! mailserver?

[DavidT]

I hope I don't add any confusion to this issue, but in my recent experience, Yahoo's webmail headers are indeed working just fine with SpamCop, at least in terms of parsing out the actual sending IP, as opposed to blaming the Yahoo relay IP. Here's a tracking URL, for example:

http://www.spamcop.net/sc?id=z997077100z75...dca5e704253ce8z

That message is one that my wife sent to me from an "InfoPoint" center in Italy (a small cyber-café), but it wound up in my SC email account's Held Mail folder not because it came from Yahoo, but rather due to the actual IP source of the message, [213.140.17.106] (213-140-17-106.ip.fastwebnet.it), which appeared properly in the first Received header and which is still listed in the SCBL as I post this (it's been triggering SC spam traps, I think, and it's listed on a lot of other BLs...you can see that in a Multi-RBL lookup).

So, that seems to speak against what some others have written, doesn't it? I think there's still a problem with messages sent out from the "Yahoo!Groups" system...I just parsed one of them and instead of the sender's IP, it resolved to Yahoo, but I've just run some other personal Yahoo webmail messages through the parser, and each time, it identified the true IP source correctly....YMMV (but I'm not sure why).

DT

[etechsupport]

I would say that yahoo has very good spam tracking headers as you can make out source IP as well as computer name from the headers. Headers also make it clear whether the email was sent by some virus installed on the system but the only problem is that emails can be sent by scripts as my recent experience revealed that a active virus on a system can use logged in yahoo email account to send emails from backend.

Some sort of code verification has to be there all the time for users to read and fill the the code and then send the email.

Yahoo is good in moving emails to bulk mails folder if the originating email has come from a blacklisted source but yahoo in itself is not successful in stopping internal spamming.

There's huge difference in spam protection policies of free email service providers and ISP's

[LanceHaverkamp]

This Yahoogroups issue has been around for years. Yahoo is never going to do whatever you think they should. ISP's are unwilling to write custom whitelist rules. So all it accomplishes is pissing-off yahoogroups members (like me) who aren't receiving perfectly good mail.

Please stop taking spam complaints about yahoogroups!

Lance

Moderator Edit: merged this post and the following dialog into the ever-so-pipular existing Topic/Discussion on the same subject matter.

[StevenUnderwood]

This Yahoogroups issue has been around for years. Yahoo is never going to do whatever you think they should. ISP's are unwilling to write custom whitelist rules. So all it accomplishes is pissing-off yahoogroups members (like me) who aren't receiving perfectly good mail.

Please stop taking spam complaints about yahoogroups!

Lance

A spam report is a spam report. I have (many years ago) received spam from a yahoo group I had never signed up for. The blocklist is an automatic program that keeps lots of spam out of my inbox. I fully support its current working model.

[Merlyn]

This Yahoogroups issue has been around for years. Yahoo is never going to do whatever you think they should. ISP's are unwilling to write custom whitelist rules. So all it accomplishes is pissing-off yahoogroups members (like me) who aren't receiving perfectly good mail.

So if Yahoo is not going to take care of the problem then they should be blocked.

Please stop taking spam complaints about yahoogroups!

No!

[Miss Betsy]

This Yahoogroups issue has been around for years. Yahoo is never going to do whatever you think they should. ISP's are unwilling to write custom whitelist rules. So all it accomplishes is pissing-off yahoogroups members (like me) who aren't receiving perfectly good mail.

Please stop taking spam complaints about yahoogroups!

If you were not thinking only of yourself and courageless besides, then you would be attacking yahoo instead of spamcop. It is possible to change the minds of idiot corporations like yahoo. It only takes enough people to say they are idiots and giving bad service as well as polluting the internet.

You are part of the spam problem.

Miss Betsy

[dra007]

No (and no means no)!

[krisg]

Hi there

Firstly please forgive me if I posted this in the wrong place or am asking for very simple advice.

I am a Yahoo user and this week sent some work press releases out to the local paper and radio. Some emails got through but I've just received this message from 2 specific companies:

Connected to 195.188.221.110 but greeting failed.

Remote host said: 554 5.7.1 This message has been blocked because it is

from a RBL/ORDBL IP address.(connection black ip 217.12.10.199)

I'm not going to try again; this message has been in the queue too

long.

I'm not too skilled in this type of thing but I need to know why my message didn't reach the destination - has it been blocked? How can I get it unblocked.

Any help given would be really appreciated.

many thanks

kris

Moderator Edit: did the Merge into the existing monster Topic on the Yahoo e-mail servers.

[Derek T]

Any help given would be really appreciated.

First, there is no evidence that the blocklist used by the receiver is the Spamcop one. In fact the rejection message points to another blocklist altogether.

Second, there is an extremely long thread about Yahoo's servers on this forum: a moderator will be along in a minute to merge this ibto that, I suspect.

Third, Yahoo getting onto various blocklists is a long-standing problem that only they can solve: their servers are mis-configured so as notto identify the injection point of the spam that they relay - so their own servers keep getting listed.

The good news is that they have so many mail servers that unless you are very unlucky, next time you mail iit will go through a different, unlisted one.

hth

[krisg]

thanks so much for taking the time and trouble to reply to me.

do you know which blocklist the mail points to (i really have no idea about all this)?

I'll go and have a look at the Yahoo thread - thanks for the heads-up.

I can't tell you how much I appreciate the advice, what a top man.

many thanks

kris