tash Posted April 1, 2005 Share Posted April 1, 2005 Today I sent an e-mail and it came up as blacklisted at the other end (through a mailwasher filter). The mailwasher showed the message "origin blacklisted by spamcop" I use a simple hotmail address. When I came to the SpamCop website it said I must insert my IP address (192.168.0.77), I did this but the message "192.168.0.77 is not a routeable IP address" came back. I have read through all of the information, but can't seem to find a way to get myself off the list since my IP is not listed. I also sent an email via another 2 email addresses (one of which was hotmail) and they were ok. I can only imagine that hotmail has several servers and my email is on a server with a spammer.... :angry: Can anyone suggest what I can do? EDIT: I thought I should also mention that I never got a notification that I was being blacklisted. Link to comment Share on other sites More sharing options...
Jeff G. Posted April 1, 2005 Share Posted April 1, 2005 Can you post the entire bounce message? Please feel free to edit out any sensitive content. Thanks! Link to comment Share on other sites More sharing options...
turetzsr Posted April 1, 2005 Share Posted April 1, 2005 Hi, tash! ...On the home page of this forum, there is a link labeled Pinned: Why Am I Blocked? FAQ / Please read before posting. The link goes to a document that provides a lot of good information relevant to your question, under "Why Am I Blocked? Probable Causes." Note that it is divided into sections -- one labeled "For people who are operating servers:" and another labeled "The rest of this FAQ is for people who do not run servers." The first of these two will probably not be of much use to you but may be worth a quick look, anyway -- the second of these will be a good thing for you to read. ...It appears from what you posted that the e-mail provider of the person to whom you sent your e-mail is not providing enough information about why your e-mail was bounced. It isn't your IP address that matters but, rather, the IP address of the server through which your e-mail service provider is sending your e-mail. Link to comment Share on other sites More sharing options...
tash Posted April 2, 2005 Author Share Posted April 2, 2005 Unfortunately I didn't get a bounced message (I only know I'm blacklisted because the recipient was my dad, who has me on his friends/trusted list, so he informed me). However, just today I did get a bonced message from an e-mail Isent to somebody else... The email I got back is as follows: *** This message was automatically generated by the MailMax Error Responder *** Sorry, your message from <> to <__________[at]hotmail.com> could not be delivered. The specific error is: 503 Duplicate HELO/EHLO This is permanent error, and the message will not be retried any further. === The Original Message Follows === To: _________[at]hotmail.com From: "_______[at]monsum.net"<________[at]monsum.net> Date: Date: Sat, 02 Apr 2005 19:17:30 +0200 Subject: __________________ === End Original Message === *** This message was automatically generated by the MailMax Error Responder *** It didn't even display the original message content. Also the "To:" address was my e-mail rather than the person I sent it to... Maybe that is just something that happens when emails are bounced *feels dumb* Hopefully you can understand a bit more now. Thanks for the quick responses! Link to comment Share on other sites More sharing options...
petzl Posted April 2, 2005 Share Posted April 2, 2005 Can anyone suggest what I can do? EDIT: I thought I should also mention that I never got a notification that I was being blacklisted. 26191[/snapback] To find out your Computers IP Try this site MailWasher is not as good as a SpamCop Email account but it is probably the next best thing and has a whitelist facility, allowing suspicious email to be viewed in text only mode before being downloaded Your ISP IF competent and set up properly (meaning they should have a registered abuse[at] address and rDNS set) would be the one receiving abuse/spam reports SpamCop predominantly lists computers spewing spam to it's members Sorting List as the spam is being sent not after ( in a few seconds). When the spam stops the IP is released quickly as well. This effectivly sends a spam run (which takes hours) to Silicon hell (Bit Bin) for those smart enough to use SpamCop members SCBL. Meaning the spam run is mainly dumped before the spammer sends, So sending spam to a person who reports spam when its recieved, quickly blocks it before anyone else gets it. People are finding attack is the best form of defense against these criminals Link to comment Share on other sites More sharing options...
Wazoo Posted April 3, 2005 Share Posted April 3, 2005 Today I sent an e-mail and it came up as blacklisted at the other end (through a mailwasher filter). The mailwasher showed the message "origin blacklisted by spamcop" I use a simple hotmail address. Not stated, but was this e-mail actually sent from HotMail? When I came to the SpamCop website it said I must insert my IP address (192.168.0.77), I did this but the message "192.168.0.77 is not a routeable IP address" came back. That IP address indicates that the computer in question is on a network. I have read through all of the information, but can't seem to find a way to get myself off the list since my IP is not listed. As stated by others, in the FAQ, and in the concept of how e-mail works, inless you are running an e-mail server on this specific computer, the IP address of this specific computer is not an issue. As you've not provided much data to go on, here's what I can provide on what data I can glean .... Your posting here reflects an IP address that associates with leic-cache-6.server.ntli.net ... you registered here with a HotMail address, so I can only go with the posting IP for data. dns1.ntli.net reports the following MX records: 10 mailspool1-win.server.ntlworld.com 62.253.162.151 10 mailrelay3-win.server.ntli.net 62.253.161.75 62.253.161.75 not listed in bl.spamcop.net 62.253.162.151 not listed in bl.spamcop.net http://www.senderbase.org/?searchBy=ipaddr...=62.253.162.151 shows 46 other IP addresses used to send e-mail .. I'm not about to spend the time to search through those to see if one of these matches your problem IP .. again, what is needed is the identity of the e-mail server your e-mail is actually being sent from. (especially as you keep trying to point to a HotMail server) I also sent an email via another 2 email addresses (one of which was hotmail) and they were ok. I can only imagine that hotmail has several servers and my email is on a server with a spammer.... :angry: Can anyone suggest what I can do? Somehow, you need to show an e-mail that was blocked that shows the actual IP address of the outgoing server in question. EDIT: I thought I should also mention that I never got a notification that I was being blacklisted. Again, the FAQ would explain that it's the responsible party administrating the e-mail server in question that would normally receive reports. Unfortunately I didn't get a bounced message (I only know I'm blacklisted because the recipient was my dad, who has me on his friends/trusted list, so he informed me). In theory, if he's using these third-party tools, saw the 'blocked data' etc. .. he should be able to provide you the header data of that e-mail so then 'we' could analyze that data instead of spending all this time in the dark. However, just today I did get a bonced message from an e-mail Isent to somebody else... The email I got back is as follows: *** This message was automatically generated by the MailMax Error Responder *** I have no knowledge of "MailMax Error Responder" .... but if the actual output only contains the data you provided, it's pretty much useless for any analysis here. But will note that the data provided doesn't seem to include anything to do with SpamCop, and in fact identifies a completely different problem with your e-mail. One could guess that this error message came from monsum.net and you could perhaps try to contact them .. but again, it would seem more likely that you would have a copy of this outgoing e-mail sitting somewhere and perhaps there's some data to be fleaned from those headers (or not???) The catch is that there isn't enough good data here to go anywhere with trying to sort anything out. Worst case, send an e-mail from the 'account' that seems to be blocked to another of your own accounts, then provide the headers of that received e-mail ....then "we" would have something to actually work with. Link to comment Share on other sites More sharing options...
tash Posted April 3, 2005 Author Share Posted April 3, 2005 I'm very sorry... the reason I havn't given the data because I don't know most of the data myself. It seems that you need to be a computer genius to understand most of this stuff! and I am by no means a computer wizard, so please state things in the most basic way. We looked at that the list of IP addresses Wazoo found, and managed to find 82.8.231.162 listed on spamcop... several others are also listed on dynablock and/or clb.abuseat (but not spamcop): 82.8.237.159 - client-82-8-237-159.brnt.adsl.ntlworld.com 82.12.50.1 - client-82-12-50-1.brhm.adsl.ntlworld.com 82.12.58.171 - client-82-12-58-171.brhm.adsl.ntlworld.com 82.8.243.183 - client-82-8-243-183.brnt.adsl.ntlworld.com 82.18.211.251 - client-82-18-211-251.brnt.adsl.ntlworld.com 82.11.118.164 - client-82-11-118-164.glfd.adsl.ntlworld.com 82.11.98.163 - client-82-11-98-163.glfd.adsl.ntlworld.com This is not listed on spamcop when typed into the spamcop page, but when clicked on in the list, it appears as listed on spamcop. 82.12.59.42 - client-82-12-59-42.brhm.adsl.ntlworld.com 82.11.114.121 - client-82-11-114-121.glfd.adsl.ntlworld.com 82.8.225.157 - client-82-8-225-157.brnt.adsl.ntlworld.com 82.18.218.219 - client-82-18-218-219.brnt.adsl.ntlworld.com 82.11.108.161 - client-82-11-108-161.glfd.adsl.ntlworld.com 82.11.99.124 - client-82-11-99-124.glfd.adsl.ntlworld.com 82.11.109.123 - client-82-11-109-123.glfd.adsl.ntlworld.com 82.18.253.110 - client-82-18-253-110.brhm.adsl.ntlworld.com 82.8.240.171 - client-82-8-240-171.brnt.adsl.ntlworld.com 82.8.244.210 - client-82-8-244-210.brnt.adsl.ntlworld.com 82.8.230.83 - client-82-8-230-83.brnt.adsl.ntlworld.com 82.8.244.80 - client-82-8-244-80.brnt.adsl.ntlworld.com 82.11.111.121 - client-82-11-111-121.glfd.adsl.ntlworld.com 82.12.35.220 - client-82-12-35-220.brhm.adsl.ntlworld.com 82.12.45.2 - client-82-12-45-2.brhm.adsl.ntlworld.com 82.8.236.67 - client-82-8-236-67.brnt.adsl.ntlworld.com 82.11.104.19 - client-82-11-104-19.glfd.adsl.ntlworld.com As you may have noticed... these all start with client-____ in the hostname, the other host names on Wazoo's senderbase list were not listed on spamcop nor dynablock and began with someting other than client- . I don't know the relevence of this, if any. As Wazoo stated, I am networked to the internet via my dad's computer. But this is only whilst I study at home. In theory, once I am back at university, my hotmail address will no longer be affected?? However, now it seems that my dad will be listed on spamcop as a spammer if going via the 82.8.231.162 IP address? Is this correct? In summary, as we understand it , my emails can be sent via any one of the 46 IP addresses Wazoo found. Some of these are not listed as spammers, whilst others are. I can not influence the IP address selected - this is entirely within the control of my ISP (ntlworld). If my email is sent through an IP listed as a spammer, I am seen as a spammer and I may get bounced. Whereas if it is sent on an unlisted IP I will be fine.. basically it is the luck of the draw.. The only way to resolve this is to report it to NTLWORLD in the hope they will try and resolve it. Is this correct???? One last point of info. My dad is running an Apache web server but is NOT running an email server. I access the internet by networking to dad'd PC which has a cable modem. Link to comment Share on other sites More sharing options...
Miss Betsy Posted April 3, 2005 Share Posted April 3, 2005 If my email is sent through an IP listed as a spammer, I am seen as a spammer and I may get bounced. Whereas if it is sent on an unlisted IP I will be fine.. basically it is the luck of the draw.. The only way to resolve this is to report it to NTLWORLD in the hope they will try and resolve it. Is this correct???? I am technically non-fluent also, but I think the above is all correct except "I am seen as a spammer." 'The IP address is known to be sending spam' is correct. 'Those people who are non-spammers who are using that IP address are asked to talk to their ISP about giving reliable service and to find alternate ways of communicating while spam is coming from that IP address.' After all, you would not insist that your correspondents receive spam just so they can also receive an email from you! Miss Betsy Link to comment Share on other sites More sharing options...
Wazoo Posted April 3, 2005 Share Posted April 3, 2005 I'm very sorry... the reason I havn't given the data because I don't know most of the data myself. It seems that you need to be a computer genius to understand most of this stuff! and I am by no means a computer wizard, so please state things in the most basic way. Data placed into the FAQ is there to help. I've even added the "How to use ..." Forum section to try to get closer to "exposing" things. What it appears we are missing here would be (hopefully) covered ubn the FAQ entry "How to get full headers" .... or if one can assume that you are using Outlook Express, I know that there are a couple of entries in the "How to Use ...." "Reporting" section at present that go step by step. We looked at that the list of IP addresses Wazoo found, and managed to find 82.8.231.162 listed on spamcop... Again, this data may not have any connection to "you" .. just a quick scan on what data I could pull up. Again, the headers of one of these 'blocked' emils is what's needed. 82.11.98.163 - client-82-11-98-163.glfd.adsl.ntlworld.com This is not listed on spamcop when typed into the spamcop page, but when clicked on in the list, it appears as listed on spamcop. As you may have noticed... these all start with client-____ in the hostname, the other host names on Wazoo's senderbase list were not listed on spamcop nor dynablock and began with someting other than client- . I don't know the relevence of this, if any. I don't know ntlworld's business model, but a general guess is that all these IP addresses are associated with end-user connections via DSL ... and in that light, a large number of ISPs would block e-mail coming from them just for that reason (again, home users not normally "allowed" to run their own e-mail servers) But again, at this point, I've no knowledge of what the / your specific IP problem is yet. As Wazoo stated, I am networked to the internet via my dad's computer. But this is only whilst I study at home. In theory, once I am back at university, my hotmail address will no longer be affected?? However, now it seems that my dad will be listed on spamcop as a spammer if going via the 82.8.231.162 IP address? Is this correct? You keep saying "hotmail address" .... This whole discussion has been centered on trying to figure out the IP address involved. In the list you created, 82.11.98.163 is an IP address. (Again, you have yet to tie this IP to "you"... will also repeat that the previous "rejection" notice you offered listed a whole separate issue for rejection by some application other than use of the SpamCopFNSBL) In summary, as we understand it , my emails can be sent via any one of the 46 IP addresses Wazoo found. Doubtful ... usually "you" would be normally 'tied' to an e-mail server, possibly based on geographic .. and what one would like to think is that the IP address of that e-mail server would be one of the two IP's identifed as the MX systems in my last post. But again, that would be trying to guess at ntworld's configuration ... Some of these are not listed as spammers, whilst others are. I can not influence the IP address selected - this is entirely within the control of my ISP (ntlworld). If my email is sent through an IP listed as a spammer, I am seen as a spammer and I may get bounced. Whereas if it is sent on an unlisted IP I will be fine.. basically it is the luck of the draw.. The only way to resolve this is to report it to NTLWORLD in the hope they will try and resolve it. Is this correct???? No ... first of all, no one is identified as a spammer in the lists you're looking at. What is indicated is that spam spew has been seen coming from that IP address. As suggested before, the "Why am I Blocked" FAQ/Pinned entry attempts to explain this. Link to comment Share on other sites More sharing options...
tash Posted April 3, 2005 Author Share Posted April 3, 2005 Thankyou for the help you are giving me, I do appreciate it. I can't however give the information you require as my dad's mailwasher is failing to bounce it (it says "maybe forged address"). We have tried several times even uninstalling and reinstalling the mailwasher program. I have read and re-read the FAQ pages you have given me (and I did this before my original post aswell). Therefore I have not recieved any bounced/blocked messages to provide you all with. I have since emailed him again and had no warning from spamcop. So I will probably just leave the problem. It seems very minor at the moment anyway. Thankyou all for you time! Link to comment Share on other sites More sharing options...
Miss Betsy Posted April 3, 2005 Share Posted April 3, 2005 I don't know if you will read this, but apparently the only message you have gotten is that your dad's mailwasher program has tagged your email as possibly a spam based on the spamcop blocklist. Whatever you do, do NOT use the bounce function on your dad's mailwasher program. It creates emails to send to the From Address which is forged if it is a spam. Then other innocent people get unsolicited email from your dad. The mailwasher bounce function is NOT a way to find out where the email is coming from because mailwasher has to accept the email in order to filter it. The From and return path are usually forged by spammers so that the IP address is the only reliable way of telling where the email actually came from. The server that accepts (or rejects) the email knows the IP address. Otherwise it can be found in what are called 'headers' There are ways to view these headers, but it depends on what kind of email reader you are using. If this problem recurs, you should talk to NTLWorld and tell them that they are not providing you with reliable service, that your emails are being tagged as possible spam because of whatever IP address they have used to send your email. Miss Betsy Link to comment Share on other sites More sharing options...
Wazoo Posted April 3, 2005 Share Posted April 3, 2005 I have read and re-read the FAQ pages you have given me (and I did this before my original post aswell). Therefore I have not recieved any bounced/blocked messages to provide you all with. Previous suggestion was to e-mail from the 'blocked' account to another account ... then (using the data found within the FAQ or 'How to Use ...' Forum) provide the headers of that received e-mail. Then we would all know what IP is involved, possibly what the other ISP error/rejection message may have been complaining about, and maybe even why MailWasher is having an issue .... Link to comment Share on other sites More sharing options...
petzl Posted April 4, 2005 Share Posted April 4, 2005 I can't however give the information you require as my dad's mailwasher is failing to bounce it (it says "maybe forged address"). 26231[/snapback] This is probably why you are getting on SpamCops list By bouncing email you are, at best/worst DOS attacking the email addresses of those who report spam. The email reply addresses are usually used by spammer's as a Joe Job Disable bounce "feature" of mailwasher, which is being stupidly and wrongly set by default Bounces are in effect what MailWasher is doing but only to valid and innocent parties email addresses (mailwasher may check email address for validity, before sending a bounce) Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.