IP got listed, but received no report

[Johanh]

Hi,

I was just sending out our bi-weekly offer to my 'real opt-in' mailing list for which my forum members opted in (using a separate opt-in option when registering for member access) to receive special offers twice a month. I do not spam, I actually use the spamcop bl on my own server. I delisted it through the web form, but of course want to prevent this from happening again, because I think I know the reason*. I've been doing this for three years and always receive friendly unsubscribe requests (which users can do manually by editing their member profile online, or simply by replying to the email, as listed at the bottom of the email). I have never received a "stop spamming me' message, only "please remove/unsubscribe me".

*The reason I suspect caused me to be listed is that I accidentally started the mailing process twice, cause a couple of thousand subscribers to receive the message twice. However, I assume everyone agrees a mistake like that shouldn't get me listed. Another possible reason is that we have very strict rules on our forums, we don't tolerate any crap (making spam very unlike us), and don't hesitate to ban users when we feel is necessary to keep the experience for other visitors a pleasant one. I fear one of the banned individuals (which we do remove from the list manually) is trying to get back at us.

Regardless of what I suspect, I'd like to know who reported my IP and why. Based on what I read on this site, I should have received a report and be able to reply directly. I take very great care in not sending spam for ethical reasons and like to maintain a good relationship with my host. I'd definitely get burned in our forums if I would actually send spam. The mailings I send, again for which my subscribers opted-in, are not like the crap you receive in 99% of the spam ads but are actually real discounts on training products for IT certifications, which is exactly what my visitors want. Obviously not the subscriber who reported me, but that's why it's an opt-in list and provides several easy ways to unsubscribe.

Sorry for the rant. I tried to find a email address to contact someone here for more info but could only find the form for ISP personel.

Thanks,

Johan

[Wazoo]

You state that you read things here, but somehow seemed to have missed the fact that there isn't anyway anyone here is going to be able to look anything up with no data provided. At the top of the page and at the entry to each Forum section is a link to the Forum version of the SpamCop FAQ, which includes entries like Why am I Blocked? ... SpamCop Blocking List - Am I listed? ... How To Ask Questions The Smart Way (language issue, but there really is only one defintion for RTFM) ... How can I contact a SpamCop representative?

You must know some of this as you go on to state that you found and used the 'express delisting' tool .... but it is a bit bothersome that you used it before getting to the bottom of things. "No notification" could be caused by spamtrap hits and if you are going to be continuing to send stuff to those accounts, oh well ....

Bottom line, identify the server IP in question if you want any input from the folks here ...

[Johanh]

Silly me... I knew you needed the IP and I did plan to include it:

216.12.219.37

You must know some of this as you fo on to state that you found and used the 'express delisting' tool .... but it is a bit bothersome that you used it before getting to the bottom of things.

Yeah rub it in Seriously though, I know, I should have digged further before using the express delist option. Forgive me for wanting to remove my IP as quickly as possible from a list it shouldn't be on in the first place. I admit, I panicked, plus I got 120 new members registering every day who need to be able receive their account information/confirmation.

"No notification" could be caused by spamtrap hits and if you are going to be continuing to send stuff to those accounts, oh well ....

well, that's apparantly not what I want to do, hence my questions here.......

I did notice the word 'spamtrap' in the corner of my eyes when using the delist option...

Thanks for the quick reply btw.

[turetzsr]

Silly me... I knew you needed the IP and I did plan to include it:

216.12.219.37

<snip>

33452[/snapback]

Hi, Johan!

...Went to http://www.spamcop.net/bl.shtml and entered the IP address in the form. Results were:

Query bl.spamcop.net - 216.12.219.37

(Help) (Trace IP) (Senderbase lookup)

216.12.219.37 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 18 hours.

Causes of listing

    * System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

Additional potential problems

(these factors do not directly result in spamcop listing)

    * System administrator has already delisted this system once

Because of the above problems, express-delisting is not available

Listing History

In the past 148.0 days, it has been listed 6 times for a total of 2.7 days

<snip>

...Following the "(Trace IP)" link, I see:

SpamCop v 1.493 Copyright © 1998-2005, IronPort Systems, Inc. All rights reserved.

Parsing input: 216.12.219.37

host 216.12.219.37 = gaea.techexams.net. (cached)

Routing details for 216.12.219.37

[refresh/show] Cached whois for 216.12.219.37 : abuse[at]ev1.net

Using abuse net on abuse[at]ev1.net

abuse net ev1.net = abuse[at]ev1.net

Using best contacts abuse[at]ev1.net

Routing details for 216.12.219.37

Statistics:

216.12.219.37 listed in bl.spamcop.net (127.0.0.2)

More Information..

216.12.219.37 not listed in dnsbl.njabl.org

216.12.219.37 not listed in dnsbl.njabl.org

216.12.219.37 not listed in cbl.abuseat.org

216.12.219.37 not listed in dnsbl.sorbs.net

216.12.219.37 not listed in relays.ordb.org.

Reporting addresses:

abuse[at]ev1.net

Third parties interested in reports:

abuse[at]savvis.net

So it appears that abuse[at]ev1.net (and possibly abuse[at]savvis.net, in some cases) are receiving the reports. Perhaps you can get the reports from them?

Edit: 2005/09/29 00:41 EDT -0400 Jeff G. munged all those email addresses.

[Wazoo]

Yeah, but ..... only spamtraps identified, no reports sent ....

Now the really bad news, http://www.senderbase.org/?searchBy=ipaddr...g=216.12.219.37

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ....... 4.3 .. 691%

Last 30 days . 3.3 .. -10%

Average ....... 3.4

That kind of increase usually suggests that a spammer has more control of this server than the real owner.

[Johanh]

Yeah, but ..... only spamtraps identified, no reports sent ....

Now the really bad news, http://www.senderbase.org/?searchBy=ipaddr...g=216.12.219.37

Volume Statistics for this IP 

Magnitude Vol Change vs. Average

Last day ....... 4.3 .. 691%

Last 30 days . 3.3 .. -10%

Average ....... 3.4

That kind of increase usually suggests that a spammer has more control of this server than the real owner.

33454[/snapback]

Not likely considering that I'm getting listed while sending out our mailing. Total size is about 40,000. Note that I carefully built up this list over the past 3 year, all IT professionals that use my free study material and they all registered and subscribed themselves. Obviously that's not something one attains by spamming.

216.12.219.37 listed in bl.spamcop.net (127.0.0.2)

I guess there's no need to express my feelings regarding this, more importantly, how do I get delisted this time? I don't spam. I will contact my host and will keep you posted here.

only spamtraps identified, no reports sent ....

What does that mean? I know I know, rtfm, but it conflicts with the following quote. And does that at least mean that you haven't received spam reports from a person (in regards to my suspicion of a banned member)?

Spamtraps, bounced messages... can it be that my host (ev1.net) notices the bounced messages (inactive address, full mailboxes) that are sent back to their network/my mail server and that that is getting my IP listed here?

Thanks for the help so far.

[Wazoo]

Not likely considering that I'm getting listed while sending out our mailing.

NEW! SenderBase's "Magnitude" Explained purs 40k e-mails in the ballpark. I did qualify my comments with "In general, this suggests ..."

What does that mean? I know I know, rtfm, but it conflicts with the following quote. And does that at least mean that you haven't received spam reports from a person (in regards to my suspicion of a banned member)?

Had there been sufficient user complaints, there would have been a line similar to "There have been 10 complaints subitted ..." but that line isn't there so it appears that spamtrap hits (and their mathmatical leverage in the equation) appear to be the 'primary' reason for the listing. There are no reports sent out on spamtrap hits, also going back to the concept that spamtraps should not be receiving any e-mail in the first place. Some spammers seem to delight in finding these addresses and populating lists (or using them in forged headers) such that some innocent ends up extremely upset at then hearing all about SpamCop.net and the "harm to the Interent" it causes. In this case, the 'real' issue is the opt-in mechanism for the mailing list or mis-configured servers. (and yes, the RFC keeps coming up, in that "in the days of old" bounces to the "From:" address was once considered a nicety .. those days disappeared long ago due to spammer abuse of the once trusted procedures.

Spamtraps, bounced messages... can it be that my host (ev1.net) notices the bounced messages (inactive address, full mailboxes) that are sent back to their network/my mail server and that that is getting my IP listed here?

33455[/snapback]

Glossary has been worked up and provided, links found via the SpamCop FAQ links "here" ...

Quickly, spamtrap hits would suggest your cultivated list has been poisoned ...

Your bit of query on bounces is actually backwards as far as getting listed in a BL is concerned.

[StevenUnderwood]

What does that mean? I know I know, rtfm, but it conflicts with the following quote. And does that at least mean that you haven't received spam reports from a person (in regards to my suspicion of a banned member)?

Spamtraps, bounced messages... can it be that my host (ev1.net) notices the bounced messages (inactive address, full mailboxes) that are sent back to their network/my mail server and that that is getting my IP listed here?

Thanks for the help so far.

33455[/snapback]

One person can NOT get an IP listed unless they had multiple reporting accounts.

There have been real reports against the IP though not recently enough to be affecting it now and these might have been mistakes while your IP was listed.

Report History:

--------------------------------------------------------------------------------

Submitted: Thursday, September 15, 2005 6:07:04 PM -0400:

TechExams.net IL - Free Software from ExamForce

1508909157 ( 216.12.219.37 ) To: abuse#savvis.net[at]devnull.spamcop.net

1508909156 ( 216.12.219.37 ) To: spamcop[at]imaphost.com

1508909155 ( 216.12.219.37 ) To: abuse[at]ev1.net

--------------------------------------------------------------------------------

Submitted: Thursday, July 28, 2005 12:03:07 PM -0400:

TechExams.net IL - CBT Nuggets for less

1477559502 ( 216.12.219.37 ) To: abuse[at]ev1.net

--------------------------------------------------------------------------------

Does your system receive email from the internet. Does it accept it, then process it and send out unable to deliver messages to the (often forged) From: or Reply-to: address rather than rejecting the message during the SMTP transaction? Those forged From: and/or Reply-to: addresses can very easily be spamtrap addresses which are getting you listed.

[Johanh]

spamtrap hits would suggest your cultivated list has been poisoned ...

I just had a chat with my host ev1.net. They are not involved and never received any abuse reports for my IP or mail domain.

Here are some details about my sending process.

- I use Dada mail, a fairly advanced cgi scri_pt.

- I send out a mailing in batches, only 60 messages per minute.

- In addition to manual unsubscribe requests (when they reply to the message instead of changing their member profile online) I clean up the list at least once every month by removing bounced addresses (inactive, incorrect email addresses)

- The following text is at the bottom of each message: "You are receiving this message because you joined our Info Letter when you registered at TechExams.Net. To remove yourself from the TechExams.net Info Letter, update your profile at the TechExams.Net Forums. Just follow this link: Member Profile, or reply to this message."

- I don't spam.

I understand the spamtraps are secret, but please advice on what to do next.

- How to get off the list?

- How to stay off the list?

- Should I hit that Dispute listing link?

Is it possible that the sole reason for getting listed today is that I made the classic mistake of sending the mailing twice (though partly)?

[Wazoo]

Questions asked in this last (and apologies on my last post ... most of what I had typed in seemed to have disappeared during some fumble-fingered moments)

One issue you didn't touch is the management of "adding" e-mail addresses to the list, which is where the problem with bad addresses usually comes from. Am I running mailing lists responsibly? Updated! is one entry on that subject.

Hitting the Dispute button probably usn't the best route to start. Reading the Why am I Blocked? FAQ entry would be better. What to do next is addressed in that FAQ item.

Other data was edited back into my last post, once I saw that data wasn't there <g>

[Johanh]

I person can NOT get an IP listed unless they had multiple reporting accounts. 

Thanks.

Report History:

--------------------------------------------------------------------------------

Submitted: Thursday, September 15, 2005 6:07:04 PM -0400:

TechExams.net IL - Free Software from ExamForce

1508909157 ( 216.12.219.37 ) To: abuse#savvis.net[at]devnull.spamcop.net

1508909156 ( 216.12.219.37 ) To: spamcop[at]imaphost.com

1508909155 ( 216.12.219.37 ) To: abuse[at]ev1.net

--------------------------------------------------------------------------------

Submitted: Thursday, July 28, 2005 12:03:07 PM -0400:

TechExams.net IL - CBT Nuggets for less

1477559502 ( 216.12.219.37 ) To: abuse[at]ev1.net

--------------------------------------------------------------------------------

I didn't notice your post while I posted the above, but as I mentioned, my host told me they didn't receive any reports on this IP. Probable referring to recently, over a period that could be of influence on this situation. Still, can I see who reported back then? Should I not have received a message? I don't want to send mail to people who don't want it, but I'd like to know why they report instead of contacting me. Apart from two easy methods to unsubscribe, if I'd really spam someone he/she could post/complain about it in my forums, which is obviously something I'd like to avoid in the first place.

Does your system receive email from the internet.  Does it accept it, then process it and send out unable to deliver messages to the (often forged) From: or Reply-to: address rather than rejecting the message during the SMTP transaction?  Those forged From: and/or Reply-to: addresses can very easily be spamtrap addresses which are getting you listed.

Yes, it does receive email from the internet, ie. for my webmaster account. Quite honestly, it would not surprise me if it does what you describe. I'd have to double-check and fix if necessary. However, it would be a major coincidence if 'that' would cause me to get listed here on the same day I sent out my mailing (twice). I.o.w. it seems highly unlikely that that's the cause.

www.techexams.net/technotes/securityplus/emailsecurity.shtml#spam

You got the wrong guy

[Johanh]

One issue you didn't touch is the management of "adding" e-mail addresses to the list, which is where the problem with bad addresses usually comes from.  Am I running mailing lists responsibly? Updated! is one entry on that subject.

If you are suggesting that basically anyone can submit an email address to the list, then yes, they can. Single opt-in, but they do receive a welcome message and account information/registration confirmation. Meaning, if someone would submit an address of someone else, the latter would notice it. I'm running my mailing list as well as the website with the utmost responsibility. Members in the forums know that very well.

Hitting the Dispute button probably usn't the best route to start.  Reading the Why am I Blocked? FAQ entry would be better.  What to do next is addressed in that FAQ item.

Other data was edited back into my last post, once I saw that data wasn't there <g>

33460[/snapback]

Thanks for the suggestions.

[Merlyn]

Still, can I see who reported back then?

33463[/snapback]

No, then it would be called listwashing

Should I not have received a message?

33463[/snapback]

Only if you owned the IP's. According to Arin it looks like you don't own them.

I don't want to send mail to people who don't want it, but I'd like to know why they report instead of contacting me. Apart from two easy methods to unsubscribe, if I'd really spam someone he/she could post/complain about it in my forums, which is obviously something I'd like to avoid in the first place.

33463[/snapback]

People should not have to unsubscribe from anything they never requested to begin with. Ditto on your forum.

However, it would be a major coincidence if 'that' would cause me to get listed here on the same day I sent out my mailing (twice). I.o.w. it seems highly unlikely that that's the cause.

33463[/snapback]

Do you use opt-in or confirmed opt-in?

Can anyone just sign up to your newsletters without some kind of confirmation process?

Because you are hitting spamtraps one would think anybody could come along and put in any email address they wanted to.

Just curious.

[turetzsr]

I just had a chat with my host ev1.net. They are not involved and never received any abuse reports for my IP or mail domain.

33459[/snapback]

...Never heard of something like this but I guess it's possible. Given StevenUnderwood's Report History listing, above, either abuse[at]ev1.net skipped through the reports or a rare glitch occurred and the SpamCop reporting system failed to send them. In either case, I would think that the admins at ev1.net need to work with SpamCop deputies (deputies [at] spamcop [dot] net) to exchange information. This would need to be done anyway for the spam trap hits.

Here are some details about my sending process.

- I use Dada mail, a fairly advanced cgi scri_pt.

- I send out a mailing in batches, only 60 messages per minute.

- In addition to manual unsubscribe requests (when they reply to the message instead of changing their member profile online) I clean up the list at least once every month by removing bounced addresses (inactive, incorrect email addresses)

- The following text is at the bottom of each message: "You are receiving this message because you joined our Info Letter when you registered at TechExams.Net. To remove yourself from the TechExams.net Info Letter, update your profile at the TechExams.Net Forums. Just follow this link: Member Profile, or reply to this message."

- I don't spam.

33459[/snapback]

...IMHO it is not the sending process that is suspect but, rather, your subscription list. What steps do you take to ensure that someone with evil intent does not sign up a spamtrap or an innocent victim who does not want your e-mails? What steps do you and ev1.net take to ensure that a spammer can not send out e-mail through 216.12.219.37?

I understand the spamtraps are secret, but please advice on what to do next.

- How to get off the list?

33459[/snapback]

...At this point, I would think you will have to wait until the listing ages off, providing you take successful action to stay off before it ages off. For spamtraps, only SpamCop Deputies (deputies [at] spamcop [dot] net) can help.

- How to stay off the list?

33459[/snapback]

...In simple terms, figure out what is causing the listing and stop it. Unfortunately, I don't have the knowledge to be able to see what exactly is causing the listing but my top guesses would be (1) your subscription mechanism is not sufficiently secure from evildoers (see previously referred-to "Am I running mailing lists responsibly?" article) and/or (2) some spammer has managed to send spam through your outgoing server. But I'm far from an expert on such things.

- Should I hit that Dispute listing link?

33459[/snapback]

...Suppose so, but from what I see, it seems to take you to information-only pages. If I'm reading correctly, that would be a good place to go.

Is it possible that the sole reason for getting listed today is that I made the classic mistake of sending the mailing twice (though partly)?

33459[/snapback]

...From what I understand of the process, no. If your subscriber list has integrity, it shouldn't matter how many copies of an e-mail you send to people who want it -- SpamCop rules do not permit reporting e-mails that members subscribe to receive -- if that is what is happening and you can demostrate it, the SpamCop members are subject to disciplinary action, up to and including loss of reporting privileges). Sending to a spam trap twice might make a difference but if your subscriber list includes a spam trap, you were bound to be listed eventually (and will continue to be listed until it's removed).

[Johanh]

People should not have to unsubscribe from anything they never requested to begin with.  Ditto on your forum.

Do you use opt-in or confirmed opt-in?

Can anyone just sign up to your newsletters without some kind of confirmation process?

Because you are hitting spamtraps one would think anybody could come along and put in any email address they wanted to.

It's an opt-in list, which is a separate list from the forum member list, but one can only subscribe by registering for the latter. I.o.w. when someone signs up for the forums there is an option in the user profile for receiving our Info Letter. They don't get actually confirmation like "you have been subscribed to the Info Letter, but receive a general welcome message with their account info. I.o.w. whether they opt-in to receive mail or not they receive a confirmation. So, as I mentioned in my previous post, someone can enter an email address of someone else, but the latter would receive confirmation. I get a message about 3 times a year from users that received a confirmation message but didn't sign up. Of course those are removed immediately. People can unsubscribe from the mailing list without losing their forum account, and can create a forum account without having to receive mailings, at all.

[Johanh]

Thanks for the reply turetzsr.

What steps do you take to ensure that someone with evil intent does not sign up a spamtrap or an innocent victim who does not want your e-mails?

Well, as explained above, that innocent victim would receive a confirmation with hist unwanted account info. But what can I do to prevent someone from registering a spamtrap address. If someone uses a spamtrap address to register the IP would get listed because a registration confirmation would be sent directly to the spamtrap.

I'll do some more reading here first, before contacting the deputy.

[turetzsr]

Thanks for the reply turetzsr.

33470[/snapback]

...You're welcome. Please refer to me, though, as Steve T (see sig) -- turetzsr is just my user id (sort of like it being more appropriate to refer to you as "Johan" than as "Johanh"). <g>

What steps do you take to ensure that someone with evil intent does not sign up a spamtrap or an innocent victim who does not want your e-mails?

Well, as explained above, that innocent victim would receive a confirmation with hist unwanted account info. But what can I do to prevent someone from registering a spamtrap address. If someone uses a spamtrap address to register the IP would get listed because a registration confirmation would be sent directly to the spamtrap.

<snip>

33470[/snapback]

...Yes, sorry, your replies were added while I was typing my answer (which took rather a long time).

...IIUC, spamtraps are set up so that they will not react to a single confirmation e-mail. So as long as you follow the recommended procedure (I think this is in the "Am I running mailing lists responsibly?" article) of sending ONLY ONE confirmation e-mail and, if you receive no reply, remove that e-mail address and never send anything else to it, you should be okay. This procedure is appropriate for spamtraps and real e-mail addresses alike.

[Johanh]

...You're welcome.  Please refer to me, though, as Steve T (see sig) -- turetzsr is just my user id (sort of like it being more appropriate to refer to you as "Johan" than as "Johanh"). <g>

Ok, Steve T. It's kinda a habbit at my forums to refer to each other by the username. Most people actually refer to me as 'Webmaster', but Johan will do fine.

...IIUC, spamtraps are set up so that they will not react to a single confirmation e-mail.

Ok, sounds fair and logical.

So as long as you follow the recommended procedure (I think this is in the "Am I running mailing lists responsibly?" article) of sending ONLY ONE confirmation e-mail and, if you receive no reply, remove that e-mail address and never send anything else to it, you should be okay.  This procedure is appropriate for spamtraps and real e-mail addresses alike.

33472[/snapback]

I can do all that by changing some settings and modifying some code fairly easily, and surely that's worth the effort if that keeps me of the list.

Some concerns though (I have to double-check both):

- I've sent the mailing to only the first half of the list. That part contains addresses that are at least 6 months old, meaning it's unlikely it contains a spamtrap, considering it would have received a message at least 10 times in the last 6 months.

- If you spoof an email to my mailserver using a spamtrap as the sender address, and a bogus[at]techexams.net as the recipient, it would go to a catch-all account, hence not sent an undeliverable.

I stopped the mailing when it got listed again after the express delisting, basically means that if there are going to be reports of ongoing objectionable email from mysystem it will not be delisted automatically in approximately 15 hours, and I will be sure it's not my mailing list.

[StevenUnderwood]

Well, as explained above, that innocent victim would receive a confirmation with hist unwanted account info. But what can I do to prevent someone from registering a spamtrap address. If someone uses a spamtrap address to register the IP would get listed because a registration confirmation  would be sent directly to the spamtrap.

33470[/snapback]

You are aware that many AUP's these days specifically prohibit their users from unsubscribing from a list they did not subscribe to in the first place, so Unless you use confirmed opt-in, this could be what is happening.

Someone (bl's have many enemies) signed up your newsletter using spamtrap addresses they have figured out. The spamtrap does (will not) reply to any message saying to unsubscribe. They then start receiving a message (or more)every month and you are listed because of it.

IF this is the problem, there is only one good solution. Delete that list and start again. Since you seem to have contact through your forum to many of these people, that might be a way to get word of the problem to them. An alternative would be to send instructions to your list one time and start a new list with ONLY those that reply and confirm that request. I would contact your ISP and Spamcop to let them know you are doing this so they can help you stay off the BL and not close you down for any reports that may come in from the bad addresses.

[dbiel]

Or to state is slightly differently,

Send an email to everyone on your list stating that you have been registered to receive my newsletter. If you wish to stop receiving it you need do nothing at all.

If you wish to continue receiveing it you must reply to this email and enter the following code xxxxxxxxxxxx in the subject line (note the code is important to avoid accepting automated replies or bounce backs)

If you would rather register at my web set please enter your unique code where prompted to confirm your registration. (do not use generic codes, each code should be different and matched to the email address it was sent to.)

Note: my wording is terrible so I am sure you could do much better, but the point is stop using your current list. create a new list from only those that respond.

Also require the same process for new registrations. Do NOT accept automated replies.

If you fail to take these steps, you will keep appearing in the list.

It is starting to be accepted to require annual renewals to lists. This is for your protection from the user who signed up and forgot about it a year latter.

Also make sure you keep the copies of the confirmation email in a file that is off line. Too many hackers out there. Today the only truely safe file is the off line file.

Is this a lot of work? yes!

Spammers have spoiled it for everyone.

You you tried flying since 911?

Terorists have spoiled it for everyone.

It is a shame it has to be this way, but if we are to survive.............

[Wazoo]

Another data point .... http://www.senderbase.org/?searchBy=ipaddr...g=216.12.219.37 is now showing -

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ........ 4.5 .. 1300%

Last 30 days .. 3.4 ..... -0%

Average ........ 3.4

If "we" agree that the previous 600%+ increase in this measurement earlier today was based on "your" attempt at sending to you mailing list, and you have then stated you backed off on sending that out again, do you have any possible justification for the current numbers? It's beginning to look like (to me) that "we" aren't really talking about "your" server, rather a server you are sharing with other users .. again, based on your conversation points thus far.

Now the interesting thing appears to be that the increase seen in traffic has also played with the math a bit, as 216.12.219.37 not listed in bl.spamcop.net ... much shorter than the previously mentioned 19 hours (minus a few since that was 'documented' .... (of course, not overlooking that there may have been some other forces at work, like Deputy involvement, etc. .... just going by the numbers here)

29 Sep 05 1022 -5 GMT

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ........ 4.4 .. 828%

Last 30 days .. 3.4 .... 4%

Average ........ 3.4

[Johanh]

Another data point .... http://www.senderbase.org/?searchBy=ipaddr...g=216.12.219.37 is now showing -

Volume Statistics for this IP 

Magnitude Vol Change vs. Average

Last day ........ 4.5 .. 1300%

Last 30 days .. 3.4 ..... -0%

Average ........ 3.4

If "we" agree that the previous 600%+ increase in this measurement earlier today was based on "your" attempt at sending to you mailing list, and you have then stated you backed off on sending that out again, do you have any possible justification for the current numbers?  It's beginning to look like (to me) that "we" aren't really talking about "your" server, rather a server you are sharing with other users .. again, based on your conversation points thus far.

We 'are' talking about 'my' server. It's dedicated for the site. The 1300% (which is now on 828%) is (hence, partly) because I sent out the second half of the list (without getting blocked obviously and as it should be). I understand you guys are involved with spam all day, but there are still honest lists with subscribers that actually expect to receive mail. I don't want to withhold my members a great offer that allows them to get a fair discount on a product many of them are likely to buy regardless of whether I send a mailing, because of a spamtrap.

Rebuilding as suggested would shrink the list a lot even under the most ideal circumstances (while I don't spam in the first place). Let me just say that is far from necessary, 'if' it is caused by a spamtrap, because I'd be able to identify at least a block of several thousands (instead of tens of thousands) that caused me to get listed and delete the block rigorously, or I'd be able to use a older backup of the list as 'unsubscribes' are kept in the online forum profile. The list what makes the site possible, hence I and my 100K+ members rather get rid of the spamtrap address that you created, and your enemies abuse making me and my community, while I don't spam, an indirect target and victim. Again, 'if' that is the case. No offense btw, I appreciate the suggestions nevertheless.

Needless to say, I 'will' create a more strict double opt-in subscribe system.

Now the interesting thing appears to be that the increase seen in traffic has also played with the math a bit, as 216.12.219.37 not listed in bl.spamcop.net ... much shorter than the previously mentioned 19 hours (minus a few since that was 'documented' ....  (of course, not overlooking that there may have been some other forces at work, like Deputy involvement, etc. .... just going by the numbers here ...)

33476[/snapback]

I noticed that yesterday, which is of course a good thing of course, and just. I haven't contacted a deputy yet btw, because I want to dig into it myself as much as possible before I do.

Here's a thought though:

I noticed the reports (which I unfortunately never received) posted earlier in this thread where sent on the 15th this month, and I read the SCBL ignores reports older than 14 days. I think I got listed because of those three reports in combination with a spamtrap, and that the reason I got de-listed so quickly yesterday/today (when date became 29th) is that the 3 reports are 14 days ago and one spamtrap 'alert' wouldn't be enough to keep me listed? Anyway, I'm trying to find out who reported (on the 15th) and why because those are false or either caused by someone else using their address to register (which again they would ahve noticed by the confirmation). And, again, unsubscribing is easy and unsubscribe request by email are never ignored.

Thanks again all.

[Merlyn]

The reports you saw from the 15th have nothing to do with your latest block. You latest one was from spamtraps not people. spamtraps do not get listed on the evidence page.

BTW: No on can report spam more than 24 hours old.

Moderator edit: current reporting window is 48 hours (not 24 hours) In the past it was actually longer, I believe it was 72 hours

[StevenUnderwood]

Here's a thought though:

I noticed the reports (which I unfortunately never received) posted earlier in this thread where sent on the 15th this month, and I read the SCBL ignores reports older than 14 days. I think I got listed because of those three reports in combination with a spamtrap, and that the reason I got de-listed so quickly yesterday/today (when date became 29th) is that the 3 reports are 14 days ago and one spamtrap 'alert' wouldn't be enough to keep me listed? Anyway, I'm trying to find out who reported (on the 15th) and why because those are false or either caused by someone else using their address to register (which again they would ahve noticed by the confirmation). And, again, unsubscribing is easy and unsubscribe request by email are never ignored.

33494[/snapback]

You seem still not to have read what makes the list and what does not or I don't know where you read what you did.

http://www.spamcop.net/fom-serve/cache/297.html

Please read the SCBL Rules at the bottom. Any report over a week old is completely ignored. Where did you find a reference to 14 days? Also, according to the web page, you were delisted yesterday by at least 7PM when I last looked it up.

As stated earlier, the reports were sent to the addresses provided. What they did with them is anybody's guess. As I mentioned, it could be that

a> your IP was listed and the report was automatically or accidentally reported because of that. In this case it should be brought to their attention (if it is not to late to reply to the reporter) or

b> someone was signed up for your list without their knowledge and properly reported it because they did not sign up for it and realize that MOST unsubscribe links/messages are traps to receive more spam.

[Johanh]

The reports you saw from the 15th have nothing to do with your latest block.  You latest one was from spamtraps not people. spamtraps do not get listed on the evidence page.

ok, thanks. But the FAQ notes "SCBL uses Spamtrap reports to weight total reports. For spamtrap scores less than 6, the SCBL multiplies by 5 the quantity of spamtrap reports and adds this to the report score. For larger spamtrap scores, the SCBL squares the quantity. Examples:

If an IP address has 2 spamtrap reports and 3 SpamCop user-reported reports, its weighted score is 13: (2 * 5) + 3 = 13. " So I figured the 5 +3 in my case caused the issue. But now I read it again... it must still be early, I guess I completely misread the info. nvm

BTW:  No on can report spam more than 24 hours old.

33495[/snapback]

The SCBL ignores reports for email received more than one week ago.

Anyway, if any one of you, or a deputy can confirm that the on the 15th they SC didn't receive mail from my IP on a spamtrap address, I can remove the addresses of people who subscribed over the past two weeks and with it remove the spamtrap. Then the spamtrap would be removed from my mailing list, and if then SC receives mail from my server after that, Wazoo is right and it's not 'just' 'my' server. I doubt it's a coincidence that I got listed while sending out a mailing, hence I except the above would solve 'my' problem. Please enlighten me if I'm overlooking something here.