Why Am I Blocked FAQ

[Miss Betsy]

Why Am I Blocked? Probable Causes

If your email has suddenly been blocked by the SpamCop blocklist, it is probably:

• because a virus has infected a computer that uses your ISP to connect to the Internet or you have an open proxy or open relay on your computer.
  
• because your ISP allows people to send spam (email that you have not requested and do not want)
  
• because, as in all systems, there may have been a mistake.
  

The spamcop.net listing will expire automatically within 48 hours of the last report of spam from it.

For people who are operating servers:

Am I really listed in the SpamCop Blocklist?:

You can check the status of any server by entering its address at http://www.spamcop.net/bl.shtml. The reason an IP address is listed can also be obtained from that page.

Please also see:

• How can I get removed from SpamCop's blocking system?
  
• John's explanation at John's revised post, for Why Am I Blocked FAQ
  
• Merlyn's explanation at FAQ Entry: Why is my email blocked?
  

Skip the rest of this FAQ and post the IP address that is blocked in the Spamcop web forum or newsgroup. There are many knowledgeable people in the SpamCop groups who will help you figure out why and offer solutions.

For people whose email was returned

Q: What does SpamCop do with my email? A: Nothing

The Internet Service Provider (ISP) of the person, or business, you are sending email "To" is blocking email from your ISP's computers (servers), using a list provided by SpamCop.

Your email doesn't pass through SpamCop's mail servers and SpamCop has no way of blocking or bouncing your email.

In addition, the SpamCop email service uses the blocklist to "tag" incoming mail so that suspected spam is placed in a particular folder and that is the way the blocklist is intended to be used.

Q: What is a blocklist? A: A blocklist helps ISP’s to prevent spam coming to their customers.

An ISP can use a blocklist (a list of IP addresses),to block (bounce back) all email coming from a particular IP address.

The blocking is based not on your email address (which looks like username[at]example.com), but on the IP address (which looks like 198.162.250.196).

This IP address is assigned to the mail server you use, which is probably run by your ISP. You may share this same server with hundreds or thousands of other customers. If one of the other customers is sending spam through that shared mail server, it will cause the IP address of that mail server to be put on the blocklist. And when you send email through that server, ISP’s who use blocklists to avoid receiving spam, will also block your email address.

SpamCop is one of many blocklists. [link to page that explains about blocklists and describes the major ones and the difference between spamcop & other lists particularly the time it takes to get off the list and how spamcop can be an early warning system for ISP's - explanation not written yet]

Q: What is SpamCop? A: Unique, automated blocklist and spam filtering

SpamCop has a program that will find the correct address to send a complaint because the email address you see that says who it is from is often forged by spammers. SpamCop finds the correct IP address and forwards complaints for its members. If a lot of reports are made, the IP address goes on the SpamCop blocklist that is used by many ISP’s. for more detailed information on how Spamcop works see: http://www.spamcop.net/fom-serve/cache/3.html

Q: How do ISP’s use SpamCop A: As 1) a warning that spammers have slipped by their defenses and 2) to block spam.

1) Responsible ISP's welcome SpamCop reports and will remove spammers quickly from their systems.

2)When they block emails, they send a message that looks like this:

451 Blocked - see http://www.spamcop.net/bl.shtml?xxxx.xxxx.xxxx.xxxx:

or

email from xxx.com blocked,refused by Spamcop,see http://www.spamcop.net

Q: Why me? A: It Happens to the best of us

It is annoying to have your email blocked. It is also annoying to have a backhoe interrupt email service.

However, until the blocking problem is resolved, you can email people through a web based email service (the most familiar web based email services are hotmail and yahoo).

After you have taken care of the immediate problem of being able to communicate with someone by email, the next step is to see what can be done so this inconvenience does not happen to you again.

The one thing you do not want to do is to complain to those correspondents who are using an email service that uses the SpamCop blocklist. They probably really like the reduction in spam!

You have the responsibility to see that your ISP provides you with reliable email service. See this link for a longer explanation of costs

http://forum.spamcop.net/forums/index.php?showtopic=660

Q: Who do I contact to correct this problem? A: Your ISP (email service provider) first

Usually the ISP with the blocked IP address has also been notified with the evidence of spam reports. Your ISP may have already acted on the Spamcop report he has received by the time you call. It may just have been a mistake on his part or, possibly, the reporter's part. Reporters can be fined or banned for mistakes.

As soon as your ISP stops the spam from being sent, or uses the procedures at SpamCop to point out the reporter's mistake, the IP address is taken off the blocklist (usually within 48 hours for spam; immediately for reporter error).

It may be that your call is the first time your ISP has heard that SpamCop has listed your IP address. Listings are made, in addition to member reporting, automatically from spamtraps (an eMail address that is not used, nor published anywhere, so only gets eMail if someone is sending spam!).

Your ISP can find out about SpamCop at http://www.spamcop.net/fom-serve/cache/76.html if he doesn’t already know about SpamCop.

SpamCop deputies have access to the full evidence for a listing. Deputies can delist IP addresses which are listed in error.

Q: My ISP says it’s not their fault. A: People in this forum will help with information to give your ISP

You will need to know your IP address for people to understand what has happened (it should be in the message you received telling you your mail was blocked).

It is also helpful to know the reasons why it was blocked. (To do this, go to http://www.spamcop.net/bl.shtml. Make a note of the reason for the listing. For example "Been reported as a source of spam about 30 times" "Been detected sending mail to spam traps" as this is important)

There are many people who will explain to you what has happened and what you can do.

If you are interested in finding out more about blocklists and exactly why your email was blocked, you may post

in the web forum http://forum.spamcop.net/forums/index.php?act=idx

or in the SpamCop newsgroup http://www.spamcop.net/forum.shtml with the above information.

Please remember that this block is not aimed at you personally. There are a limited number of IP addresses on the Internet, so you, and the spammer, may get a different one each time you log-on. Your Internet Service Provider is the only one who can investigate and take action to stop spam from coming from that IP address. In the meantime, the email service at the other end does not have to accept your email until spam has stopped coming from that particular IP address just as postal and package services can refuse certain types of mail and packages.

Edited per Wazoo comments March 6, 2004 rev March 7 rev Mar 8 for format (agsteele) Rev Mar11 with more links Rev Mar 12 with new John link rev 13 listized "Probable Causes" rev 14 consolidated some links

Contributors: Michaell, Mike Easter, Wazoo, Greenlady, John, JT, JeffG

[petzl]

If you are on SpamCop's blocklist it is simply because your ISP does not care and you should look for another provider

SpamCop contacts the listed address of ISP long before any lengthy listing so your provider again does not care and is either not getting abuse reports or ignores them

The reason a provider (or credit card milker) does not get reports is simply that they have a misconfigured network and one you should not trust to send email

Many of these clown ISP's eventually come to SpamCop newsgroups and threaten (cartoony) legal action about the messenger who has advised them of their (at best) messed up misconfigured network. Or they are simply spammer friendly in both cases SpamCop is simply and effectivly doing what SpamCop members subscribe for.

That's to produce an effective spam sorter/filter which sorts spam as and while a spammer is sending spam and when spam stops the IP is released (The SpamCop Filter is not a blocklist). SpamCop does this magnificently stopping porn, fraud and other sleaze from hitting ones in box (again while being sent not after)

[turetzsr]

Hi, petzl!

...Pretty good additions/clarifications, except for:

If you are blocked by SpamCop it is simply because your ISP does not care and you should look for another provider

...Please change or remove this one. SpamCop can not block anyone's e-mail unless it is sent to a SpamCop mail user, and even then it is almost always sent to the user, just not to the regular Inbox.

SpamCop contacts the listed address of ISP long before any lengthy listing so your provider again does not care and is either not getting abuse reports or ignores them

... or the abuse address (to which reports are sent) is upstream.

The reason a provider (or credit card milker) does not get reports is simply that the have a misconfigured network and one you should not trust to send email

... or the abuse address (to which reports are sent) is upstream.

<snip>

SpamCop is simply doing what SpamCop members pay it for.

...Perhaps not relevant, but there are also non-paying reporting members.

That's to produce an effective spam sorter/filter which sorts spam as and while a spammer is sending spam and when spam stops the IP is released

... normally within about a 48-hour period.

[petzl]

Spamtraps and mole reporting .... ????

Yes but only when listed

[Jeff G.]

How come no one has commented on the one I posted?

Sorry, I haven't had time to fully digest it.

[petzl]

I don't follow (or maybe just can't read) .. only when listed?

SpamCop notifies the ISP when they get listed for sending email to spamtraps, but only when listed not before If responsive and they fix their security problem SpamCop will very quickly delist

Miss Betsy's rendition is fine. However I feel being nice to people who end up on SpamCops "Blocklist" need to be spoken to more aggressively and straight to the no nonsense point

Trying to be "polite" seems to infer to many of these loons that it is SpamCop at fault when SpamCop is but a service. Stating in no uncertain terms to these no nothing loons that any provider that gets listed, has been listed because of their own doing/incompetancy and no one else's

Whether or not they like it The only listings that happen is because of no response or action to abuse reports. Which are sent for each and every spam! It is not an excuse or SpamCops doing if their "upstairs" do not inform them of problems (FIRST stop paying these "drongo's" get a provider that WILL provide a service)

It is now ridiculous that out of every 1000 emails recieved one is legitimate (One now has to be ready to "avert one's eyes")! The rest is spamvertised filth and or fraud (If on a SpamCop Blocklist talk to your provider and demand your money back. That is all these ISP credit Card milking creeps are about) :angry:

[petzl]

Miss Betsy

And I just had an idea - why does an admin need a complete report when spam hits a spamtrap or for mole reporting? Just a short note saying a report was made.

I would say the problem is that a number of know nothing do nothing "abuse" desks start complaining about what they term" SpamCop" spam (been there done that)

The best way to deal with a open network (or open computer) is to format all their spam spewing drives and leave those drives with 20 alphanumeric password protected (this stops them spamming and something I am cosidering doiing! I've had enough

If someone like Comcast does not mind insecure networks fine I hope they realize what information I do not decide to copy and post in newsgroups (Passwords credit card details etc) Then find they have to buy new drives for their servers fine and suits me.

[agsteele]

How come no one has commented on the one I posted?  It has incorporated the suggestions from several other posts - especially including the one from someone who is very new to spamcop.

Well, I think Miss Betsy's updated FAQ is fine in terms of the content but quite a tough read. A lot of text and I found it easy to lose the thread.

I wonder if, for something as important as this FAQ, that some creative layout and provision of whitespace - even some graphics perhaps - would make the FAQ more readable for the person who has come to SpamCop for the first time seeking an answer and not understanding how the system works.

Hope that is helpful.

Andrew

[agsteele]

I don't have time to figure out all the nuances of how to format, but if this FAQ is used, maybe someone can add the links and colors and more appropriate white space.

But I have revised it to see if a quick formatting helps.

The coloured headings etc have certainly made the FAQ much easier. A good idea and easier than trying to incorporate images and tables.

Thanks.

Andrew

[jcrm]

And I think that being blunt with admins is ok, but most of what they will see is in the links. 

And I just had an idea - why does an admin need a complete report when spam hits a spamtrap or for mole reporting?  Just a short note saying a report was made.

In fact, why does the entire spam need to be sent at all to anyone on the first report?  Submissions could be kept for a certain period of time and if an ISP wants to know; they can request a copy

I speak only for myself, but abuse admins are a lazy bunch*.

If you want me to look at your complaint, you had better have sent me enough of the message so I can see wether it is definately spam, or only possibly spam, or probably legitimate.

Then there had better be properly formatted headers which, while email addresses may be "munged", had better be pretty much intact so I can check against our logs to see if it really happened (which unfortunately means I can dig out the email address - sorry).

If you don't send me what I need, I'm probably not going to look at it. I may send you a 3 word email "not enough info"

Don't tell me you expect someone who deals with spam to click on a weblink with a code in it just because it says there has been some spam sent.

*not really lazy, it just looks that way. Dealing with abuse is just an "extra" part of the job for all of the people I know that do it. If you assume that handling abuse is all we do, then the amount of time we are prepared to spend on it makes us look pretty lazy.

Miss Betsy, while i think this idea of yours is bad, I think the FAQ does a fine job of informing a user without insulting an admin.

[Wazoo]

moved this Topic to the Lounge .... bringing the recent re-post of Miss Betsy's back to the Help Forum and re-Pinning it. An attempt to assuage one user's feelings that an entry described as a FAQ should not have any discussion about its contents attached.

[yourbuddy]

Two things ...

First thing, complements:

Miss Betsy has done a great job of doing the "hard work", of

putting the thoughts together in a logical order and used words

that make logical sense (while being "readable" not "techie").

Second thing, suggestions:

Lots of the suggestions and evaluations have merit, but they

are (for the most part) variations on Miss Betsy's great "opus".

Some "layout work" and "wording tweeks" and it's a hit tune.

[turetzsr]

Two things ...

First thing, complements: 

Miss Betsy has done a great job of doing the "hard work", of

putting the thoughts together in a logical order and used words

that make logical sense (while being "readable" not "techie").

<snip>

...Hear, hear!

[Wazoo]

First thing, complements: 

Miss Betsy has done a great job of doing the "hard work", of

putting the thoughts together in a logical order and used words

that make logical sense (while being "readable" not "techie").

You dang betcha! Wonderful job!

Second thing, suggestions: 

Lots of the suggestions and evaluations have merit, but they

are (for the most part) variations on Miss Betsy's great "opus".

Please note the dates involved .. this thing goes back a while, and she did incorporate some, rework some stuff, etc. but sitting up there as a Pinned FAQ thingie. (Maybe why you didn't notice it?) I'm just not comfortable wuth deleting other posters' stuff, and had the original concept of having them revisit and either update/change/delete what was already accomplished so I could clear the complained about FAQ with additional input ... now I don't even know where I posted that suggestion/request ... but put the "clean" copy over in Help, brought this one with all commentary (well, deleted my own stuff that Miss Betsy had incorporated) in hopes that the original posters would do what I was thinking (and thought I'd asked?)

Some "layout work" and "wording tweeks" and it's a hit tune.

Examples and specifics would go a long ways <g>

[turetzsr]

...Another possible suggestion: one high-level pinned FAQ with sparse details and hyperlinks to other locked posts with greater detail. That might address agsteele's problem of it being "quite a tough read. A lot of text and I found it easy to lose the thread."

[Miss Betsy]

There was plenty of time while it was 'in the works' for people to add or make suggestions.

It still can be done. agsteele seemed to think that what I did to it was what he had suggested.

So what is the problem(s)?

[aside to yourbuddy: this is a /spamcop/ FAQ, of course it is going to reflect the spamcop viewpoint]

Miss Betsy

[turetzsr]

There was plenty of time while it was 'in the works' for people to add or make suggestions.

It still can be done.  agsteele seemed to think that what I did to it was what he had suggested.

So what is the problem(s)?

[aside to yourbuddy: this is a /spamcop/ FAQ, of course it is going to reflect the spamcop viewpoint]

Miss Betsy

...No problem at all, just a thought I had. If it isn't worth considering, we can just drop it.

[Miss Betsy]

If what your suggestion was, was to have like one or two 'super' FAQ with links to other topics, that's a good suggestion, but it has nothing to do with the FAQ on Why Am I blocked? Which does have links.

I know that I am wordy and need editing, but some of the wordiness were 'suggestions'

I am tired and maybe am not reading this as carefully as I should.

This is a thread about the specific FAQ on Why Am I Blocked? and whether it meets the need or not. I am always open to suggestions.

Miss Betsy

[Wazoo]

...Another possible suggestion: one high-level pinned FAQ with sparse details and hyperlinks to other locked posts with greater detail.  That might address agsteele's problem of it being "quite a tough read. A lot of text and I found it easy to lose the thread."

Right now, as far as I can come up with, there are several issues with trying to do it the way I think you're suggesting.

1. note that the default set-up is to show the "last 30 days" worth. It appears that the Pinned items over-ride that setting, thuis remaining "in view" .. Perhaps the links wouldn't be affected, but I've been caught so many times in Search mode, for example, by this 30-day default setting .... maybe it's not that big of a thing, but I'm also not sure what the constraints are in this package .. install requires SQL support, so data fields may have some bearing, but again, that's a JT thing the we know nothing about.

2. How would one Title a "Super-Faq" to allow enough detail to indicate that "this is the one" without taking up more of the screen by the line-wrapping in that title-block? Again, maybe not that big of an issue, but ....

3. That users now have to scroll through the titles should help draw their "interest" first that their problem has already been noted .... shortening up the list and combining/crunching the titles would allow for more of the "didn't see it anywhere" routine ... and lordy, I get enough of that over in the Microsoft newsgroups ... "I've searched everywhere and didn't see it anywhere" .. and I'm looking at the same question asked 300 times a day, every frigging day ... no idea how you could look and not see sometimes .. but, i digress a bit <g>

4. I think we're all pretty much convinced that there needs to be a bit more framework set up to allow for more variations of discussion points, but .... JT is the only one that can handle that part of the set-up. This was much discussed back in the beginning, brought up many times since, and there's been a note or two sent put today on it again.

I'm going with Miss betsy's reaction this evening as being at the end of along day. Her FAQ attempt has been in place for quite some time with no input for a while. This recent activity was based on a user coming with a bit of attitude, and per that discussion, "we" thought "we'd" try to handle the issues by moving stuff around (as stated in my "moved" it post ... I just think she's a bit taken aback by the suggestions coming now talking about a whole re-do of what she worked hard to create ... not that the suggestions are at issue .. just call it a matter timing <g> .... Tomorrow willl be a better day for a number of us, we hope <g>

[yourbuddy]

Some "layout work" and "wording tweeks" and it's a hit tune.

Examples and specifics would go a long ways <g>

I was actually referring to the specifics already suggested,

all of which were well considered, and some of which may

provide enhancements. It sure doesn't need my "help"

[yourbuddy]

[aside to yourbuddy: this is a /spamcop/ FAQ, of course it is going to reflect the spamcop viewpoint]

Yes, and a great/perceptive, etc. job it is too ...

I was just being very complementary (this time)

Perhaps that was confusing/disorienting (sorry!!)

[Miss Betsy]

Thanks, yourbuddy! I should have acknowledged that I did see your post as a compliment as well as maybe adding a "Doh!" or emoticon to my remark about it being a spamcop FAQ to show that it was not being seriously taken as a criticism.

Miss Betsy

[turetzsr]

...Another possible suggestion: one high-level pinned FAQ with sparse details and hyperlinks to other locked posts with greater detail.  That might address agsteele's problem of it being "quite a tough read. A lot of text and I found it easy to lose the thread."

If what your suggestion was, was to have like one or two 'super' FAQ with links to other topics, that's a good suggestion, but it has nothing to do with the FAQ on Why Am I blocked?  Which does have links.

<snip>

...Yes, that was my suggestion but as applied to the "Why Am I blocked?" FAQ. Yes, it does have links, but it also has very long (and very helpful) discussion which could be shunted off to separate postings. For example, suppose I were an admin-type looking at the FAQ -- I might not care so much about the "For people whose email was returned" part and so having it in a separate post instead of the FAQ itself would be a good thing for me!

Right now, as far as I can come up with, there are several issues with trying to do it the way I think you're suggesting.

1. note that the default set-up is to show the "last 30 days" worth.  It appears that the Pinned items over-ride that setting, thuis remaining "in view" .. Perhaps the links wouldn't be affected, but I've been caught so many times in Search mode, for example, by this 30-day default setting ....

...Hmm - not sure what the problem is that you're concerned about. Presumably the main "Why Am I Blocked" FAQ would be pinned and so remain in view and the sub-FAQ would be linked to from the main one. The idea thus being that the Search option wouldn't need to be used for answers that can be found in the FAQ.

2.  How would one Title a "Super-Faq" to allow enough detail to indicate that "this is the one" without taking up more of the screen by the line-wrapping in that title-block?  Again, maybe not that big of an issue, but  ....

...No change -- it would be entitled "FAQ: Why Am I Blocked" or "FAQ: Why Am I Blocked and Server Admin Help" or something along those lines.

3. That users now have to scroll through the titles should help draw their "interest" first that their problem has already been noted .... shortening up the list and combining/crunching the titles would allow for more of the "didn't see it anywhere" routine

...Not sure how my suggestion would make this problem any worse....

4.  I think we're all pretty much convinced that there needs to be a bit more framework set up to allow for more variations of discussion points, but ....  JT is the only one that can handle that part of the set-up.  This was much discussed back in the beginning, brought up many times since, and there's been a note or two sent put today on it again.

...Yes, but my suggestion is independent of that. Incorporating my suggestion would, I think, require only:

• breaking out much of the text of the current "Why Am I Blocked" FAQ into separate postings and locking them
  
• replacing that text in the "Why Am I Blocked" FAQ with links to the separate ones
  

I'm going with Miss betsy's reaction this evening as being at the end of along day.  Her FAQ attempt has been in place for quite some time with no  input for a while.  This recent activity was based on a user coming with a bit of attitude, and per that discussion, "we" thought "we'd" try to handle the issues by moving stuff around (as stated in my "moved" it post ...  I just think she's a bit taken aback by the suggestions coming now talking about a whole re-do of what she worked hard to create ...  not that the suggestions are at issue .. just call it a matter timing <g> .... <snip>

...Understood, but I don't think what I'm suggesting requires much of a rewrite (see bulleted list I entered in my response to your point 4). It would certainly be far less work than Miss Betsy and others have already put into the FAQ so far!

[Miss Betsy]

...Yes, that was my suggestion but as applied to the "Why Am I blocked?" FAQ. Yes, it does have links, but it also has very long (and very helpful) discussion which could be shunted off to separate postings. For example, suppose I were an admin-type looking at the FAQ -- I might not care so much about the "For people whose email was returned" part and so having it in a separate post instead of the FAQ itself would be a good thing for me!

I don't have time to look it up now, but I believe there is a general statement; a section for people who are admins that goes to three links; and then a statement that admins can skip the rest of the FAQ.

The section for admins is purposefully short so that people who are not admins will get to their section before they give up reading. It also is short because admins, hopefully will not need much direction about IP addresses, etc. The admin section is first because they are busy people. Even if they do miss the statement about skipping the rest, they probably will skip it as soon as they read the first couple of paragraphs since they already know all that.

IMHO, If there are two FAQ or even two links in one FAQ, there will be a number of people who will get the wrong one and come storming into the forum with either "I couldn't understand a word of what you said!" or "What drivel when all I want to know is when I can get delisted!"

Now to have a "super FAQ" entitled "Problems with Reporting? - see this FAQ first" with a list of all the possible problems

Email submissions disappearing

"Would Send"

Etc.

Even having the same link under different headers might be a good idea, because some people think their problem is that they are getting a "Would Send" message and someone else thinks that spamcop isn't sending reports any more.

IMHO, the Cost of spam (which was just a link from the Why Am I blocked) and the Spammer Rules should go in the Lounge if people want them pinned.

That would reduce the number of Pinned items considerably.

Miss Betsy

[Wazoo]

Cost of spam (which was just a link from the Why Am I blocked)

is it still? ... have to look <g>

OK, yes it is still ... and went ahead and moved it ... still wish there was another spot beside Lounge ... nothing from JT yet on this issue ...

the Spammer Rules should go in the Lounge

Done