Jump to content
Sign in to follow this  
Goldencard

Please help! 210.0.235.98 has been listed again!

Recommended Posts

210.0.235.98 has been listed for three times. We called our ISP to solve the problem, we have been delisted for few days, but today we found we are listed again.

I have read the FAQ already. But we didn't do anything that make ourselves listed. Is it because we are using share IP with others? Or any other reasons?

Anything we can prevent to be listed again? Really annoying~

Share this post


Link to post
Share on other sites
210.0.235.98  has been listed for three times.  We called our ISP to solve the problem,  we have been delisted for few days, but today we found we are listed again.

36017[/snapback]

Well, if you share that IP for outgoing email, your ISP has plenty of evidence to track down the source. Below are just the recent reports submitted by spamcop members. It is also possible that someone has an infected machine allowing spammers to use that machine to send their spew.

Report History:

--------------------------------------------------------------------------------

Submitted: Sunday, November 13, 2005 5:24:20 AM -0500:

Please Restore Your Account Access

--------------------------------------------------------------------------------

Submitted: Friday, November 11, 2005 1:47:27 PM -0500:

*** spam *** Account Information Needs To Be Updated

--------------------------------------------------------------------------------

Submitted: Thursday, November 10, 2005 9:12:11 PM -0500:

Update Your Account Information

--------------------------------------------------------------------------------

Submitted: Thursday, November 10, 2005 1:07:12 AM -0500:

Account Information Needs To Be Updated

--------------------------------------------------------------------------------

Submitted: Thursday, November 10, 2005 1:07:12 AM -0500:

Account Information Needs To Be Updated

--------------------------------------------------------------------------------

Submitted: Wednesday, November 09, 2005 9:05:37 AM -0500:

Update Your Account Information

--------------------------------------------------------------------------------

Submitted: Wednesday, November 09, 2005 1:14:29 AM -0500:

Update Your Account Information

--------------------------------------------------------------------------------

Submitted: Monday, November 07, 2005 7:10:40 PM -0500:

Verify Your Account Information

--------------------------------------------------------------------------------

Submitted: Friday, November 04, 2005 3:56:02 AM -0500:

Update Your Account Information

--------------------------------------------------------------------------------

Submitted: Thursday, November 03, 2005 1:13:44 PM -0500:

Update Your Account Information

--------------------------------------------------------------------------------

Share this post


Link to post
Share on other sites

If they were sent today, SpamCop Reports about hm3.hosting-mail.com [210.0.235.98] would be sent to (and have been sent to) Hutchison Whampoa Enterprises Limited's abuse[at]hgcbroadband.com - please contact that address and/or company to urge them to be more responsive and proactive in stopping the spam that has been coming from that server. Please also add to the woefully inadequate information at http://www.enom.com/domains/whois.asp?Doma...x=20&submit.y=4. Thanks!

Share this post


Link to post
Share on other sites
210.0.235.98  has been listed for three times.  We called our ISP to solve the problem,  we have been delisted for few days, but today we found we are listed again.

Define "we" ....

I have read the FAQ already. But we didn't do anything that make ourselves listed.  Is it because we are using share IP with others? Or any other reasons?

Anything we can prevent to be listed again?  Really annoying~

36017[/snapback]

One would think that you would know if you were running your own e-mail server, were paying for a dedicated e-mail server, or were simply using something provided as part of your user account with an ISP .... starting point for figuring that out would usually start with how much you are paying for this ISP's services.

http://www.spamcop.net/w3m?action=checkblock&ip=210.0.235.98

currently shows that user complaints are the primary reason for a SpamCopDNSBL listing.

http://www.senderbase.org/?searchBy=ipaddr...ng=210.0.235.98 shows that SpamCop isn't the only BL this IP is listed in ....

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ........ 4.5 .. 2171%

Last 30 days .. 3.5 .... 131%

Average ........ 3.1

Noting the same scenario shown in so many other "why am I listed" posts in this Forum, there is an issue with that large increase in traffic ... however, back to "is this a shared server" ..????

http://forum.spamcop.net/forums/index.php?showtopic=4556 would suggest that the current traffic coming from the IP address is somewhere around 85 thousand e-mails a day (as compared to a developed average of maybe 2 thousand e-mails a day ... do these numbers match "your" outgoing e-mail loads? If not, then it would be an easy assumption that you are "sharing" that e-mail server with someone else. But then again, this should have already been discussed with your ISP ...????

If this your server, start checking your logs (e-mail, firewall, server, ...)

If this is your ISP's server, raise the complaint with them.

It's hard to guess at just "what" FAQ (entry) you've read .... It is seen that you apparently didn't read some of them developed "here" or read some of the "How to ..." items, else you'd have included more information in your original query .... For example, you say "we are blocked" ... yet, you don't provide any of the "blocked/error message data" . you then waffle a bit about knowing just exactly who the "we" might be (you or your ISP or something else) ... any of the (SpamCop) FAQs made available would have stated that it is the IP address that finds its way onto a BL, and its the use of that data/BL by the receiving ISP that may turn a BL listing into a Blocking action .... For example, you may send out 1,000 e-mails ... 200 of them hit an ISP that may be using the SpamCopDNSBL ... 160 of those ISPs have configured their systems to reject e-mail coming from an IP address found to be on the BL ..... 80 of those ISPs further chose to simply delete this e-mail, the remainder sending back an error message, of which only 60 make it past your ISP's incoming spam filters. And it's about these 60 messages that you then come in here and complain that "you are blocked" .....

How much of the above actually fits your situation, there's no way anyone on this side of the screen that can guess .... this is why the initial instructions on How to ask a question seem so extensive ... there's a lot of things in between you sending an e-mail and someone here trying to tell you why it was "blocked" .. most of those things are not controlled by anyone at SpamCop.net ....

Share this post


Link to post
Share on other sites

Thanks very much for your help. I have already raised the complaint to ISP. Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98 is in blocked list.

Can anybody tell me why? Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000

Received: from unknown (HELO mike) (59.57.162.90)

by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000

Message-ID: <000701c5e8e6$2b9c1aa0$0100a8c0[at]mike>

MIME-Version: 1.0

Content-Type: text/plain;

charset="gb2312"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3 (Normal)

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook, Build 10.0.2627

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

Importance: Normal

In-Reply-To:

Share this post


Link to post
Share on other sites

That would be due to dns propagation delays. Please keep trying. Thanks!

Share this post


Link to post
Share on other sites
... Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.

Can anybody tell me why?  Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000

Received: from unknown (HELO mike) (59.57.162.90)

  by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000...

36022[/snapback]

Could be several reasons, including exactly how the receiver is using the SCBL (and propogation delays as Jeff says) - whether it really is the SCBL doing the blocking (the message may be in error as to that detail), noting 210.0.235.98 is currently on the SORBS list and still showing a high level of activity (refer http://www.senderbase.org/?searchBy=ipaddr...35.98&showRBL=1 concerning both). "unknown (HELO mike) (59.57.162.90)" seems strange, its abuse address is abuse[at]fjdcb.fz.fj.cn and .cn is not noted for being at the forefront in the war on spam. Edited by Farelf

Share this post


Link to post
Share on other sites
"unknown (HELO mike) (59.57.162.90)" seems strange, its abuse address is abuse[at]fjdcb.fz.fj.cn and .cn is not noted for being at the forefront in the war on spam.

36024[/snapback]

Please note that the entire 59.57.0.0/16 network (64K IP Addresses) for China's Fujian Province appears (along with many other networks) to be afflicted with lack of RDNS - Chinanet's Hostmasters are not "following the INSTRUCTIONS" per Section "INSTRUCTIONS - Adding a host - Add the reverse IN-ADDR entry" of RFC1033 "DOMAIN ADMINISTRATORS OPERATIONS GUIDE", to wit:
INSTRUCTIONS...
   Adding a host.

      To add a new host to your zone files:

         Edit the appropriate zone file for the domain the host is in.

         Add an entry for each address of the host.

         Optionally add CNAME, HINFO, WKS, and MX records.

         Add the reverse IN-ADDR entry for each host address in the
         appropriate zone files for each network the host i[s] on.

Share this post


Link to post
Share on other sites
Thanks very much for your help. I have already raised the complaint to ISP.  Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.

Can anybody tell me why?  Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

--- Below this line is a copy of the message.

Received: (qmail 17843 invoked from network); 14 Nov 2005 06:36:33 -0000

Received: from unknown (HELO mike) (59.57.162.90)

  by hm3.hosting-mail.com with SMTP; 14 Nov 2005 06:36:33 -0000

Message-ID: <000701c5e8e6$2b9c1aa0$0100a8c0[at]mike>

MIME-Version: 1.0

Content-Type: text/plain;

charset="gb2312"

Content-Transfer-Encoding: quoted-printable

X-Priority: 3 (Normal)

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook, Build 10.0.2627

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

Importance: Normal

In-Reply-To:

36022[/snapback]

I'm a bit confused. This Topic was started by asking about a SpamCopDNSBL listing of 210.0.235.98 .... but this last posting deals with an e-mail blocked that points back to 59.57.162.90 (which coincidentally matches another IP address showing for Moderators in this post) ...???? What's the connection between the two IP addresses? The immediate (and probably wrong, but based on the only data provided) assumption is that this e-mail was sent by other than an ISP's e-mail server and the receiving system has a configuration issue with pulling up the wrong error message based on the use of another BL, possibly one using a 'dial-up' list of IP blocks .....

Share this post


Link to post
Share on other sites

It appears that the latest quoted data is a bounce from 210.0.235.98 (ns3.hosting-mail.com, which originally received the message from Goldencard's computer "mike" at 59.57.162.90) saying that ns3.hosting-mail.com couldn't deliver to the final destination (one of goldencard.net's mailservers mail.goldencard.net or relay.hosting-mail.com) because ns3.hosting-mail.com's IP Address 210.0.235.98 was still listed by the SCBL. That should no longer be the case, as ns3.hosting-mail.com's IP Address 210.0.235.98 was delisted by the SCBL over 13 hours ago.

Share this post


Link to post
Share on other sites

All in how one defines "--- Below this line is a copy of the message." I guess. The "How to ..." stuff states that "we" would like to see the "rejection" notification rather than the e-mail that allegedly triggered a blocking action .... and I did caveat my remarks with "based on data provided" .... I read the "offered" e-mail as being a continuation of the "your e-mail was blocked" information, bot noting the suggested change in perspective to "here's the e-mail that was blocked" ....

Share this post


Link to post
Share on other sites
Chinanet's Hostmasters are not "following the INSTRUCTIONS" per Section "INSTRUCTIONS - Adding a host - Add the reverse IN-ADDR entry" of RFC1033 "DOMAIN ADMINISTRATORS OPERATIONS GUIDE"

36027[/snapback]

They are also not complying with "Every Internet-reachable host should have a name" and "Make sure your PTR and A records match" per Section 2.1 of RFC1912 Common DNS Operational and Configuration Errors.

Share this post


Link to post
Share on other sites
Thanks very much for your help. I have already raised the complaint to ISP.  Meanwhile, I have checked 210.0.235.98 not listed in bl.spamcop.net. But when I sent email to customer, it shown that 210.0.235.98  is in blocked list.

Can anybody tell me why?  Thank you.

Remote host said: 501 5.7.1 <goldencard[at]goldencard.net>... Sender refused by the DNSBL bl.spamcop.net

36022[/snapback]

There are several possible reasons why this can happen.

1) Not all users of the SpamCop BL are using real time versions. Some use cached versions that may take some time to update, so even it an IP shows as not listed in the real time list, it may still appear in some of the cached lists that have not been updated.

2) Some mail rejectors use standardized replies that are not always accurate. They may state that a message was blocked due to the SpamCopBL when in reality it was blocked for some other reason.

3) The IP address may have been on the SpamCopBL at the time when the message was bounced, but had been removed prior to the sender checking the list.

I realize that this is not much help, but maybe it will explain differences between being on the list vs off the list.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×