I'm blocked but not blacklisted

[Pelorus]

Hello!

I'm from Croatia.

I read all the "Why Iam Blocked FAQ" and all the topics in this sub-forum but I did not find anything that could explane me what to do next in this situation (my English is not very good so unfortunatly I didn't understand most of the technical explanations).

I use my mother's e-mail provided by our (only one) ISP provider. We use this mail only to contanct our father that works on a ship (via Globeemail) and for nothing else (we don't send any other mail).

Today we were unable to send any mail as our IP adress was blocked by SpamCop.

This is the message we received:

-------------------------------------------------------------------

This is the Qmlai program at host ls422.t-com.hr.

I'm sorry to have to inform you that your message could not

be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can

delete your own text from the attached returned message.

The Qmlai program

<XXXXXX.HOMT[at]globeemail.com>: host losmtpgate3.globeemail.com[207.212.243.4]

said: 550 5.7.0 Your server IP address is in the SpamCop database, bye (in

reply to RCPT TO command)

__________ NOD32 1.1322 (20051214) Information __________

This message was checked by NOD32 antivirus system.

http://www.eset.com

Reporting-MTA: dns; ls422.t-com.hr

X-Qmlai-Queue-ID: CC6ED988BBB

X-Qmlai-Sender: rfc822; XXXXXXX.XXXXXXXX[at]ri.t-com.hr

Arrival-Date: Wed, 14 Dec 2005 18:23:42 +0100 (CET)

Final-Recipient: rfc822; XXXXXX.HOMT[at]globeemail.com

Action: failed

Status: 5.0.0

Diagnostic-Code: X-Qmlai; host losmtpgate3.globeemail.com[207.212.243.4] said:

550 5.7.0 Your server IP address is in the SpamCop database, bye (in reply

to RCPT TO command)

Subject:

TEST

From:

Olivera <XXXXXXX.XXXXXXXXX[at]ri.t-com.hr>

Date:

Wed, 14 Dec 2005 18:23:46 +0100

To:

TSURUSAKI <XXXXXX.HOMT[at]globeemail.com>

TEST

----------------------------------------------------------------

This is my IP adress: 194.152.245.17

I called our ISP provider but they told me that everything is ok and that they don't know what is the cause of the problem.

Now, I read the topics with other similar problems but as the answers look more strictly releated to the problem (not generic answers) I don't know what to do next.

I hope someone can tell me (in a 'less' technical way if possible) what should be my next moves?

Thank you in advance.

Greetings,

Darian

[Telarin]

Well, unfortunately the globeemail mail server does not seem to be kicking back the IP address of the sending server, so that doesn't give us much to work with at this point. What we need is the IP address of your sending SMTP server, not of your actual computer. It should be in the message headers somewhere, if the email is coming back with the headers, those would be very useful as they would tell us which IP address is causing the problem.

One thing I can tell your for certain is that if your ISP is in the SCBL, everything is most definitely not ok on their end. It means they are either following some bad mail practices (misdirected bounces, etc), or are allowing spammers to operate on their network either from negligence, or worse intentionally.

The first thing to do would be to provide us with the headers from one of these emails if possible, as they will provide us the information we need to help you.

[StevenUnderwood]

Found some servers possibly related to your ISP not listed in SpamCop but in other lists:

194.152.245.160

194.152.245.88

194.152.245.214

194.152.245.52

194.152.245.16

194.152.245.184 listed in dnsbl.njabl.org ( 127.0.0.9 )

194.152.245.77 listed in dnsbl.sorbs.net ( 127.0.0.2 )

194.152.245.57

Also, if you plug each IP into this URL ( http://www.senderbase.org/?searchBy=ipaddress&sb=1 ) there is lots f traffic travelling out of most of these servers related to their average.

[Wazoo]

http://www.senderbase.org/?sb=1&searchBy=o...atian%20Telecom lists 125 'known' "Addresses in Croatian Telecom used to send email" ... so the problem is, which one of these might be yours, just to try to dig up any specific data. However, a rather interesting bit is to look yp the IP address you offered ... http://www.senderbase.org/?searchBy=ipaddr...=194.152.245.17 which only lists 8 of those 125. Walking through the links provided, it would appear that Croatian Telecom's 'solution' to some problems is to simply move the e-mail server to a new IP address ... this doesn't seem to suggest that the actual problem is being handled ... for instance;

Report on IP address: 194.152.245.88

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ........ 3.9 .. 12145%

Last 30 days .. 2.7 .... 706%

Average ........ 1.8

That would normally look very bad, but .... oit may be due to the rerouting of all the traffic that was handled by these other IP addresses;

Report on IP address: 194.152.245.160

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ........ 0.0 .. -100%

Last 30 days .. 2.8 ... 699%

Average ........ 1.9

Report on IP address: 194.152.245.214

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ........ 0.0 .. -100%

Last 30 days .. 2.7 ... 585%

Average ........ 1.9

Report on IP address: 194.152.245.52

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ......... 0.0 .. -100%

Last 30 days ... 2.7 ... 703%

Average ........ 1.8

on and on, noting also that some of these other IP addresses made it onto other BlockLists .... it sounds like you might have the need to find yet another e-mail provider ..????

[turetzsr]

Hi, Darian,

...Sorry to hear of your problem. Your English seems very good to me (and CERTAINLY better than my Serbo-Croatian <g>).

...No disrespect to the very good answers provided above by Telarin, StevenUnderwood and Wazoo but they seemed a bit technical to me, so I thought I'd add some things to what they told you.

...(1) From what you posted, I would say that Globeemail is not providing enough information. "Your server IP address is in the SpamCop database" is just not enough information. I hope your father can prevail upon Globeemail to change the message to include the IP address in future reject messages.

...(2) From what you posted, your ISP is not inclined to help you and you can't switch to another because it's the only one available to you. I think you may be able to get around that problem by signing up with an e-mail provider so that your e-mail will go out through the e-mail provider's servers and not directly from your ISP's servers. Personally, I use Yahoo!Mail: (http://mail.yahoo.com/) because it is free and I am a cheapskate. <g> There are other such e-mail providers, both free and paid, including SpamCop e-mail ( $30/year: filtered POP/IMAP/web mail and reporting) and MSN/HotMail by Microsoft (I am not promoting any specific e-mail provider and have no relationship, other than as a Yahoo!Mail user, with any provider).

...(3) I hope you will continue to try to collect and present to your ISP enough information to convince them that they have a problem and that they will fix it. spam is a scourge.

...Good luck!

[Pelorus]

Thank you for your quick replies.

This is the header (if this is the information that you need) of one of the messages (I use Firefox so it didn't show them by default, sorry for that).

--------------------------------------

Subject: Undelivered Mail Returned to Sender

From: MAILER-DAEMON[at]ls422.t-com.hr (Mail Delivery System)

Date: Wed, 14 Dec 2005 19:11:06 +0100 (CET)

To: XXXXXXX.XXXXXXXXX[at]ri.t-com.hr

X-Account-Key: account2

X-UIDL: UID135-1131479747

X-Mozilla-Status: 0001

X-Mozilla-Status2: 10000000

Return-Path: <>

Delivered-To: XXXXXXXX[at]pop.htnet.hr

Received: from as404.t-com.hr (as404.t-com.hr [195.29.150.23]) by as403.t-com.hr (lmtpd) with LMTP

Received: from ls422.t-com.hr (ls422.t-com.hr [195.29.150.237]) by as404.t-com.hr (Postfix) with ESMTP id 69AB73626 for <XXXXXXXX[at]pop.htnet.hr>; Wed, 14 Dec 2005 19:11:06 +0100 (CET)

Received: by ls422.t-com.hr (Qmlai) id 542A29890B0; Wed, 14 Dec 2005 19:11:06 +0100 (CET)

MIME-Version: 1.0

Content-Type: multipart/report; report-type=delivery-status; boundary="8C7629890A9.1134583866/ls422.t-com.hr"

Message-ID: <20051214181106.542A29890B0[at]ls422.t-com.hr>

---------------------------------------------

I hope this is the correct header.

If you need some more information regarding this problem please tell me.

I forgot to mention before that whan I called my ISP and said to them that my IP was blocked by SC they told me that they have nothing to do with it as it is not up to them and that I should try to contact SC (the operator told me that this could be very hard as most anti-spam companies don't have a customer support?!) and ask them for help.

I'm glad he was wrong.

Thanks again for your help.

Greetings,

Darian

[Pelorus]

Thank for your 'less' technical answer Telarin, I was writing the reply at the same time you posted so I didn't noticed it before.

Unfortunately this is for now the only true ISP. There are some smaller others but as they have to rent the infrastructure from the big one thay are not so cheaper.

I have already made an account on yahoo, but unfortunately (I don't know why) all mail sent to my father from my yahoo account are unsent (I don't get the unsent notification but nether the sent confirmation).

The ISP operators were wery polite by they always told me "it's not our problem".

If there is no other way I hope to gather with your help all the information needed to show them that they DO have a problem.

BTW I read in the FAQ that this block can be removed after 24h or something like this. Could this also be the case?

Thanks.

Greetings,

Darian

[Jeff G.]

The IP Address of your SMTP Relay / Smarthost ls422.t-com.hr [195.29.150.237] appears to be in the process of delisting. Please ask your ISP to see the following info from http://www.spamcop.net/w3m?action=checkblo...=195.29.150.237 (reproduced here for posterity because it will be going away shortly):

195.29.150.237 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 0 hours.

Causes of listing

    * System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

Additional potential problems

(these factors do not directly result in spamcop listing)

    * System administrator has already delisted this system once

Because of the above problems, express-delisting is not available

Listing History

In the past 85.4 days, it has been listed 4 times for a total of 4.4 days

Other hosts in this "neighborhood" with spam reports

195.29.150.24

Dispute Listing

If you are the administrator of this system and you are sure this listing is erroneous, you may request that we review the listing. Because everyone wants to dispute their listing, regardless of merit, we reserve the right to ignore meritless disputes.

Dispute listing of 195.29.150.237

SpamCop Reports about 195.29.150.237 would be sent to abuse[at]htnet.hr at present. Report History is as follows:

Submitted: Saturday 2005/12/10 20:52:01 -0500:

Internet Backgammon

1581990984 ( http:// www.backgammongamer.info/index.html ) To: mole[at]devnull.spamcop.net

1581990979 ( 195.29.150.237 ) To: mole[at]devnull.spamcop.net

Also, please encourage "CARNet - Croatian Academic and Research Network" to establish a WHOIS Server for the "hr" ccTLD (Country Code Top Level Domain). Their phone number is +385 1 616 55 11. Thanks!

[Pelorus]

Thanks to everybody for your help.

I was able to send 2 mails but the it was blocked again.

Unfortunately my ISP doesn't want to listen me about my problem. I have told them about the problem but they keep saying it's impossible that it's happening.

BTW, does somebody know why I cannot send any mail from my yahoo account to the globeemail server. My father didnt' get any message that I tried to send to him from yahoo (while my primary mail was blocked)?

Thanks again for your time.

Greeting,

Darian

[turetzsr]

<snip> 

BTW, does somebody know why I cannot send any mail from my yahoo account to the globeemail server. My father didnt' get any message that I tried to send to him from yahoo (while my primary mail was blocked)? 

<snip>

37888[/snapback]

Hi, Darian,

...Have you contacted Yahoo!Mail Customer Care to ask them to look into this problem? It may also be of help if your father could ask Globeemail to try to work the problem at their end -- perhaps they are blocking all e-mail from Yahoo, for example.

[Miss Betsy]

Try opening a Hotmail or Gmail account and see if that also doesn't go through.

Or if you can talk to your father via some other way (phone, fax, postal mail), ask him to get a Yahoo (Hotmail, Gmail) account and see if you can't communicate that way.

But don't give up on trying to explain to your ISP what is wrong with what they are doing and how you are not happy with their service.

Good Luck,

Miss Betsy

[Pelorus]

Try opening a Hotmail or Gmail account and see if that also doesn't go through.

Or if you can talk to your father via some other way (phone, fax, postal mail), ask him to get a Yahoo (Hotmail, Gmail) account and see if you can't communicate that way.

But don't give up on trying to explain to your ISP what is wrong with what they are doing and how you are not happy with their service.

Good Luck,

Miss Betsy

37919[/snapback]

I have contacted Yahoo customer support. I'm waiting for their answer.

Thank you for your help.

Greetings...

P.S.

No problems with the server so far

[Jeff G.]

The IP Address of your SMTP Relay / Smarthost ls422.t-com.hr [195.29.150.237] appears to be in the process of delisting.  Please ask your ISP to see the following info from http://www.spamcop.net/w3m?action=checkblo...=195.29.150.237 (reproduced here for posterity because it will be going away shortly)

37845[/snapback]

Uh oh, 195.29.150.237 appears to be listed by the SCBL, and was listed three more times in the past week. Report History shows the following new info:

Submitted: Friday 2005/12/16 10:31:51 -0500:

M-Ros Novosti

1588608947 ( 195.29.150.237 ) To: abuse[at]htnet.hr

Please ask abuse[at]htnet.hr about this. Thanks!