Jump to content
Sign in to follow this  
andydills

Respectful request for assisstance

Recommended Posts

Hello, I'm the administrator of Xecunet.

Spamcop is currently listing 216.127.136.199, 216.127.136.203,

216.127.136.204, 216.127.136.223, 216.127.136.136.224 in bl.spamcop.net.

This perplexes me. We're very much white-hat, and we're not listed in any

other black lists. When I visit your website, I'm not able to retrieve any

sort of evidence supporting why we were listed.

Given our mail architecture, it would be trivial for me to renumbers these mail servers (they aren't referenced directly by anything except an L4 loadbalancer). However, that's a band-aid, not a solution. I'd much rather get de-listed than renumber; however, our 10k+ customers are justifiably pissed, so I'll do what I need to do.

Can somebody help me out? I know for a fact our mailservers are not spam sources, and I suspect this is all regarding errant bounce messages.

Thanks,

Andy

Share this post


Link to post
Share on other sites

Thanks, but I read that before I posted.

However, without evidence of the reported spam, and without a timestamp to go on to determine the "48 hour period", there's absolutely nothing to move forward with.

Thanks,

Andy

Share this post


Link to post
Share on other sites

Hi, Andy!

...Please try dropping a note to deputies <at > admin.spamcop.net. The helpful SpamCop.net deputies may be able to assist you.

Share this post


Link to post
Share on other sites
Hello, I'm the administrator of Xecunet.

Spamcop is currently listing 216.127.136.199, 216.127.136.203,

216.127.136.204, 216.127.136.223, 216.127.136.136.224 in bl.spamcop.net.

This perplexes me. We're very much white-hat, and we're not listed in any

other black lists. When I visit your website, I'm not able to retrieve any

sort of evidence supporting why we were listed.

Given our mail architecture, it would be trivial for me to renumbers these mail servers (they aren't referenced directly by anything except an L4 loadbalancer). However, that's a band-aid, not a solution. I'd much rather get de-listed than renumber; however, our 10k+ customers are justifiably pissed, so I'll do what I need to do.

Can somebody help me out? I know for a fact our mailservers are not spam sources, and I suspect this is all regarding errant bounce messages.

Thanks,

Andy

The SCBL output pages aren't updated in real time. It sometimes takes 30 min. to an hour to be fully updated. Give it another 30 minutes or so and there will probably be an update. You might check your abuse[at] & postmaster[at] inboxes for spam reports, if you haven't done so recently.

Share this post


Link to post
Share on other sites

Looking at those addresses right now, I don't see any of them on the bl.

Looking at senderbase, both the 199 and 204 addresses appear very recent and both have a large volume change over the average. Are these new hosts? There was talk of a change recently which listed large volume coming from new hosts immediately, even without reports.

You will need to contact the deputies as mentioned elsewhere to get this looked at. Or have you already, which is why I am not seeing them on the list.

Share this post


Link to post
Share on other sites
Can somebody help me out? I know for a fact our mailservers are not spam sources, and I suspect this is all regarding errant bounce messages.Can somebody help me out? I know for a fact our mailservers are not spam sources, and I suspect this is all regarding errant bounce messages.

SpamCop does not report bounce messages and rejects any attempt for one to use SpamCop for this purpose. A person circim navigating SpamCop for this purpose is likley to be fined and or expelled for doing so

http://www.spamcop.net/fom-serve/cache/14.html

You would have a security problem or be a spam source if listed by SpamCop

However I cannot see any of the IP's as presently listed?

A couple have been sending spam to spamtraps? So unless spamcop is silently reporting bounces? Which SpamCop should not be! SpamCop can detect bounce messages and disregard them?)

216.127.136.199

216.127.136.203 Been detected sending mail to spam traps

216.127.136.204 Been detected sending mail to spam traps

216.127.136.223

Edited by petzl

Share this post


Link to post
Share on other sites

Andy got in touch with us and I think we have the problem under control ...

Share this post


Link to post
Share on other sites

Ellen ...

That's great, but was one of their servers compromised in any way,

or was there an "error" of any kind at all (on the part of SpamCop)?

Postings here generally assume that SpamCop is "usually" right.

Perhaps an answer may help with answering future situations.

Share this post


Link to post
Share on other sites

um I can't remember -- I am running thru 50-70 emails/IPs a day and if it didn't happen in the last 5 minutes it's been erased from mind -- it was probably anti-spam/virus autoresponders to spamtraps or something like that ...

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×