Blocked IP address

[timmyt]

Hello,

I don't know all the posting rules here and I have only average computer knowledge!

I'll try to give you all the facts as I know them so someone can get me out of this blocked email list jam.

1)I use Verizon DSL for my ISP and work out of my house.

2) I'm using Outlook Express and have configured my business mail to send/receive from the domain and mail hosting service I own and/or subscribe to.

3) I don't send any marketing or spam email - ever!!!

Here's what happens right out of the blue (for about the 3rd or 4th time in the last couple months) when I try to send outgoing mail from one of my business email accounts via Outlook Express on my home connection:

An unknown error was returned from the SMTP server. Account: 'Timmy T.', Server: 'mail.webtixdirect.com', Protocol: SMTP, Server Response: '571 71.127.2.167 was found in bl.spamcop.net', Port: 25, Secure(SSL): No, Server Error: 571, Error Number: 0x800CCC61

I have spent hours on this issue with Verizon and trying to read online and I tried to get off the list but the email goes to Verizon? I seemed to have fallen off the list in the past but the time lost is killing me......

HELP and THANKS,

Tim

[turetzsr]

Hi, Tim!

An unknown error was returned from the SMTP server. Account: 'Timmy T.', Server: 'mail.webtixdirect.com', Protocol: SMTP, Server Response: '571 71.127.2.167 was found in bl.spamcop.net', Port: 25, Secure(SSL): No, Server Error: 571, Error Number: 0x800CCC61

I have spent hours on this issue with Verizon and trying to read online and I tried to get off the list but the email goes to Verizon? I seemed to have fallen off the list in the past but the time lost is killing me......

71.127.2.167 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in a short time.

Causes of listing

• System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
  

Automatic delisting

If you are the administrator of pool-71-127-2-167.spfdma.east.verizon.net and you are sure it will not be the subject of any more reports of spam, you may cause the system to be delisted without waiting for us to review the issue.

You may only do this once per IP! So please be sure that the problem is really and truly resolved. If you delist your system and we get more spam reports about it, you will not be allowed to expedite delisting again. Delisting normally occurs 24 hours after spam reports have ceased.

You must be able to receive mail at one of the addresses below. Until you have received and confirmed your request, it will not take effect.

Looking for potential administrative email addresses for 71.127.2.167:

....cannot find an mx for pool-71-127-2-167.spfdma.east.verizon.net

....cannot find an mx for spfdma.east.verizon.net

....cannot find an mx for east.verizon.net

....206.46.232.11 is an mx ( 0 ) for verizon.net

....postmaster[at]verizon.net redirects to abuse[at]verizon.net

<snip>

Listing History

System has been listed for 30 hours.

<snip>

...From the machine name ("pool-71-127-2-167.spfdma.east.verizon.net") associated with the IP address you posted, 71.127.2.167, it appears that your machine has been fingered as the one sending spam. My guess would be that you have some malware infecting your machine. Do you have a firewall? Anti-virus software? Anti-spyware software? Is it up-to-date?

[agsteele]

...From the machine name ("pool-71-127-2-167.spfdma.east.verizon.net") associated with the IP address you posted, 71.127.2.167, it appears that your machine has been fingered as the one sending spam. My guess would be that you have some malware infecting your machine. Do you have a firewall? Anti-virus software? Anti-spyware software? Is it up-to-date?

Hi Tim!

Thanks for providing a clear statement of the issue affecting you.

Steve T's observation may well be true but it is also possible that you have a dynamically assigned IP address and have thereby inherited a previous user's bad record.

It would help to know the name or IP address of the SMTP server listed inside Outlook Express. You say that you send via the service you own/subscribe to. Is your SMTP server a machine in your office using the DSL line you rent from Verizon? This information may assist in offering more accurate advice.

Further information... You are listed in more than the SpamCop BL. SenderBase shows listings as follows:

bl.spamcop.net http://spamcop.net/w3m?action=checkblock&ip=71.127.1.183

dynablock.njabl.org - Dynamic IP - http://www.njabl.org/cgi-bin/lookup.cgi?query=71.127.1.183

cbl.abuseat.org http://cbl.abuseat.org/lookup.cgi?ip=71.127.1.183

CBL warns: This IP is likely infected with the Stration/Warezov worm

Andrew

[Snowbat]

'pool' in the hostname frequently indicates a a pool of IP addresses that are dynamically assigned. It may well have been another Verizon customer that got this IP address blocked and Tim's machine picked up this IP address later.

If this is what happened, solutions to prevent this happening again:

- Get a static IP address from Verizon. They'll probably want to charge you extra but, given what happened, you could reasonably demand it for free

or

- Talk to your hosting provider. Do they know what they are doing? Whatever about incoming mail, I certainly wouldn't want to reject outgoing mail *FROM* paying customers based only on a SCBL listing. SpamCop specifically advises against using the SCBL for any kind of blocking, though it is not unusual for admins to use it for blocking incoming mail *TO* customers: http://www.spamcop.net/fom-serve/cache/291.html

[timmyt]

Hello,

I'm still trying to read, comprehend and take the steps suggested!

Thank you for the quick responses and I'll follow-up tonight or tomorrow as the problem persists and even if it corrects itself I want to know why and how to prevent it in the future.

Thanks Again

[petzl]

I'm still trying to read, comprehend and take the steps suggested!

Thank you for the quick responses and I'll follow-up tonight or tomorrow as the problem persists and even if it corrects itself I want to know why and how to prevent it in the future.

That IP is a Zombie make sure it is not YOUR COMPUTER If it is you need to format drive then go through my signature

An earlier post explains the ins and outs of being blocked

I am a SpamCop member living in Sydney Australia and not admin

[Wazoo]

I don't know all the posting rules here and I have only average computer knowledge!

I split your issue out from someone else's different issue, made it into its own Topic.

Per the instructions offer at SECTION 7 - Change of Username I would be more than happy to "fix" your username selection. The ALL-CAPS is very grating .. the "AGAIN" implies that you have posted about this issue here before, causing one to ask why you felt you had to create yet another account just to post about your 'new' issue ....

1)I use Verizon DSL for my ISP and work out of my house.

2) I'm using Outlook Express and have configured my business mail to send/receive from the domain and mail hosting service I own and/or subscribe to.

Yet not all information is yet provided. The IP address being described as blocked is also the IP address you are posting here from .... yet no mention of where the mail-hosting service is located. Bur, perhaps this isn't really needed after all.

An unknown error was returned from the SMTP server. Account: 'Timmy T.', Server: 'mail.webtixdirect.com', Protocol: SMTP, Server Response: '571 71.127.2.167 was found in bl.spamcop.net', Port: 25, Secure(SSL): No, Server Error: 571, Error Number: 0x800CCC61

Your Outlook Express is trying to make a Port 25 connection to a server at mail.webtixdirect.com, but that server is allegedly using the SPamCopDNSBL to block incoming traffic from spam spew sources, which your (posting IP address, allegedly your computer) is seen as trying to connect to send more spew.

OLEXP: Outlook Express Error Codes defines your error as: 0x800CCC61 SMTP_UNKNOWN_RESPONSE_CODE Unknown error code.

I have spent hours on this issue with Verizon and trying to read online and I tried to get off the list but the email goes to Verizon? I seemed to have fallen off the list in the past but the time lost is killing me......

http://spamcop.net/w3m?action=checkblock&ip=71.127.2.167

71.127.2.167 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in a short time.

Causes of listing

System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

So it's about ready to age off again .... spamtraps are the only item listed, so no reports woulf have gone to abuse[at]verizon.net

http://www.senderbase.com/?searchBy=ipaddr...ng=71.127.2.167

Date of first message seen from this address 2006-11-04

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ........ 3.2 .. 9590%

Last 30 days .. 1.7 ... 258%

Average .................. 1.1

Wow!! in just a day or two, an amazing amount of spew of something from that IP address (currently associated with the computer used to post your query here ...????)

[timmyt]

I split your issue out from someone else's different issue, made it into its own Topic.

Per the instructions offer at SECTION 7 - Change of Username I would be more than happy to "fix" your username selection. The ALL-CAPS is very grating .. the "AGAIN" implies that you have posted about this issue here before, causing one to ask why you felt you had to create yet another account just to post about your 'new' issue ....

Sorry about that - please change my username to: timmyt

I tried to do it myself but as you know I can't do it..........Thanks!

Moderator Edit: fixed quoting

[agsteele]

CBL warns: This IP is likely infected with the Stration/Warezov worm

Hi Tim!

Did you pick up this information I posted earlier? This should be the first thing you look to fixing.

Andrew

[timmyt]

Did you pick up this information I posted earlier? This should be the first thing you look to fixing.

I'm searching the internet for the fix if I do have the virus! Might have to buy software - I got rid of all that 3rd party virus software because I thought all it did was run in the background and slow me down and conflict with some other software. Being carefull I've never had a problem with viruses or anything - ever!!!

[Telarin]

You can always try running one of the free scanners like AVG.

[timmyt]

You can always try running one of the free scanners like AVG.

Will do - thanks!

[Wazoo]

Sorry about that - please change my username to: timmyt

Not as the instructions aked at all .... but ....

On the other hand, you're still posting from the same IP address, but ....

http://www.senderbase.com/?searchBy=ipaddr...ng=71.127.2.167

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ....... 0.0 .. -100%

Last 30 days . 1.7 ... 259%

Average ....... 1.1

It would be nice to know what actually changed, especially for others in the same situztion ....

[timmyt]

On the other hand, you're still posting from the same IP address, but ....

http://www.senderbase.com/?searchBy=ipaddr...ng=71.127.2.167

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day ....... 0.0 .. -100%

Last 30 days . 1.7 ... 259%

Average ....... 1.1

It would be nice to know what actually changed, especially for others in the same situztion ....

What seemed to have changed for me is:

I used the removal tool on this site after loking up my IP address in: "Am I listed".

Waited 12-18 hours.

Turned my pc off for the night.

Is it true every time I shut down my pc I'll obtain a different IP address? Maybe leaving it on will help?

Verizon DSL will only issue a static IP address to business accounts that come with faster speeds and higher monthly fees...........I passed on that and I'm up and running again with no clue how or why again........

Thanks - still clueless,

Tim

P.S. I might have that virus mentioned above and I'll do the cleaning/scanning thing later on tomorrow - I suppose that could have caused all of this and I'll better protect my pc in the future now that I know!

[Telarin]

Are you running with your PC connected direcly to your DSL modem? If so, it is likely that your computer has been compromised. I would strongly recommend getting an inexpensive router/firewall appliance (DLink and Linksys make models that you can pick up at most electronics stores for around $50). This will help keep hackers out of your machine. Let us know the results of your virus scan.

As far as obtaining a new IP address every time you reboot, this depends on how your provider has DHCP leases set up. If they are set up with pretty long term leases, you should get the same IP unless your computer has been off for an extended period of time.

[Wazoo]

I used the removal tool on this site after loking up my IP address in: "Am I listed".

That would have no bearing on the "traffic seen"

Waited 12-18 hours.

Turned my pc off for the night.

Is it true every time I shut down my pc I'll obtain a different IP address? Maybe leaving it on will help?

No idea "if it's true" (as Will stated, it depends) ... but yes, you posted here with a different IP address this time.

P.S. I might have that virus mentioned above and I'll do the cleaning/scanning thing later on tomorrow - I suppose that could have caused all of this and I'll better protect my pc in the future now that I know!

No traffic seen at the time of this posting by SenderBase ....

http://www.senderbase.com/search?searchString=72.70.250.64

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day 0.0 -100%

Last 30 days 0.0 -100%

Average 0.0

[kamaraju]

What seemed to have changed for me is:

I used the removal tool on this site after loking up my IP address in: "Am I listed".

Waited 12-18 hours.

Turned my pc off for the night.

Is it true every time I shut down my pc I'll obtain a different IP address? Maybe leaving it on will help?

according to http://www.spamcop.net/w3m?action=hoshame#domsum both Road runner, Verizon are one of the worst ISPs spewing spam out there. But if you are in US, you have very limited choice of choosing an ISP. So changing ISPs does not seem to be a solution here...

P.S. I might have that virus mentioned above and I'll do the cleaning/scanning thing later on tomorrow - I suppose that could have caused all of this and I'll better protect my pc in the future now that I know!

Why not install Linux which is inherently much more secure than windows. That way, all the software is free. There are virtually no viruses in Linux. It will take sometime to learn about Linux but at the end of the day you will keep wondering how you have ever lived without it ...