Jump to content
Sign in to follow this  
wep844

Example IP?

Recommended Posts

Hello,

I've *tried* to search for an example IP but the search function won't allow < 4 characters... I tried http://spamcop.net/w3m?action=checkblock&ip=1.2.3.4 tens of dozens of times with different IPs, even tried IPs from 'non-resolved' threads, but response is always 'not listed'. So, can anyone give me an IP that is listed so I can check if this really works? I tried my best to search for an example on the site, even Google, but nothing.

Thanks in advance.

Share this post


Link to post
Share on other sites
...So, can anyone give me an IP that is listed so I can check if this really works? I tried my best to search for an example on the site, even Google, but nothing.
Try some listed in the "Hall of Shame" - http://www.spamcop.net/w3m?action=hoshame

Like (currently) http://www.spamcop.net/w3m?action=checkblo...ip=204.13.69.90 but anything in the HoS is fairly well guaranteed to be listed while it is shown there.

[checking

Microsoft Windows XP [Version 5.1.2600]

© Copyright 1985-2001 Microsoft Corp.

H:\>nslookup 90.69.13.204.bl.spamcop.net

Server: (mine)

Address: (mine)

Name: 90.69.13.204.bl.spamcop.net

Address: 127.0.0.2

H:\>

YEP (- that's another way to check the listing of IP address 204.13.69.90)]

Share this post


Link to post
Share on other sites

Try some listed in the "Hall of Shame" - http://www.spamcop.net/w3m?action=hoshame

Like (currently) http://www.spamcop.net/w3m?action=checkblo...ip=204.13.69.90 but anything in the HoS is fairly well guaranteed to be listed while it is shown there.

[checking

Microsoft Windows XP [Version 5.1.2600]

� Copyright 1985-2001 Microsoft Corp.

H:\>nslookup 90.69.13.204.bl.spamcop.net

Server: (mine)

Address: (mine)

Name: 90.69.13.204.bl.spamcop.net

Address: 127.0.0.2

H:\>

YEP (- that's another way to check the listing of IP address 204.13.69.90)]

Alright this is weird, I clicked the link it says 'not listed' (browser). When I do a reverse nslookup via cmd.exe, I get a timeout, so it's not there? Am I doing something wrong here? I exactly copied your line and it gave a timeout...

Share this post


Link to post
Share on other sites

Alright this is weird, I clicked the link it says 'not listed' (browser). When I do a reverse nslookup via cmd.exe, I get a timeout, so it's not there? Am I doing something wrong here? I exactly copied your line and it gave a timeout...

OK, that one is no longer listed, in fact many of them are no longer listed. Noting the SC servers are having some database issues right now, perhaps leave it a while and pick another. This is not a common occurence. Timeout on the command line query (NOT usual) is perhaps another indicator of db problems. Wait for the database to recover and you should get results then. I doubt you are doing anything wrong.

Share this post


Link to post
Share on other sites
Alright this is weird, I clicked the link it says 'not listed' (browser). When I do a reverse nslookup via cmd.exe, I get a timeout, so it's not there? Am I doing something wrong here? I exactly copied your line and it gave a timeout...

It's not just you....I just ran a bunch of the IPs listed in the HOS through the web-based SCBL lookup, and NONE of them are showing up as listed. I tried checking the report history (I'm a SC email customer, so I was using the "http://mailsc.spamcop.net/mcgi?action=showhistory..." lookup) and got red error messages, such as:

Cannot open database connection in getList

Yes, Farelf, there are some database issues right now. In fact, it looks like the SCBL is pretty much FUBAR at the moment.

The command-line lookups aren't working for me, either (Win XP Home). I get:

...can't find 90.69.13.204.bl.spamcop.net: Non-existent domain

DT

Share this post


Link to post
Share on other sites
Yes, Farelf, there are some database issues right now. In fact, it looks like the SCBL is pretty much FUBAR at the moment.
Hopefully not quite BAR :D .
...The command-line lookups aren't working for me, either (Win XP Home). I get:

...can't find 90.69.13.204.bl.spamcop.net: Non-existent domain

That (NXD) is the normal response for "not listed". 127.0.0.2 means listed (some other DNSbls use slightly different numbers - SORBS has a raft of 'em, but all 127.0.0.[x]x). Thanks for the checking. We need solid green in the graphic for some little time before things will function as normal I guess. Quite unthinkable that 204.13.69.90 should be listed for 'leventy-seven reports in short order (95384 in a week) and *not* be listed, eh? I suppose it *could* have been pulled off line in the last 24 hours but, on the balance of probability (and vague recollections of 20-something hours to run when I posted that example), I think not.

Share this post


Link to post
Share on other sites
before things will function as normal I guess. Quite unthinkable that 204.13.69.90 should be listed for 'leventy-seven reports in short order (95384 in a week) and *not* be listed, eh?

It's still showing as not listed, yet with "History" available. However, when I check the 90-day history, there are no reports at all, so it's looking like no IPs are currently listed in the SCBL (hope I'm wrong), and that all the report history is also gone. Maybe TPTB are working on restoring all that? Someone should check with Ellen...she seems the most responsive about things like this.

UPDATE: I just checked the reporting history on an IP that I reported before the server/database "troubles," and (once I got past an authentication error...it's still having problems), I found the reports I had submitted on this IP (they hit three of my addresses, so three reports), so the History isn't all gone.

DT

Edited by DavidT

Share this post


Link to post
Share on other sites
<snip>

the search function won't allow < 4 characters

<snip>

...True of the Search function from the link with that label but there is another search mechanism -- near the top center of all SpamCop Forum pages there is an entry field between two buttons -- "Search for -->" and "GO" -- which does not have such a limit.

Share this post


Link to post
Share on other sites
...It's still showing as not listed, yet with "History" available. However, when I check the 90-day history, there are no reports at all, so it's looking like no IPs are currently listed in the SCBL (hope I'm wrong), and that all the report history is also gone. Maybe TPTB are working on restoring all that? Someone should check with Ellen...she seems the most responsive about things like this. ...
I caught a couple of hours sleep in there somewhere, came back and the system, as indicated by the graphic, seems to have settled down and our favorite spamsource is "back" on the list
204.13.69.90 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 21 hours.

Causes of listing

System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

Additional potential problems

(these factors do not directly result in spamcop listing)

DNS error: 204.13.69.90 has no reverse dns

Because of the above problems, express-delisting is not available

Boy, that thing is really pounding the spam traps, not hitting any members who are reporting listed IPs (which I usually recommend to ensure the listing stays while the spam continues - not necessary in such high-volume cases, evidently).

... and of course, a "manual" lookup shows ...

Microsoft Windows XP [Version 5.1.2600]

© Copyright 1985-2001 Microsoft Corp.

H:\>nslookup 90.69.13.204.bl.spamcop.net

Server: mine (well, my employers')

Address: that too

Name: 90.69.13.204.bl.spamcop.net

Address: 127.0.0.2

H:\>

Share this post


Link to post
Share on other sites

I caught a couple of hours sleep in there somewhere, came back and the system, as indicated by the graphic, seems to have settled down and our favorite spamsource is "back" on the listBoy, that thing is really pounding the spam traps, not hitting any members who are reporting listed IPs (which I usually recommend to ensure the listing stays while the spam continues - not necessary in such high-volume cases, evidently).

... and of course, a "manual" lookup shows ...

Microsoft Windows XP [Version 5.1.2600]

© Copyright 1985-2001 Microsoft Corp.

I get:

Address lookup

lookup failed 204.13.69.90

Could not find a domain name corresponding to this IP address.

Service scan:

FTP - 21 220 Microsoft FTP Service

SMTP - 25 220 msg-g09pmirpcam Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready at Fri, 8 Feb 2008 10:26:17 -0800

HTTP - 80 HTTP/1.1 200 OK

Content-Length: 1433

Content-Type: text/html

Content-Location: http:///iisstart.htm

Last-Modified: Sat, 22 Feb 2003 02:48:30 GMT

Accept-Ranges: bytes

ETag: "0d3ade11cdac21:43c"

Server: Microsoft-IIS/6.0

Date: Fri, 08 Feb 2008 18:26:17 GMT

Connection: close

POP3 - 110 Error: ConnectionRefused

IMAP - 143 Error: ConnectionRefused

OrgName: AKANOC Solutions Inc.

OrgID: AKANO

Address: 45535 Northport Loop East

City: Fremont

StateProv: CA

PostalCode: 94538

Country: US

ReferralServer: rwhois://rwhois.akanoc.com:4321

NetRange: 204.13.64.0 - 204.13.71.255

CIDR: 204.13.64.0/21

NetName: AKANOC-SJC

NetHandle: NET-204-13-64-0-1

Parent: NET-204-0-0-0-0

NetType: Direct Allocation

NameServer: RDNS1.AKANOC.COM

NameServer: RDNS2.AKANOC.COM

Comment:

RegDate: 2005-04-07

Updated: 2005-04-07

RTechHandle: AAT3-ARIN

RTechName: AKANOC Arin Tech

RTechPhone: +1-888-589-5589

RTechEmail: tech[at]akanoc.com

Share this post


Link to post
Share on other sites

Thanks Merlyn :), that leaves 66.79.170.106 currently on top of the Hall of Shame charts. Wow - they really stopped 204.13.69.90 in its tracks - it's still there (for ping and tracert for instance), just not talking, is that how the service scan is to be interpreted?

There are/were a whole heap (8) on the HoS in the 204.13.69.0/24 owned by AKANOC Solutions Inc (they have the whole 204.13.64.0/21 - 204.13.64.0 to 204.13.71.255 by the look of it), none listed for the last 2.5 days (3.5-1) and they seem now (not all checked) to show

No valid email addresses found, sorry!

There are several possible reasons for this:

  • The site involved may not want reports from SpamCop.
  • SpamCop administrators may have decided to stop sending reports to the site to prevent listwashing.
  • SpamCop uses internal routeing to contact this site, only knows about the internal method and so cannot provide an externally-valid email address.
  • There may be no working email address to receive reports.

('routeing'? routing is the more usual US spelling). Anyhow, I can see why they wouldn't want/need reports - maybe due over 100,000 per day while the run was underway. I'll bet there is a story behind all of that. The dramas we don't see. :blink:

Share this post


Link to post
Share on other sites

Well...AKANOC is located just across the bay from IronPort...they could go make a housecall. Or...my son just lives 10 miles up the road from them...I could send him to knock on their door and give them some grief about all their spam...but then, he doesn't speak Chinese! ;-)

DT

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×