Jump to content
Sign in to follow this  
cford114

Please help!

Recommended Posts

My IP address is 24.210.36.236. A friend/classmate in California and I are putting together a 20 year class

reunion. My email being blocked will make that a bit difficult! My email

(below) is not spam and there any block you have on my email is unjustified.

I also contacted my server (RoadRunner) and below is their response. Please

rectify immediately and remove me from the list. Also below I have included

the full header and message source.

We do not use DNSRBL for spam filtering. We use a service called MAPS.

Likely the domain you are sending the email to is using the DNSRBL service

to block email coming from Road Runner. Depending on how they block

emails they may be blocking your computer specifically or the entire Road

Runner service. You may want to try to contact DNSRBL and request to be

removed. I will also notify our national security team so they may

contact them as well.

Thus I guess this falls on spamcop? Can anyone help?

--

Thank you,

Jason

Time Warner Cable HSD

Columbus Division

Message Source*********

Return-path: <>

Received: from ms-mta-03 (ms-mta-03 [10.24.14.240])

by ms-mss-01.columbus.rr.com

(iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003))

with ESMTP id <0HVR00FTUAG91M[at]ms-mss-01.columbus.rr.com> for

cford114[at]columbus.rr.com; Tue, 06 Apr 2004 11:45:51 -0400 (EDT)

Received: from ohmx02.mgw.rr.com (ohmx02.mgw.rr.com [65.24.0.110])

by ms-mta-03.columbus.rr.com

(iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003))

with ESMTP id <0HVR00BXMAEZQ2[at]ms-mta-03.columbus.rr.com> for

cford114[at]columbus.rr.com (ORCPT cford114[at]columbus.rr.com); Tue,

06 Apr 2004 11:45:04 -0400 (EDT)

Received: from webmailcenter.com

(mail.commercialnetworkservices.net [209.242.130.61])

by ohmx02.mgw.rr.com (8.12.10/8.12.8) with ESMTP id i36FjRcR005020 for

<cford114[at]columbus.rr.com>; Tue, 06 Apr 2004 11:45:37 -0400 (EDT)

Date: Tue, 06 Apr 2004 08:44:38 -0700

From: Postmaster <postmaster[at]webmailcenter.com>

Subject: Undeliverable Mail

Sender: postmaster[at]webmailcenter.com

To: cford114[at]columbus.rr.com

Message-id: <10404060844.AA61907250[at]webmailcenter.com>

MIME-version: 1.0

X-Mailer: <SMTP32 v8.04>

Content-type: text/plain; charset=us-ascii

X-Virus-Scanned: Symantec AntiVirus Scan Engine

Original-recipient: rfc822;cford114[at]columbus.rr.com

undeliverable to Coach[at]lombardicontracting.com

Original message follows.

Received: from ms-smtp-01-eri0.ohiordc.rr.com [65.24.5.135] by

webmailcenter.com with ESMTP

(SMTPD32-8.04) id A05F1BA500FE; Tue, 06 Apr 2004 08:44:31 -0700

Received: from your939tqgi62r (dhcp024-210-036-236.columbus.rr.com

[24.210.36.236])

by ms-smtp-01-eri0.ohiordc.rr.com (8.12.10/8.12.7) with SMTP id

i36FiTMV011935

for <Coach[at]LombardiContracting.com>; Tue, 6 Apr 2004 11:44:29 -0400 (EDT)

Message-ID: <022301c41bee$0ae08830$ec24d218[at]your939tqgi62r>

From: "Christy Ford" <cford114[at]columbus.rr.com>

To: "Mike Lombardi" <Coach[at]LombardiContracting.com>

Subject: Fw: Update Andy Penhorwood

Date: Tue, 6 Apr 2004 11:44:26 -0400

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0220_01C41BCC.83A65190"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2800.1158

X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

X-Virus-Scanned: Symantec AntiVirus Scan Engine

X-IMAIL-spam-DNSBL:

((bl.spamcop.net)_www.CommercialNetworkServices.com/BlockedEmail,463798526,1

27.0.0.2)

This is a multi-part message in MIME format.

------=_NextPart_000_0220_01C41BCC.83A65190

Content-Type: text/plain;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Couldn't tell if everyone got it or not? Let me know if you did. =20

ME

----- Original Message -----=20

From: Andrew Penhorwood=20

To: To:=20

Sent: Tuesday, April 06, 2004 8:29 AM

Subject: Update

Hello Class of '84.

Could it really be 20 years since we graduated? I won't be able to make =

it in July so I thought I would give a brief update. In 2002 I got =

married to a wonderful Brazilian lady I met while running a Bible School =

in Northern Brazil. Iris and I have one daughter who we named Glynda =

after my mom. I am a full time missionary to Brazil and South American. =

We live in Manaus, Amazonas, Brazil which is on the Amazon River south =

of the equator.

Andrew Penhorwood

www.wordmissions.org=20

------=_NextPart_000_0220_01C41BCC.83A65190

Content-Type: text/html;

[message truncated]

FULL HEADER***

Return-path: <>

Received: from ms-mta-03 (ms-mta-03 [10.24.14.240])

by ms-mss-01.columbus.rr.com

(iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003))

with ESMTP id <0HVR00FTUAG91M[at]ms-mss-01.columbus.rr.com> for

cford114[at]columbus.rr.com; Tue, 06 Apr 2004 11:45:51 -0400 (EDT)

Received: from ohmx02.mgw.rr.com (ohmx02.mgw.rr.com [65.24.0.110])

by ms-mta-03.columbus.rr.com

(iPlanet Messaging Server 5.2 HotFix 1.21 (built Sep 8 2003))

with ESMTP id <0HVR00BXMAEZQ2[at]ms-mta-03.columbus.rr.com> for

cford114[at]columbus.rr.com (ORCPT cford114[at]columbus.rr.com); Tue,

06 Apr 2004 11:45:04 -0400 (EDT)

Received: from webmailcenter.com

(mail.commercialnetworkservices.net [209.242.130.61])

by ohmx02.mgw.rr.com (8.12.10/8.12.8) with ESMTP id i36FjRcR005020 for

<cford114[at]columbus.rr.com>; Tue, 06 Apr 2004 11:45:37 -0400 (EDT)

Date: Tue, 06 Apr 2004 08:44:38 -0700

From: Postmaster <postmaster[at]webmailcenter.com>

Subject: Undeliverable Mail

Sender: postmaster[at]webmailcenter.com

To: cford114[at]columbus.rr.com

Message-id: <10404060844.AA61907250[at]webmailcenter.com>

MIME-version: 1.0

X-Mailer: <SMTP32 v8.04>

Content-type: text/plain; charset=us-ascii

X-Virus-Scanned: Symantec AntiVirus Scan Engine

Original-recipient: rfc822;cford114[at]columbus.rr.com

----- Original Message -----

From: "Postmaster" <postmaster[at]webmailcenter.com>

To: <cford114[at]columbus.rr.com>

Sent: Tuesday, April 06, 2004 11:44 AM

Subject: Undeliverable Mail

> undeliverable to Coach[at]lombardicontracting.com

>

>

> Original message follows.

>

> Received: from ms-smtp-01-eri0.ohiordc.rr.com [65.24.5.135] by

webmailcenter.com with ESMTP

> (SMTPD32-8.04) id A05F1BA500FE; Tue, 06 Apr 2004 08:44:31 -0700

> Received: from your939tqgi62r (dhcp024-210-036-236.columbus.rr.com

[24.210.36.236])

> by ms-smtp-01-eri0.ohiordc.rr.com (8.12.10/8.12.7) with SMTP id

i36FiTMV011935

> for <Coach[at]LombardiContracting.com>; Tue, 6 Apr 2004 11:44:29 -0400 (EDT)

> Message-ID: <022301c41bee$0ae08830$ec24d218[at]your939tqgi62r>

> From: "Christy Ford" <cford114[at]columbus.rr.com>

> To: "Mike Lombardi" <Coach[at]LombardiContracting.com>

> Subject: Fw: Update Andy Penhorwood

> Date: Tue, 6 Apr 2004 11:44:26 -0400

> MIME-Version: 1.0

> Content-Type: multipart/alternative;

> boundary="----=_NextPart_000_0220_01C41BCC.83A65190"

> X-Priority: 3

> X-MSMail-Priority: Normal

> X-Mailer: Microsoft Outlook Express 6.00.2800.1158

> X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

> X-Virus-Scanned: Symantec AntiVirus Scan Engine

> X-IMAIL-spam-DNSBL:

((bl.spamcop.net)_www.CommercialNetworkServices.com/BlockedEmail,463798526,1

27.0.0.2)

>

> This is a multi-part message in MIME format.

>

> ------=_NextPart_000_0220_01C41BCC.83A65190

> Content-Type: text/plain;

> charset="iso-8859-1"

> Content-Transfer-Encoding: quoted-printable

>

> Couldn't tell if everyone got it or not? Let me know if you did. =20

>

> ME

> ----- Original Message -----=20

> From: Andrew Penhorwood=20

> To: To:=20

> Sent: Tuesday, April 06, 2004 8:29 AM

> Subject: Update

>

>

> Hello Class of '84.

>

> Could it really be 20 years since we graduated? I won't be able to make =

> it in July so I thought I would give a brief update. In 2002 I got =

> married to a wonderful Brazilian lady I met while running a Bible School =

> in Northern Brazil. Iris and I have one daughter who we named Glynda =

> after my mom. I am a full time missionary to Brazil and South American. =

> We live in Manaus, Amazonas, Brazil which is on the Amazon River south =

> of the equator.

>

>

> Andrew Penhorwood

> www.wordmissions.org=20

>

> ------=_NextPart_000_0220_01C41BCC.83A65190

> Content-Type: text/html;

>

> [message truncated]

Share this post


Link to post
Share on other sites
undeliverable to x<at>lombardicontracting.com

Original message follows.

Received: from ms-smtp-01-eri0.ohiordc.rr.com [65.24.5.135] by

webmailcenter.com with ESMTP

(SMTPD32-8.04) id A05F1BA500FE; Tue, 06 Apr 2004 08:44:31 -0700

Received: from your939tqgi62r (dhcp024-210-036-236.columbus.rr.com

[24.210.36.236])

by ms-smtp-01-eri0.ohiordc.rr.com (8.12.10/8.12.7) with SMTP id

i36FiTMV011935

24.210.36.236 not listed in bl.spamcop.net

SpamCop has no record of this system

Therefore your machine was not listed

65.24.5.135 not listed in bl.spamcop.net

Since SpamCop started counting, this system has been reported about 10 times by less than 10 users. It has been sending mail consistently for at least 161.9 days. In the past 9 hours, it has been listed once for a total of 5 hours

In the past week, this system has: 
Been detected sending mail to spam traps 
Been witnessed sending mail about 1730 times 

This machine is not currently listed but might have been when the message was sent. Detected sending to spam traps is not a good thing as it will not send a report to the admin. My guess is that rr admins contacted the deputies and got this delisted. You should try again.

Edited by StevenUnderwood

Share this post


Link to post
Share on other sites

Admittedly I didn't look very hard after I saw that the IP address you gave was not listed in spamcop. It is listed in 16 other lists however and it is the only one not "DNS verified" in a list at Senderbase.org

It was also listed in SORBS as a "Dynamic IP address, use your ISPs mail server"

Not being technically fluent, I am not positive what that means, though it seems to me that I read in a post not too long ago that many ISP's will block people sending email from Dialups because they were dynamic IP addresses.

I can't help feeling that what goes around comes around when I saw the "Time Warner" I haven't had much lately, but boy, there was one time when I got so much spam from them, I could have done something really unladylike! Now, it's your turn to deal with "large" email services who send you on wild goose chases to solve a problem that would not exist without spammers who could not spam if the people at rr.com and tw whatever hadn't allowed it. (I don't know how they stand currently - whether they help or hinder).

Miss Betsy

Share this post


Link to post
Share on other sites

24.210.36.236 is a dynamic IP address, most email admins and ISP's will not accept mail from a dynamic IP address.

Why don't you use your providers email server.

Are you sure people want email from you after 20 years? Just because you want to contact them does not mean they want contact from you.

You should get their permission, where did you get all their email addresses from?

Share this post


Link to post
Share on other sites
[snip]

We do not use DNSRBL for spam filtering.  We use a service called MAPS.

[snip]

Gee, and here I was thinking that MAPS WAS the original DNSBL.

Share this post


Link to post
Share on other sites
Are you sure people want email from you after 20 years?  Just because you want to contact them does not mean they want contact from you.

You should get their permission,  where did you get all their email addresses from?

Get off it Merlyn ...

Sending directed email to old classmates is not spam.

Share this post


Link to post
Share on other sites

Time to restart the yourbuddy troll count...

Edited by StevenUnderwood

Share this post


Link to post
Share on other sites
Get off it Merlyn ...

Sending directed email to old classmates is not spam.

How do you know your old high school buddies aren't peddling penis pills?

Share this post


Link to post
Share on other sites

Yup, that's what to expect from SpamCop munchkins. :D

Everything is spam, unless you send an embossed invitation first

(but if you did that, Miss Manners would say it was unsolicited, and

would think it rude - she likely throws birthday and christmas cards

in the garbage without opening them first). Unsolicited = very bad.

If any of you have a spouse, how did you ever meet?? :rolleyes:

Share this post


Link to post
Share on other sites
If any of you have a spouse, how did you ever meet??

That was an unsolicited question!

Share this post


Link to post
Share on other sites
If any of you have a spouse, how did you ever meet??

That was an unsolicited question!

So are we all guilty of spam?? :D

Share this post


Link to post
Share on other sites
My IP address is 24.210.36.236.  A friend/classmate in California and I are putting together a 20 year class

reunion.  My email being blocked will make that a bit difficult!

That IP is not listed in the SpamCop blocklist.

Share this post


Link to post
Share on other sites

Hi, cford114!

<snip>

My email being blocked will make that a bit difficult!  My email

(below) is not spam and there any block you have on my email is unjustified.

...Nope, SpamCop.net does not block e-mail. See links I included below.

I also contacted my server (RoadRunner) and below is their response.  Please rectify immediately and remove me from the list.  Also below I have included the full header and message source.

<snip>

...There are some postings in the FAQ and pinned items that may be helpful to you. I'd suggest you start with:

If, after reviewing these and the other replies to your post, you still have questions, please return here and ask.

...Good luck!

Share this post


Link to post
Share on other sites

24.210.36.236 is blacklisted in (blocked by):

block.blars.org

dnsbl.jammconsulting.com

dul.dnsbl.sorbs.net

Edited by yourbuddy

Share this post


Link to post
Share on other sites
If any of you have a spouse, how did you ever meet??  :rolleyes:

This also should be in the lounge, but since you asked:

University of Lowell, 1987 Christmas dance :)

Share this post


Link to post
Share on other sites
If any of you have a spouse, how did you ever meet??  :rolleyes:

Why? Are you jealous? :o

I've never met her (or you), but it's unlikely I'm jealous :D

The point was, you would have had to "spam" her, or she would

likely have had to spam you ;) namely an unsolicited first contact.

Or did you sign-up first, and she then asked for a confirmation, and

you've been on her mailing list ever since, but retain opt-out rights.

spam is "in the eye of the beholder", I think ;)

Share this post


Link to post
Share on other sites

Miss Betsy wrote:

It was also listed in SORBS as a "Dynamic IP address, use your ISPs mail server"

Not being technically fluent, I am not positive what that means, though it seems to me that I read in a post not too long ago that many ISP's will block people sending email from Dialups because they were dynamic IP addresses.

They are not sending from a dynamic I.P. address. They are sending through a RR.COM mail server.

The mail server is adding a line to the headers indicating that it got the e-mail from one a rr.com dhcp address. A rr.com mail server should be able to trust rr.com DHCP address.

Now the spamcop.net parser when fed the headers of a message that was rejected currently properly identifies the I.P. address of the sender, and not the mail server.

So looking up the I.P. address of the apparently listed server:

http://www.moensted.dk/spam/?addr=65.24.5.135&Submit=Submit

http://dsbl.org/listing?ip=65.24.5.135

lameav.rbl.rangers.eu.org.

Misconfigured anti-virus scanner sending false virus notifications

DRBL-WORK-SANDY

RoadRunner DHCP Network

I do not know how to get information about the DRBL, it appears that they are under the mistaken belief that the webmail relay is on a DHCP address.

Either there was an error in the parser in processing e-mail from that server in the past, that caused an incorrect listing, or that server was compromised and actually sending spam that it was not indicating the true source of.

The spam samples shown by spamcop.net do not show that the mail server is claiming to have received the spam attributed to it from any other source. This looks like either an SMTP AUTH exploit, or an open proxy. Only a deputy can look at the source and make the true determination.

For an open relay or a multi-hop exploit, there should be an additional header line.

Some open proxy exploits also put false header lines, as indicated in the thread about another.com.

Maps OPS has a spam sample on file:

http://www3.mail-abuse.org/cgi-bin/nph-ops-sview?65.24.5.135

The most recent spam is from Jan 29th. Looking at a random sample, all look like multi-hop, plus at least one virus.

A google search on news.admin.net-abuse.e-mail shows sightings as late as Feb 2003, again, multi-hop exploits.

The spamcop.net parser tries not to list real mail servers used in multi-hop exploits, but other DNSbls will list the output of multihop relays.

I do not know if Ellen will satisfy any curiosity as to what caused the listing of the rr.com server.

-John

Personal Opinion Only

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×