Blocked, but not on SpamCopDNSbl

[Wazoo]

Received via PM .. user advised that the discussion would be moved "here" ...

Please help me to resolve the problem be looking at the email below:

>-------

The following recipient(s) could not be reached:

kacie <at> kmcho.com on 9/8/2004 9:37 AM

There was a SMTP communication problem with the recipient's email server. Please contact your system administrator.

<BACKUPSERVER.belle-haven.local #5.5.0 smtp;553 210.176.164.* mail rejected due to excessive spam (Listed by Spamcop 210.176.164.10)210.176.164.* mail rejected due to excessive spam (Spamcop 210.176.164.10)>

>---------

I checked that our IP 210.176.164.10 is not listed on the Spamlist. But, why am I getting this message? Please help.

http://www.spamcop.net/w3m?action=checkblo...=210.176.164.10

Agreed, check at this point in time shows this IP not listed at SpmCop. However, there are some other issues going on that may (or may not) explain .. it may be a matter of timing (the evidence page has not been "real" time for quite a while) .... it may be that this IP has actually aged off of the SpamCopDNSbl ....

http://www.senderbase.org/?searchBy=ipaddr...=210.176.164.10 shows the disturbing data of a massive increase in e-mail traffic seen from that IP (thinking that the current -100% is due to a clock event, that number will probably start incrementing in a bit)

Volume Statistics for this IP

Magnitude Vol ...... Change vs. Average

Last day ........ 0.0 ..... -100%

Last 30 days .. 3.6 ..... 1090%

Average ........ 2.6

Though this could be due to only recently coming on line ....????

Date of first message seen from this address 2004-08-16

Also shown is listing in another list;

http://cbl.abuseat.org/lookup.cgi?ip=210.176.164.10

So there is also the possibility that the receiving ISP has a configuration that blocks incoming e-mail for some reason, but has the message reflecting a SpamCop justification ...???

There is a "Why am I Blocked" FAQ in this Forum that might help ....

[Miss Betsy]

A new server can explain an increase in traffic, but it could also be that a switch was left open by mistake during the set up. (happens to the best of them)

A spamcop deputy said that very often, spammers using an exploit only use it for a short time. The IP falls off the blocklist and the owner of the exploited machine relaxes and assumes it was a mistake. Then the spammer uses it again.

So the first thing to do is to check all the possible ways that you could get listed. If you find nothing (or want to confirm that you have done all you could), post back. Or write to deputies <at> spamcop dot net . They can tell you in a general way what is happening. Since there are not very many of them, you can find it yourself or get an answer here more quickly. If it is a mistake, then it probably will not be on the blocklist very long and you can wait to confirm that with a deputy and measures can be taken so that it is not repeated.

Miss Betsy

[Ellen]

Received via PM .. user advised that the discussion would be moved "here" ...

Please help me to resolve the problem be looking at the email below:

>-------

The following recipient(s) could not be reached:

kacie <at> kmcho.com on 9/8/2004 9:37 AM

There was a SMTP communication problem with the recipient's email server. Please contact your system administrator.

<BACKUPSERVER.belle-haven.local #5.5.0 smtp;553 210.176.164.* mail rejected due to excessive spam (Listed by Spamcop 210.176.164.10)210.176.164.* mail rejected due to excessive spam (Spamcop 210.176.164.10)>

>---------

I checked that our IP 210.176.164.10 is not listed on the Spamlist. But, why am I getting this message? Please help.

http://www.spamcop.net/w3m?action=checkblo...=210.176.164.10

Agreed, check at this point in time shows this IP not listed at SpmCop. However, there are some other issues going on that may (or may not) explain .. it may be a matter of timing (the evidence page has not been "real" time for quite a while) .... it may be that this IP has actually aged off of the SpamCopDNSbl ....

http://www.senderbase.org/?searchBy=ipaddr...=210.176.164.10 shows the disturbing data of a massive increase in e-mail traffic seen from that IP (thinking that the current -100% is due to a clock event, that number will probably start incrementing in a bit)

Volume Statistics for this IP

Magnitude Vol ...... Change vs. Average

Last day ........ 0.0 ..... -100%

Last 30 days .. 3.6 ..... 1090%

Average ........ 2.6

Though this could be due to only recently coming on line ....????

16535[/snapback]

The IP 210.176.164.10 delisted on 9/504 at 3:49:02 AM -0400. However some servers may cache previous lookup results and not refresh their caches when the TTL expires; some servers send the wrong reject message. There is nothing that we can do about those servers. However the IP is and has been delisted for 3 days and your mail is not bouncing due to a listing in the SCbl.