paulgami Posted July 19, 2005 Posted July 19, 2005 Came back from vacation to find we'd been added to the spamcop blocklist. I believe I've remedied the situation and am waiting to see what happens. Yesterday the message at http://www.spamcop.net/w3m?action=checkblo...p=68.89.254.181 read "If there are no reports of ongoing objectionable email from this system it will be delisted automatically in 13 hours", then 12, 11, 10 etc... Today the message reads: "If there are no reports of ongoing objectionable email from this system it will be delisted automatically in a short time." Does that mean there have been no more spams and I'm now in the queue to be removed, or does it mean I haven't actually fixed the problem and the cycle will soon restart with ".... automatically delisted in 24 hours"? Thanks
Jeff G. Posted July 19, 2005 Posted July 19, 2005 Per Ellen's most recent post on the subject: That means that the IP is eligable for delisting/has entered the delist process. It can take up to 3 hours or a bit longer for the process to complete and the delist to propagate.28494[/snapback]
paulgami Posted July 19, 2005 Author Posted July 19, 2005 I did see the "zero time" topics but there was nothing about "a short time" in a FAQ/forum search. Something to add, perhaps? * DNS error: 68.89.254.181 is 68-89-254-181.gami.com but 68-89-254-181.gami.com has no DNS information Because of the above problems, express-delisting is not available Is the above why I'm seeing "a short time" instead of "zero hours"? Thanks.
Wazoo Posted July 19, 2005 Posted July 19, 2005 Actually, this is the first time I've heard of (and have yet to see) the "short time" tag .. checking http://www.spamcop.net/w3m?action=checkblo...p=68.89.254.181 now shows 68.89.254.181 not listed in bl.spamcop.net .... I'm not really comvinced that something else needs to be added at this point .... it appears that the "short time" period has expired ... for all I know, perhaps the "zero hours" remark has been replaced with the "short time" phrase ....??? will ask, but ...????
Jeff G. Posted July 19, 2005 Posted July 19, 2005 I did see the "zero time" topics but there was nothing about "a short time" in a FAQ/forum search. Something to add, perhaps?30420[/snapback] Perhaps. * DNS error: 68.89.254.181 is 68-89-254-181.gami.com but 68-89-254-181.gami.com has no DNS information Because of the above problems, express-delisting is not available Is the above why I'm seeing "a short time" instead of "zero hours"? 30420[/snapback] Possibly. You'd have to ask TPTB. In any case, that IP Address is now delisted. However, the hostmaster at SBC's Southwestern Bell Internet Services is not "following the INSTRUCTIONS" per Section "INSTRUCTIONS - Adding a host - Add the reverse IN-ADDR entry" of RFC1033 "DOMAIN ADMINISTRATORS OPERATIONS GUIDE", to wit:INSTRUCTIONS... Adding a host. To add a new host to your zone files: Edit the appropriate zone file for the domain the host is in. Add an entry for each address of the host. Optionally add CNAME, HINFO, WKS, and MX records. Add the reverse IN-ADDR entry for each host address in the appropriate zone files for each network the host i on.
Merlyn Posted July 19, 2005 Posted July 19, 2005 Came back from vacation to find we'd been added to the spamcop blocklist. I believe I've remedied the situation and am waiting to see what happens. 30412[/snapback] Submitted: Monday, July 18, 2005 1:11:50 PM -0400: You will get a 50% Discount for Re-Orders on viagra, cialis levitra. Submitted: Monday, July 18, 2005 3:02:54 AM -0400: Attract women now! There are more...... Just curious, Did you remove your spammer?
Wazoo Posted July 20, 2005 Posted July 20, 2005 As it turns out, the code was changed to try to stop all the questions about "will be de-listed in 0 hours" .. wil try to figure out how to adapt the FAQ entry to include this and some additional background data.
Jank1887 Posted July 20, 2005 Posted July 20, 2005 Submitted: Monday, July 18, 2005 1:11:50 PM -0400: You will get a 50% Discount for Re-Orders on viagra, cialis levitra. 30431[/snapback] A good case for adding an *open relay* or other qualifier to the past report list. Would provide some quick clues on how spam was sent. Although, haven't seen a list for a specific IP before. how does one go about seeing that history?
paulgami Posted July 20, 2005 Author Posted July 20, 2005 Submitted: Monday, July 18, 2005 1:11:50 PM -0400: You will get a 50% Discount for Re-Orders on viagra, cialis levitra. Submitted: Monday, July 18, 2005 3:02:54 AM -0400: Attract women now! There are more...... Just curious, Did you remove your spammer? 30431[/snapback] Those seem to be dated from before I fixed the server. Are there any more recent mails? The only blocklists we seem to be on are BLARSBL which DNSstuff tells me I can safely ignore, and a German one that offers removal for a price. Senderbase reports a huge increase in emails from our domain yesterday - I'm hoping that's a result of all the queued emails going through after the delisting. If you can let me know if the other emails are more recent it would help me a lot. Thanks.
Jeff G. Posted July 20, 2005 Posted July 20, 2005 how does one go about seeing that history?30446[/snapback] Please see Report History. Thanks!
Jeff G. Posted July 20, 2005 Posted July 20, 2005 Those seem to be dated from before I fixed the server. Are there any more recent mails?30450[/snapback] No.
paulgami Posted July 20, 2005 Author Posted July 20, 2005 No. 30459[/snapback] Thanks. Senderbase is still occasionally reporting us as blacklisted here but I guess that's just delays in database replication (or whatever) because http://www.spamcop.net/w3m?action=checkblo...p=68.89.254.181 comes up negative. Once again, thanks to all who replied.
Jeff G. Posted July 20, 2005 Posted July 20, 2005 I'm not sure what SenderBase's problem is, perhaps it's just slow on the uptake. In any case, 181.254.89.68.bl.spamcop.net is not showing as having IP Address 127.0.02 at present, either directly from here or at any of the nameservers listed on http://www.dnsstuff.com/tools/ispdns.ch?na...mcop.net&type=A.
Merlyn Posted July 21, 2005 Posted July 21, 2005 Currnet Senderbase shows it up quite a bit, are you sure it is fixed? Last day 4.5 6332% Last 30 days 3.6 744% Average 2.7 up 6,332% in the last day after you said it was fixed is quite a bit, something is going on with this machine.
Jeff G. Posted July 21, 2005 Posted July 21, 2005 That looks like about 42 thousand emails in the last day, vs. about 5 thousand per day this past month, and under 700 per day average. Does that sound right?
Recommended Posts
Archived
This topic is now archived and is closed to further replies.