ahz Posted December 7, 2005 Share Posted December 7, 2005 I started using SC lately, and now my SMTP server is in the block list! Is there a way to search to see I didn't report my own SMTP server on accident? Otherwise, could this be retaliation? Link to comment Share on other sites More sharing options...
Wazoo Posted December 7, 2005 Share Posted December 7, 2005 No data provided, can't help. You are responsible for which reports go out and where they go. Have you submitted yourself? What's the IP address of the server involved? Yes, I could invoke Admin powers and research your posting Ip address, track that down to an MX server for that IP block, but there's no guarantee that this will result in the IP address of your outgoing e-mail. Try checking some of the data provided in the SpamCop FAQ, linked to at the top of this very page. Link to comment Share on other sites More sharing options...
turetzsr Posted December 7, 2005 Share Posted December 7, 2005 I started using SC lately, and now my SMTP server is in the block list! Is there a way to search to see I didn't report my own SMTP server on accident?37407[/snapback] Hi, ahz! ...It's possible. Unfortunately, most of us are just users like yourself and, as such, have no access to your reports. If you are a reporting-only (not a SpamCop e-mail) user, then after you log in to http://www.spamcop.net/, there is a link near the top of the page labeled "Past Reports" (it looks like the next-to-right-most tab in a set of five gray tabs). If you click on that, the resulting page has a link labeled "View recent reports." Clicking that link will bring you to a page that will tell you the abuse addresses to which reports were sent by SpamCop on your behalf. Note that there is a link labeled "Older Reports" at the end of the list of the most recent spam reports. ...Have you used SpamCop MailHosts configuration? One of the reasons it was created was to avoid reporting your own SMTP host (or ISP or MSP). You may wish to try it but read all instructions carefully. You can start it by clicking the "MailHosts" link at the top of the http://www.spamcop.net/ page (it looks like the next-to-left-most tab in the set of five gray tabs of which the aforementioned "Past Reports" is the next-to-right-most one). If you are a SpamCop e-mail subscriber, I'm sorry, I don't know how you check previous reports. Perhaps another SpamCop e-mail subscriber will happen along and offer advice. Otherwise, could this be retaliation? 37407[/snapback] ...From what others have responded to other posts, this seems fairly unlikely. ...For what do you use your SMTP -- outgoing e-mail only? If so, I would guess that either The PC of a user who has access to your SMTP server has been trojanned or zombied or A spammer has gained access to your SMTP server (often this happens when there is a security hole on that server, such as a user id with a weak or no password. ...Good luck finding the problem! Link to comment Share on other sites More sharing options...
ahz Posted December 7, 2005 Author Share Posted December 7, 2005 The IP is 209.239.38.176. BTW, I do not run this SMTP server, so I am not asking for delisting: I asked my provider to do that. I checked my reporting history and did not notice the hostname, so as far as I can tell, it's either retaliation or a coincidence because I've never had my SMTP in the block list for years until I started spamcop reporting very recently. Link to comment Share on other sites More sharing options...
ahz Posted December 7, 2005 Author Share Posted December 7, 2005 Steve, I will look into mailhosts before I submit more spam. I have reported spam sent to two different e-mail addresses, so I need to read it carefully (as you suggested). For what do you use your SMTP -- outgoing e-mail only? The SMTP server belongs to my shared web host. Our office sends and receives mail through it. Actually, we use fetchmail to download mail from the web host via POP3. I hope this setup doesn't complicate things. Link to comment Share on other sites More sharing options...
turetzsr Posted December 7, 2005 Share Posted December 7, 2005 <snip> The SMTP server belongs to my shared web host. <snip> 37418[/snapback] ...In that case, I would point you to the SpamCop FAQ (see link near top of page) items labeled "Why am I Blocked?" and "SpamCop Blocking List - Am I listed?" There may also be other relevant links there so I hope you'll have time to scout around. Link to comment Share on other sites More sharing options...
Telarin Posted December 7, 2005 Share Posted December 7, 2005 The IP is 209.239.38.176. BTW, I do not run this SMTP server, so I am not asking for delisting: I asked my provider to do that. I checked my reporting history and did not notice the hostname, so as far as I can tell, it's either retaliation or a coincidence because I've never had my SMTP in the block list for years until I started spamcop reporting very recently. 37417[/snapback] There are a couple of possible problems with sending through a shared SMTP server. 1) Another customer who uses the same shared SMTP server is abusing it. 2) One of your SMTP accounts, or an account of another customer that uses this server may have no password, or a weak password, and is being used to send mail through your SMTP server. While you have no control over the first one, you do have some control over the second, at least if the problem were with one of your users passwords. I usually don't recommend using your webhosts SMTP server for sending mail, its usually better to use it for receive only, and send mail through your ISPs regular SMTP server. This usually works out better as most ISPs will only allow connections to be made to their SMTP server from "their" IP addresses, preventing outsiders from sending using those servers. It also means that if someone inside their network is sending spam using their SMTP server, they are better equipped to respond and cut off that users access (not that they necessarily WILL respond quickly, but at least they have the capability). I ran the IP you listed, and it is not currently listed on the SCBL. I think the paid members may be able to pull past spam reports though, so if that is the case, it would be nice if one of said paid members could pull a tracking link to an old spam report so we can have a look at the headers. In the mean time, should your address be listed again, I would recommend switching your outgoing SMTP server to the one provided by your ISP. Link to comment Share on other sites More sharing options...
Wazoo Posted December 7, 2005 Share Posted December 7, 2005 Looks like a matter of timing involved. This server was in fact listed (currently showung that fact at http://www.senderbase.org/?searchBy=ipaddr...=209.239.38.176 .. but yes, http://www.spamcop.net/w3m?action=checkblo...=209.239.38.176 shows it as not currently listed. This is a function of the "automatic" part of the SpamCopDNSBL (again a FAQ entry) .. even the variance involved in the de-listing time is addressed in the FAQ "here" .... NEW! SCBL "will be delisted in 0 hours" (now shown as 'in a short time') explained Link to comment Share on other sites More sharing options...
Jeff G. Posted December 8, 2005 Share Posted December 8, 2005 Report History is as follows: Submitted: Wednesday 2005/12/07 14:57:30 -0500: Job from BainDoucses 1578552663 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1578552633 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1578552606 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1578552585 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 16:29:41 -0500: Job from BainDoucses 1577490469 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1577490463 ( Forwarded spam ) To: [concealed user-defined recipient] 1577490452 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1577490436 ( 209.239.38.176 ) To: [concealed user-defined recipient] 1577490426 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1577490421 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 11:36:25 -0500: Job from BainDoucses 1577266679 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1577266665 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1577266645 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1577266627 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 11:36:23 -0500: Job from BainDoucses 1577267618 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1577267612 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1577267602 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1577267590 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 10:39:20 -0500: Job from BainDoucses 1577213687 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1577213669 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1577213648 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1577213623 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 10:22:01 -0500: Job from BainDoucses 1577193980 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1577193932 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1577193900 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1577193866 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 09:17:46 -0500: Potential spam-Score: (4)Job from BainDoucses 1577136662 ( http:// www.bain-doucses.com/vacancies.htm ) To: mole[at]devnull.spamcop.net 1577136660 ( 209.239.38.176 ) To: mole[at]devnull.spamcop.net -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 07:04:48 -0500: **Fwd: Job from BainDoucses 1577244431 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1577244430 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1577244429 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1577244428 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 06:53:56 -0500: Job from BainDoucses 1576998201 ( 209.239.38.176 ) To: abuse[at]alabanza.com 1576998194 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 01:38:58 -0500: Job from BainDoucses 1576768449 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1576768447 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1576768442 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1576768433 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Tuesday 2005/12/06 00:11:24 -0500: Job from BainDoucses 1576713353 ( http:// www.bain-doucses.com/vacancies.htm ) To: network-abuse[at]cc.yahoo-inc.com 1576713348 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1576713347 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1576713337 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Wednesday 2005/11/23 20:54:33 -0500: [Norton AntiSpam] Job from ExpressMail 1564008798 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1564008787 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1564008767 ( 209.239.38.176 ) To: abuse[at]alabanza.com -------------------------------------------------------------------------------- Submitted: Wednesday 2005/11/23 13:20:18 -0500: Job from ExpressMail 1563716542 ( 209.239.38.176 ) To: abuse[at]alabanza.com 1563716540 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com -------------------------------------------------------------------------------- Submitted: Saturday 2005/11/19 19:19:32 -0500: Job from ExpressMail 1560499589 ( 209.239.38.176 ) To: spamcop[at]imaphost.com 1560499585 ( 209.239.38.176 ) To: aol-abuse[at]christianwebhost.com 1560499583 ( 209.239.38.176 ) To: abuse[at]alabanza.com You're not affiliated with BainDoucses or ExpressMail, are you? Thanks! Link to comment Share on other sites More sharing options...
StevenUnderwood Posted December 8, 2005 Share Posted December 8, 2005 You're not affiliated with BainDoucses or ExpressMail, are you? Thanks! 37434[/snapback] Or a job placement firn? Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.