tanfwc Posted February 7, 2006 Posted February 7, 2006 Hi, I am having problems delisting the IP from the spamcop. This is the second time I am requesting for delisting. I have done is to install a new anti-virus software and checking all the server for viruses. No virus is found and this is the second time it is listed. Can someone guide me to completely from this problem? http://www.senderbase.org/?searchBy=ipaddr...7.110&showRBL=1 Thank you
Wazoo Posted February 7, 2006 Posted February 7, 2006 You don't say anything about the timing involved. From the SenderBase data, it would appear that the (suggested) virus removal was done very recently ... so are you just making an assumption that removal should be instantaneous? Recall that there was time gone by before this IP got itself listed ....
tanfwc Posted February 7, 2006 Author Posted February 7, 2006 Ok, I have introduce a stricter rules to all the email been process on the email server. This might be mis-configured by the previous administrator. A new antivirus software was just deploy to the network. This time, everything is done to protect this from listing again. So how do I go about delisting again?
Derek T Posted February 7, 2006 Posted February 7, 2006 Listed on SpamCop and CBL, delisted and relisted in both. In the long run, it doesn't pay to request de-listing before you fix the problem!
Derek T Posted February 7, 2006 Posted February 7, 2006 Ok, I have introduce a stricter rules to all the email been process on the email server. This might be mis-configured by the previous administrator. A new antivirus software was just deploy to the network. This time, everything is done to protect this from listing again. So how do I go about delisting again? 40161[/snapback] You have to wait for 22 hrs. De-listing is automatic, as is listing.
tanfwc Posted February 7, 2006 Author Posted February 7, 2006 You have to wait for 22 hrs. De-listing is automatic, as is listing. 40163[/snapback] Is it possible to speed up the process? Our company is causing lots of loss mail which result in problem contacting our supplier.
dra007 Posted February 7, 2006 Posted February 7, 2006 Unfortunately repeated offenders stay listed longer. Personally I wish three strikes and you are out rule applied here. But that is a personal oppinion of course.
Jeff G. Posted February 7, 2006 Posted February 7, 2006 Is it possible to speed up the process?40166[/snapback] Yes, please see Dispute listing of 58.185.127.110.
Wazoo Posted February 7, 2006 Posted February 7, 2006 Is it possible to speed up the process? Our company is causing lots of loss mail which result in problem contacting our supplier. 40166[/snapback] Exactly why are you losing e-mail? Haven't you yet contacted your supplier via other means yet to explain what their e-mail server protection plans are doing to "your" e-mail? Technically, if they are rejecting your e-mail, then your server should be reflecting that non-delivery and schedule that same e-mail for another attempt later. But again, this is all based on the decisions made on your server and the server that you're trying to connect to.
tanfwc Posted February 7, 2006 Author Posted February 7, 2006 Exactly why are you losing e-mail? Haven't you yet contacted your supplier via other means yet to explain what their e-mail server protection plans are doing to "your" e-mail? Technically, if they are rejecting your e-mail, then your server should be reflecting that non-delivery and schedule that same e-mail for another attempt later. But again, this is all based on the decisions made on your server and the server that you're trying to connect to. 40169[/snapback] Since you are the admin, can you supply more information of the banlist to me? I can provide you mean of proof that I am the server admin
agsteele Posted February 7, 2006 Posted February 7, 2006 Since you are the admin, can you supply more information of the banlist to me? I can provide you mean of proof that I am the server admin40173[/snapback] Wazoo is admin of the of these forums which are a user self-support area. he is not an admin for the SpamCop blocklist. There are FAQ entries on the front page of the forums to assist you. Other users have pointed you to the means to dispute the listing but you will need to provide better evidence that the problem has been resolved. Otherwise, you will de-list automatically assuming there are no further problems. Andrew
Derek T Posted February 7, 2006 Posted February 7, 2006 Yes, please see Dispute listing of 58.185.127.110. 40168[/snapback] Disputing won't do him/her any good, I suspect. Disputing is for when the listing is erroneous (or so it says on the link). Prroblem is the listing was quite justified and s/he shot him/herself in the foot by delisting before the problem was fixed. Serves him/her right IMNSHO.
agsteele Posted February 7, 2006 Posted February 7, 2006 Prroblem is the listing was quite justified and s/he shot him/herself in the foot by delisting before the problem was fixed. Serves him/her right IMNSHO.40184[/snapback] I quite agree. Andrew I note that: 58.185.127.110 listed in bl.spamcop.net (127.0.0.2) If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 17 hours. Causes of listing * System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop) Additional potential problems (these factors do not directly result in spamcop listing) * System administrator has already delisted this system once Because of the above problems, express-delisting is not available Listing History In the past 14.5 days, it has been listed 4 times for a total of 7.3 days
tanfwc Posted February 8, 2006 Author Posted February 8, 2006 I realise the mistake I have make previously. Now I am correcting the server by putting spam filtering, locking down ports and securing the mail server. I am trying to get some help from you guys but all I get is "Serve you right", this does not sound encouraging.
StevenUnderwood Posted February 8, 2006 Posted February 8, 2006 I realise the mistake I have make previously. Now I am correcting the server by putting spam filtering, locking down ports and securing the mail server. I am trying to get some help from you guys but all I get is "Serve you right", this does not sound encouraging. 40219[/snapback] "Us guys" are just other users of the various spamcop systems. We can not delist you, only an email to deputies[at]spamcop.net could possibly do that, though it may be unlikely unless you can completely convince them you have fixed the problem. Again, the fact you tried the easy way out by delisting before being sure the problem were fixed, works against you. Are you also aware that there is at least one report from a real person as well? Report History: -------------------------------------------------------------------------------- Submitted: Thursday, January 26, 2006 1:13:47 AM -0500: Re: Pharam acy lulu 1635893057 ( 58.185.127.110 ) To: hostmaster[at]singnet.com.sg
tanfwc Posted February 8, 2006 Author Posted February 8, 2006 "Us guys" are just other users of the various spamcop systems. We can not delist you, only an email to deputies[at]spamcop.net could possibly do that, though it may be unlikely unless you can completely convince them you have fixed the problem. Again, the fact you tried the easy way out by delisting before being sure the problem were fixed, works against you. 40221[/snapback] Thank you Steven. The problem that is cause by this is a major mis-configuration to the MDaemon we are using. This has been setup by the previous administrator and I just take over not long. I have put in place a filtering system and antivirus scanning of all incoming/outgoing emails. If I could get the message header of the email, that will be helpful(excluding confidental information). I have contacted SpamCop too, they ask me to wait for it to delist automatically as they cannot delist it. That's a different answer I expected, I thought they could delist us.
petzl Posted February 8, 2006 Posted February 8, 2006 I thought they could delist us. 40222[/snapback] SpamCop is an algorithm you are due for delisting in a few hours It would take that long depending on the the time the administration that possibly could or maybe would sleeps and can react to such a request its 4pm in Sydney probably 3am for the people with this power You have also disabled bounces
tanfwc Posted February 8, 2006 Author Posted February 8, 2006 You have also disabled bounces 40225[/snapback] Hi, That's mean I must configure the way my email server accept the email? is this ok? Trying to connect to all mailservers: smtp.domain.tld. - xxx.xxx.xxx.xxx [Could not connect: Got an unknown RCPT TO response: 550 <test1[at]domain.tld>, Recipient unknown] test1 is not a mailbox in the email server Sorry for the newbie question as this is the FIRST time I am encountering blacklist in my entire life
petzl Posted February 8, 2006 Posted February 8, 2006 That's mean I must configure the way my email server accept the email? is this ok? test1 is not a mailbox in the email server 40239[/snapback] Spammers often use email addresses of their victims meaning if your server gets viruses or spam to defunct email addresses and your server and or virus program spews replies back to those faked email address SpamCop will also list the IP doing this
Miss Betsy Posted February 9, 2006 Posted February 9, 2006 I am not a server admin so I can't much help. However, I do understand about 'bounces' in theory. What you do not want to do is to accept email and then send an email to the return path saying that it is undeliverable. This method used to be common and RFC compliant, but once the spammers started using forged return paths, it becomes just another way to spam. If you send an undeliverable message, it is has to be before the acceptance stage. You set your server up to give 5xx messages and refuse to accept certain emails. If you can't do that, then you have to send the email that can't be delivered to the bit bucket. There is also something about turning off the 'catch-all' account, but I can't explain that. Miss Betsy
Derek T Posted February 9, 2006 Posted February 9, 2006 That's mean I must configure the way my email server accept the email? 40239[/snapback] No, it means that you MAY have to configure the way your server REJECTS email. It should not accept it and then generate a new message to the return envelope if it is undeliverable. Instead, it should reject DURING the SMTP session with a 5xx code if the message is undeliverable. That's the ONLY way can be sure of sending the reject to the right server and not to an innocent 3rd party whose address has been spoofed (or a spamtrap).
Recommended Posts
Archived
This topic is now archived and is closed to further replies.