Jump to content

Bouncing but ip not in block list?


boardtc

Recommended Posts

Emailing on one friend the last few weeks it always bounces, their sys admin says I need to the IP address removed from SpamCops database

I checked abd the domain (moonbade.com / 84.92.1.4) is noton your list?

Does anyone know what's stopping it?

Here's the bounce info :

Return-path: <tom.corcoran[at]moonbade.com>

Received: from [212.159.6.53] (helo=ptn-atmail02.plus.net)

by ptb-cgirelay01.plus.net with esmtp (Exim 4.34)

id 1FA7Rb-0008Hq-PO

for David.McGuinness[at]FINEOS.com; Fri, 17 Feb 2006 15:22:52 +0000

Content-Type: text/plain; charset="iso-8859-1"

Content-Disposition: inline

Content-Transfer-Encoding: binary

Mime-Version: 1.0

From: Tom.corcoran <tom.corcoran[at]moonbade.com>

To: 'David McGuinness ' <David.McGuinness[at]FINEOS.com> (ext. 950)

Subject: Re: buster at the NFT

Reply-To: tom.corcoran[at]moonbade.com

X-Mailer: AtMail 4.01

X-Origin: 80.177.219.46

X-Uidl: D0A7D6543169D3119B3E00902789397E0A36A989[at]oasis006mscie

Date: Fri, 17 Feb 2006 15:22:35 +0000

Link to comment
Share on other sites

Hmm, are you sure 84.92.1.4 is the IP address of your SMTP server? I just did a quick lookup on registered MXs for moonbade.com, and they are all in the 212.159 or 195.166 subnets, and I don't see any RDNS entries for 84.92.1.4.

The full text of your rejection message rather than just the headers so we can see what YOUR servers IP address is will be needed for any futher troubleshooting.

Link to comment
Share on other sites

Just a guess but it was probably due to spam/419's, advanced pay scams being sent through 212.159.6.53. It is not currently listed so it probably dropped off.

Submitted: Tuesday, February 14, 2006 4:48:12 PM -0500:

Hello

1658231618 ( 212.159.6.53 ) To: spamcop[at]imaphost.com

1658231597 ( 212.159.6.53 ) To: abuse[at]plus.net

Link to comment
Share on other sites

Nice work Merlyn!

Hmm, are you sure 84.92.1.4 is the IP address of your SMTP server?

40555[/snapback]

Yes, confusing - all part of the same PlusNet network. Tom is the registrant of the moonblade.com domain. Tom, your friend's network should be passing your mail or justifying why not (being Irish isn't an excuse), you're not currently on SCBL.
Link to comment
Share on other sites

The last mailserver in the chain, ptb-cgirelay01.plus.net [195.166.130.40] (the one that sent you the bounce message because it couldn't deliver your message to one of the mailservers for FINEOS.com) IS listed by the SCBL - please see http://www.spamcop.net/bl.shtml?195.166.130.40 and http://www.spamcop.net/w3m?action=blcheck&ip=195.166.130.40 for details (some reproduced below for posterity).

195.166.130.40 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 4 hours.

Causes of listing

  • System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)
  • SpamCop users have reported system as a source of spam less than 10 times in the past week

Additional potential problems

(these factors do not directly result in spamcop listing)

  • System administrator has already delisted this system once

Because of the above problems, express-delisting is not available

Listing History

In the past 86.1 days, it has been listed 12 times for a total of 18.7 days

Other hosts in this "neighborhood" with spam reports

195.166.130.41

Although ptb-cgirelay01.plus.net [195.166.130.40] does not have Report History, its close neighbor ptb-cgirelay02.plus.net [195.166.130.41] does, as follows:
Submitted: Thursday 2006/02/16 09:39:43 -0500:

CONTACT PROCESSING AGENT

1660421886 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2006/02/16 09:39:42 -0500:

CONTACT PROCESSING AGENT

1660421897 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2006/02/14 12:36:39 -0500:

Hello

1658049626 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/12/06 09:57:35 -0500:

I AWAIT YOUR URGENT RESPONSE.

1577177191 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/12/03 03:32:57 -0500:

HELLO

1573585385 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1573585384 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/12/03 03:32:56 -0500:

HELLO

1573585348 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1573585342 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/12/01 07:13:59 -0500:

hello..

1571605927 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/12/01 06:38:11 -0500:

HELLO

1571587557 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1571587548 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/30 07:12:34 -0500:

URGENT RESPOND

1570528513 ( http:// www.middle-east-online.com/english/?id=1... ) To: abuse[at]gxn.net

1570528507 ( 212.159.6.132 ) To: spamcop[at]imaphost.com

1570528487 ( 212.159.6.132 ) To: abuse[at]plus.net

1570528480 ( 195.166.130.41 ) To: relays[at]admin.spamcop.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/11/29 09:06:30 -0500:

URGENT RESPONSE

1569531664 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Monday 2005/11/28 20:47:06 -0500:

URGENT RESPONSE

1569001682 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1569001676 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Monday 2005/11/28 14:16:22 -0500:

AWARD NOTIFICATION

1568724495 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1568724472 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Monday 2005/11/28 12:28:29 -0500:

AWARD NOTIFICATION

1568642279 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/11/26 01:40:30 -0500:

REPLY ME

1566040777 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/11/26 01:36:19 -0500:

Employment Offer

1566037955 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1566037954 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Saturday 2005/11/26 01:29:28 -0500:

HELLO

1566034408 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1566034406 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 09:06:40 -0500:

HELLO

1566504428 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1566504417 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 05:52:46 -0500:

From Kim Liang

1565220533 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 02:46:41 -0500:

HELLO

1565191649 ( http:// www.metrocat.com ) To: chatree[at]isp-thailand.com

1565191648 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1565191647 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 02:24:06 -0500:

BE OUR BUSSINESS REPRESENTATVIVE

1565080770 ( Forwarded spam ) To: [concealed user-defined recipient]

1565080769 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1565080768 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Friday 2005/11/25 01:06:26 -0500:

From Kim Liang

1565039692 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/11/24 22:38:50 -0500:

BE OUR BUSSINESS REPRESENTATVIVE

1564962068 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/11/24 18:03:37 -0500:

BUSINESS PROPOSAL(REPRESENTATIVE)

1564839889 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1564839888 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Thursday 2005/11/24 07:22:54 -0500:

[Norton AntiSpam] Solenoids

1564823080 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1564823079 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 14:01:35 -0500:

Hello.

1563747534 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1563747529 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 08:37:11 -0500:

WINNING NOTIFICATION

1563504198 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 03:26:59 -0500:

Hello...

1563289370 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Wednesday 2005/11/23 01:34:21 -0500:

Hello...

1563227623 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/11/22 19:47:39 -0500:

HELLO

1563141226 ( 195.166.130.41 ) To: mole[at]devnull.spamcop.net

--------------------------------------------------------------------------------

Submitted: Tuesday 2005/11/22 17:48:47 -0500:

Hello.

1562974951 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1562974949 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Sunday 2005/11/20 19:34:09 -0500:

Solenoids

1561254834 ( 195.166.130.41 ) To: abuse[at]plus.net

--------------------------------------------------------------------------------

Submitted: Sunday 2005/11/20 18:24:17 -0500:

**spam** Solenoids

1561223435 ( 195.166.130.41 ) To: spamcop[at]imaphost.com

1561223433 ( 195.166.130.41 ) To: abuse[at]plus.net

Link to comment
Share on other sites

Thanks everyone. I was hopeful with the last post but it bounced again today :-(

His network people have said it's my problem not there's. But i've not had this happen before. Do only some people use spamcop is that it?

Here are the headers from today.

Thanks for helping.

Cheers, Tom.

Subject:

Mail delivery failure: returning message to sender

From:

Mail Delivery System <Mailer-Daemon[at]ptb-cgirelay01.plus.net>

Date:

Mon, 20 Feb 2006 17:17:06 +0000

To:

tom.corcoran[at]moonbade.com

X-Account-Key:

account3

X-UIDL:

UID11525-1080073234

X-Mozilla-Status:

0001

X-Mozilla-Status2:

00000000

Envelope-to:

tom.corcoran[at]moonbade.com

Delivery-date:

Mon, 20 Feb 2006 17:17:09 +0000

Received:

from localhost ([127.0.0.1]) by ptb-mxcore01.plus.net with esmtp (PlusNet MXCore v2.00) id 1FBEeq-0006sZ-PZ for tom.corcoran[at]moonbade.com; Mon, 20 Feb 2006 17:17:08 +0000

Received:

from ptb-cgirelay01.plus.net ([195.166.130.40])by ptb-mxcore01.plus.net with esmtp (PlusNet MXCore v2.00) id 1FBEeo-0006s7-L1 for tom.corcoran[at]moonbade.com; Mon, 20 Feb 2006 17:17:06 +0000

Received:

from Debian-exim by ptb-cgirelay01.plus.net with local (Exim 4.34)id 1FBEeo-0003ix-85for tom.corcoran[at]moonbade.com; Mon, 20 Feb 2006 17:17:06 +0000

X-Failed-Recipients:

David.McGuinness[at]FINEOS.com

Auto-Submitted:

auto-generated

Message-ID:

<E1FBEeo-0003ix-85[at]ptb-cgirelay01.plus.net>

x-open-relay:

195.166.130.40 is in a black list at bl.spamcop.net

X-PN-VirusFiltered:

by PlusNet MXCore (v2.00)

X-Antivirus:

AVG for E-mail 7.1.375 [267.15.11/264]

MIME-Version:

1.0

Content-Type:

text/plain

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its

recipients. This is a permanent error. The following address(es) failed:

David.McGuinness[at]FINEOS.com

SMTP error from remote mailer after MAIL FROM:<tom.corcoran[at]moonbade.com>:

host mail.fineos.com [217.173.101.209]: 553 5.3.0 spam blocked see:

http://spamcop.net/bl.shtml?195.166.130.40

------ This is a copy of the message, including all the headers. ------

Return-path: <tom.corcoran[at]moonbade.com>

Received: from [212.159.6.58] (helo=ptn-atmail03.plus.net)

by ptb-cgirelay01.plus.net with esmtp (Exim 4.34)

id 1FBEei-0003ig-I3

for David.McGuinness[at]FINEOS.com; Mon, 20 Feb 2006 17:17:00 +0000

Content-Type: text/plain; charset="iso-8859-1"

Content-Disposition: inline

Content-Transfer-Encoding: binary

Mime-Version: 1.0

From: Tom.corcoran <tom.corcoran[at]moonbade.com>

To: 'David McGuinness ' <David.McGuinness[at]FINEOS.com> (ext. 950)

Subject: Re: snowdon

Reply-To: tom.corcoran[at]moonbade.com

X-Mailer: AtMail 4.01

X-Origin: 80.177.219.46

X-Uidl: D0A7D6543169D3119B3E00902789397E0A36A9AF[at]oasis006mscie

Date: Mon, 20 Feb 2006 17:26:14 +0000

Link to comment
Share on other sites

553 5.3.0 spam blocked see:

    http://spamcop.net/bl.shtml?195.166.130.40

40633[/snapback]

Hi boardtc!

Did you follow the link provided in the error message you received? This points to 195.166.130.40

This IP address is currently listed in the SpamCop BL

Causes of listing

* System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

* SpamCop users have reported system as a source of spam less than 10 times in the past week

Additional potential problems

(these factors do not directly result in spamcop listing)

* System administrator has already delisted this system once

Because the admin for this IP has already used the quick delist function but the problem has not been resolved, this option is no longer available to you or the admin for your mail server.

The messages going to spam traps can only be viewed by SpamCop deputies. The messages that have been reported include subjects such as:

Submitted: Sat, 18 Feb 2006 21:03:25 GMT:

We are interested in employing your services

Submitted: Tue, 14 Feb 2006 20:26:09 GMT:

Dear Sir/Madam,

Submitted: Mon, 13 Feb 2006 19:28:43 GMT:

Dear Sir/Madam,

Submitted: Tue, 07 Feb 2006 16:14:04 GMT:

Establish a medaium

There are many more that look like spam. Plus.net needs to take a look at the issue. They have received notice of these issues at abuse[at]plus.net My experience is that their abuse department is responsible. Take it up with abuse and see if you can make progress as a customer.

Andrew

Link to comment
Share on other sites

195.166.130.40 listed in bl.spamcop.net (127.0.0.2)

If there are no reports of ongoing objectionable email from this system it will be delisted automatically in approximately 5 hours.

Causes of listing

* System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop)

* SpamCop users have reported system as a source of spam less than 10 times in the past week

Additional potential problems

(these factors do not directly result in spamcop listing)

* System administrator has already delisted this system once

Because of the above problems, express-delisting is not available

Listing History

In the past 89.2 days, it has been listed 14 times for a total of 20.8 days

Other hosts in this "neighborhood" with spam reports

195.166.130.41

Yes, only some ISPs use spamcop blocklist to block emails. It is your problem with your ISP. Ask him why he is allowing spam from 195.166.130.40.

If you don't want the hassle of trying to convince your ISP that he is irresponsible and incompetent and not providing you with reliable email service, you can always use some webmail address to email the person whose ISP is 'bouncing' your email. Yahoo is not a good choice, but hotmail and other free web mail are probably ok.

Miss Betsy

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...