Portuguese ISP being blocked

[MiguelRamos]

Dear all,

the reason for this post is to ask your attention to the fact that "sapo.pt", one of the domains of "telepac.pt" the main ISP in Portugal is being blocked by your list.

The servers on this ISP are Exchanged based, other are UNIX with qmail and the specific smtp server appears to be 212.55.154.22 (relay1.ptmail.sapo.pt) but there is also a relay1.ptmail.sapo.pt (212.55.154.21). Currently these smtp require authentication.

Here is the reply from the server:

Hi. This is the qmail-send program at sapo.pt.

I'm afraid I wasn't able to deliver your message to the following addresses.

This is a permanent error; I've given up. Sorry it didn't work out.

<octavio.garcia[at]inforgate.net>:

66.98.188.93 does not like recipient.

Remote host said: 451 Blocked - see http://www.spamcop.net/bl.shtml?212.55.154.22

Giving up on 66.98.188.93.

I'm not going to try again; this message has been in the queue too long.

--- Below this line is a copy of the message.

Return-Path: <cpombo[at]turware.pt>

Received: (qmail 10865 invoked from network); 18 Mar 2004 14:50:29 -0000

Received: from unknown (HELO sapo.pt) (10.134.35.153)

by relay2 with SMTP; 18 Mar 2004 14:50:29 -0000

Received: (qmail 10262 invoked from network); 18 Mar 2004 14:49:37 -0000

Received: from unknown (HELO twserver2k.turware.pt) ([81.193.125.122])

(envelope-sender <cpombo[at]turware.pt>)

by mta3 (qmail-ldap-1.03) with SMTP

for <octavio.garcia[at]inforgate.net>; 18 Mar 2004 14:49:37 -0000

-------------------------------------------------------------------------------------------

Please look into this situation as you can understand there are several problems in place because no one using your list can receive email from this ISP (which is the main provider in Portugal.

Thank you very much,

Miguel Ramos

(miguel.ramos[at]inforgate.net)

[Jeff G.]

According to http://www.spamcop.net/w3m?action=blcheck&ip=212.55.154.22:

Query bl.spamcop.net - 212.55.154.22

212.55.154.22 is relay2.ptmail.sapo.pt

212.55.154.22 listed in bl.spamcop.net (127.0.0.2)

Since SpamCop started counting, this system has been reported about 150 times by about 30 users. It has been sending mail consistently for at least 147.7 days. It has been listed for 8.2 days.

In the past week, this system has:

Been reported as a source of spam less than 10 times

Been detected sending mail to spam traps

Been witnessed sending mail about 5250 times

Other hosts in this "neighborhood" with spam reports:

212.55.154.21

212.55.154.23

212.55.154.24

212.55.154.25

212.55.154.26

A sample sent sometime during the 24 hours beginning Sunday 2004/03/21 19:00:00 -0500:

Received: from -.- (-.-.-.- [212.55.154.22])

by -.-.com.- (Postfix) with SMTP id -

for <-[at]-.com.->- Mon, 22 Mar 2004 - - (-)

Subject: [none]

From: fn.. at ..u.com

A sample sent sometime during the 24 hours beginning Tuesday 2004/03/16 19:00:00 -0500:

Received: from -.- (-.-.-.- [212.55.154.22])-

by -.-.-.-.net-

(- - - -.- - -.- (- May - -))-

with SMTP id <-[at]-.-.-.-.net> -

-[at]-.net (- -[at]-.net)- Wed,-

- Mar 2004 -55- - (-)-

Subject: very urgent

From: p_.. at ..po.pt

A sample sent sometime during the 24 hours beginning Tuesday 2004/03/16 19:00:00 -0500:

Received: from -.- (-.-.-.- [212.55.154.22])

by -.-.-.- (-.-.-.-.-) with SMTP id -

for <-[at]-.-.->- Wed, - Mar 2004 - -

Subject: [none]

From: gc.. at ..es.fr

A sample sent sometime during the 24 hours beginning Tuesday 2004/03/16 19:00:00 -0500:

Received: from -.-.-.- ([212.55.154.22] -.-)

by -.-.net with smtp id -

for -[at]-.-.net- Wed, - Mar 2004 - -

Subject: -

From: _f.. at ..5.com

A sample sent sometime during the 24 hours beginning Saturday 2004/03/13 19:00:00 -0500:

Received: from -.- [212.55.154.22] by -.com

(-.-) id - Sun, - Mar 2004 - -

Subject: - em - para -

From: bi.. at ..po.pt

A sample sent sometime during the 24 hours beginning Saturday 2004/03/13 19:00:00 -0500:

Received: from -.- (-.-.-.- [212.55.154.22])-

by -.-.- (Postfix) with SMTP id -

for <-[at]-.->- Sun, - Mar 2004 -22- - (-)-

Subject: - spam - the only - you need - score - for -

From: kb.. at ..l.com

A sample sent sometime during the 24 hours beginning Wednesday 2004/02/04 19:00:00 -0500:

Received: from -.- ([212.55.154.22]) by -.-.-.-

(- -.-.-.-.- -22-22-) with -

id <-.-.-.-.-.-[at]-.->-

for <-[at]-.-.->- Thu, - Feb 2004 - -

Subject: -

From: na.. at ..po.pt

A sample sent sometime during the 24 hours beginning Thursday 2003/11/27 19:00:00 -0500:

Received: from -.- ([212.55.154.22]) by -.-.-.-

(- -.-.-.-.- -22-22-) with -

id <-.-.-.-.-.-[at]-.->

for <-.-[at]-.-.->-

Fri, - Nov 2003 - -

Subject: - online - visa

From: ma.. at ..da.pt [/code]

Been detected sending mail to spam traps is a kiss of death for any IP Address. ISPs whose IP Addresses have Been detected sending mail to spam traps need to review FAQ Entry "How can I be de-listed" at http://www.spamcop.net/fom-serve/cache/298.html ASAP.

SpamCop Reports for 212.55.154.22 are currently going to the following addresses - please ask them for copies of the reports:

postmaster[at]mail.telepac.pt

abuse[at]mail.telepac.pt

Also, according to http://moensted.dk/spam/?addr=212.55.154.22, 212.55.154.22 "was found in 15 lists (of 258 tested)".

[MiguelRamos]

First of all, thank you for your reply.

Telepac currently has several million users, I don't think the entity (even that I don't use their services) should be blammed for everything users do... but I understand your reply and I'll continue "shooting" in several directions in order to solve (or at least try) this problem.

[Spambo]

[snip]

Please look into this situation as you can understand there are several problems in place because no one using your list can receive email from this ISP (which is the main provider in Portugal.

People using the SpamCop blocklist don't want to receive email from the listed server as long as it is being used by spammers.

[Merlyn]

It looks as if massive amounts of criminal 419 scammers like to use your providers servers because they do not act upon abuse complaints. It is a pity that spammers have spoiled email for everyone.

I think you would agree with me that everyone is tired of receiving 419 scams, mortgage quotes, penis enlargement, breast enhancement, weight loss, nude 40 year old teenage sluts, Viagra, vacation, lottery, prescription drug, business opportunities, genealogical, university degrees, gambling, get rich quick, MLM, pyramid schemes, Web Cams, Russian brides, work from home, stock scams, pirated software and everything else that is force fed into our inboxes.

I believe you should take this up with your provider. There is no excuse for the amount of spam coming from their servers. Each Spamcop complaint actually reflects from thousands to tens of thousands of spam that was sent.

Many of your servers are blocked by other lists also.

For an example of one see: http://www.moensted.dk/spam/?addr=212.55.1...2&Submit=Submit

[StevenUnderwood]

I don't think the entity (even that I don't use their services) should be blammed for everything users do

The entitiy is not blamed or even listed.

In general, the administrator or the IP detected sending spam is informed of this information. If the administrator does something quickly and stops the flow, they will not be listed. If more people report receiving spam from the same IP (according to a formula based on number of valid messages vs. spam messages detected), it will be listed. If the administrator stops the flow, the IP will drop off the list no more than 48 hours after the last report is received. If the administrator does not stop the flow, the IP remains listed.

It is the administrator of the IP that needs to be blamed for letting their users send spam. In most cases, it is against the AUP (Acceptable Use Policy) the customer agreed to when they signed up. If so, the administrator is letting his cusomers break the rules and allowing them to bother innocent people throughout the internet.

[MiguelRamos]

Again thank you everyone for your replies. I do agree with what was said here *and* I've already wrote a long email to them, but from what I know from them they won't mind because they are "the biggest isp in Portugal"... how stupid can that be - I just can hope they bother looking into this.

Keep on the good work guys! And thank you again.

[turetzsr]

<snip> I've already wrote a long email to them, but from what I know from them they won't mind because they are "the biggest isp in Portugal"... how stupid can that be - I just can hope they bother looking into this.

<snip>

...Maybe one day (if it hasn't happened already), someone will start a responsible ISP in Portugal and telepac will quickly find itself one of the smallest ISPs in Portugal!