Will someone get us off the low senderbase reputation please

[InnocentVictim]

Our shared IP had spam coming from it from another individuals server - the hosting company were unusually slow to react and only when I highlighted the problem was it realised that spam was being issued (I think it was an infection rather than an originator). I believe this spam must have been low volume but nasty (Phishing) because our hosting company is normally very quick to react when there is a problem. But as soon as the issue was known it was resolved.

Unfortunately for my company and that of the clients whom we host, bad spam blocking software out there is still bouncing our emails... because the IP's senderbase reputation is low.

How do I get that changed quickly?

Please note - we are not Spammers, we loathe it, I daily get emails advertising best prices for drugs I cannot use and extensions to body parts I do not own *but* I would rather suffer that than to lose a single genuine communication.

Can anyone out there advise how to resolve this problem for all of the innocent parties involved?

I have been informed that I must send out a lot of emails so that the genuine emails outweigh the spam statistically - then the senderbase reputation will get better faster- can anyone confirm this for me?

(no I won't even entertain it - that's as bad as spamming in my view)

[agsteele]

How do I get that changed quickly?

...I have been informed that I must send out a lot of emails so that the genuine emails outweigh the spam statistically - then the senderbase reputation will get better faster- can anyone confirm this for me?

(no I won't even entertain it - that's as bad as spamming in my view)

Unfortunately, spammers have spoilt things for everybody. Often it is the innocent who suffer.

Before anyone can help you you'll need to provide rather more information than you have done so far. To start with we'll need the IP address of your outgoing mail server - the one that's been identified as a source of spam. Take a look at the FAQ to find out what information you need to provide.

If your problem is only with SenderBase then you've posted in the wrong forum and a moderator may move your question to the Lounge since this area is about issues with the SpamCop block list.

In general, though, you've been incorrectly advised about the SenderBase issue. You simply need to stop the flow of spam from the IP address and the statistics will be adjusted accordingly. Sending a lot of good mail in proportion to the spam would be an impossible task if you're subject to a spammer's abuse of the system. Far easier to fix the flow and the stats will self correct.

But if you have a SpamCop listing give the information requested in the FAQ and you'll find folk happy to give advice.

Andrew

[StevenUnderwood]

*but* I would rather suffer that than to lose a single genuine communication.

That is your option... others would much rather use blocklists to force the senders from bad providers to find other ways to get their message across. At least with blocklists, the sender is notified their message did not get through.

You did not provide any IP address so we can do no investigation and not provide you any specifics.

This is NOT a senderbase message board, but I believe you are correct about the reputation being a history kind of thing. Just like in real life, it is quick and easy to lose a reputation, much longer and harder to get it back.

[InnocentVictim]

That is your option... others would much rather use blocklists to force the senders from bad providers to find other ways to get their message across. At least with blocklists, the sender is notified their message did not get through.

You did not provide any IP address so we can do no investigation and not provide you any specifics.

This is NOT a senderbase message board, but I believe you are correct about the reputation being a history kind of thing. Just like in real life, it is quick and easy to lose a reputation, much longer and harder to get it back.

Thank you Steve for your reply, I am referring to the SenderBase Reputation rather than the SpamCop Block List. We aren't blacklisted there.

I have posted this in the wrong area, many apologies. Do you want me to post this in the Lounge or is it possible to move it?

IP is 85.92.67.109 btw.

I agree that bad providers deserve to lose business, but how are those people who are 'forcing' others to find other ways of sending their email differentiating between a good provider and a bad provider: is there a list?

And can anyone give a sensible reason as to why it should take longer for the SenderBase Reputation to become better than for it to lower?

I don't really understand either why IP addresses are treated as spam - I thought they were two different things?

[Telarin]

Hmm, looks like a poor senderbase reputation is not your only problem. According to http://www.robtex.com/rbl/85.92.67.109.html your IP is also listed on the following blacklists:

dnsbl.sorbs.net

sorbs.dnsbl.net.au

spam.dnsbl.sorbs.net

t1.dnsbl.net.au

web.dnsbl.sorbs.net

Apparently the problem went on for quite a while to get listed. Also the IP was used to send spam (spam.dnsbl.sorbs.net) as well as hosting a spammed website (web.dnsbl.sorbs.net). I would address those blacklists first, as I believe that some blacklist entries are used in calculating the senderbase reputation score. I believe SORBS will remove listings if you can show that they are now clean, though I know he will not remove IP addresses that have repeated problems. You will need to contact the owner of that list directly to effect a removal.

Edit:

Also, checked the SORBS list itself, and it looks like they have received spam from that IP address as recently as 6/9/2008. Did you just get this IP address? If so, you might want to talk to your hosting company about issuing you a different IP until that one has been cleaned up and removed from various blacklists.

[StevenUnderwood]

Yes, it will be moved to the Lounge with this post.

Also, the most recent report SpamCop has received is:

Submitted: Tuesday, June 10, 2008 18:08:24 -0400:

Official Mail For User of NatWest Bank Private and Business

3184572207 ( http:/ /www.mesiu.com/mambocm/cache/www.hsbc.co.uk/ ) To: abuse[at]theplanet.com

3184572205 ( 85.92.67.109 ) To: abuse[at]uknoc.co.uk

[Miss Betsy]

spam is unsolicited email. IP addresses are addresses on the internet. Some IP addresses never send email (unless they are infected with a trojan). An email server has an IP address that is recognized by other email servers when email is sent and received. If you share an email server with other people (as you are doing), then even if you are vehemently against spam, your email server IP address can be listed as sending spam if someone else who is using that server is, or has been, sending spam.

If you are not just simply an end user with a personal website, you really ought to research how email is sent and why an IP address may be added to a blacklist. There are responsible webhosting companies and others that are either incompetent or don't care. It is not that difficult to understand the concepts - you don't have to be able to run a server in order to make a responsible consumer decision.

As has been suggested, sometimes a webhosting company will have an email server that is not on any blocklists and they will assign you to that server. (Occasionally, spam slips by even responsible web hosts, but they are usually very happy to help those customers who don't have a spam problem - and they won't suggest sending more emails to overcome the senderbase reputation.)

Filtering that occurs at the server level will return a non-delivery message to the sender if there is a problem with that IP address sending spam. Filtering that occurs after the email is delivered may, or may not, even identify the email as spam correctly. If the recipient doesn't identify the 'good' email amongst all the spam, then the email disappears and the sender doesn't know that it wasn't seen. Since spam can only be stopped from being sent from the sending end, the sender is the one who is responsible for using email service that doesn't send spam. If email is blocked and they can't send email because their email service is not responsible for clean email, then that is their problem, not the receiver's. They have several options - complain, change email service, use another method of communicating with those who won't receive spam as well as their email.

Miss Betsy

[InnocentVictim]

Thank you for moving the thread Steve. Apologies for that.

Thank you Miss Betsy, you explained the point well. I just wanted to try and see the distinction between IP blocking as opposed to spam blocking. Until there is a solution that tempers IP blocking with known good domains we are unlikely to see anything that is better than the proverbial cracking of a nut with a sledgehammer.

It is interesting that many people are very happy to see Spammers damaged even if it means damaging others in the process. Sorbs for example.

'Don't arrest the criminals - bomb the whole street instead' approach.

I agree spam is a total menace. I too want to see an end to it. But I can't see how damaging innocent parties along the way is a good thing.

I am resigned to the fact that we will most probably have to change to another IP. There is no will out there to try and ensure our services are back up and running with minimum disruption (we call that the professional approach) and I am getting so much flack from our customers now that I have to make a responsible business decision.

Thanks for your help anyway. I thought there might be an easier way to resolve this.

EDIT: Apolgies Telarin I tried to post a reply to you when the thread was moved and it failed:

Basically yes, I was aware that the IP had been added to SORBS and I raised a ticket with them last Monday. No reply so far, but as we are not the server owners, nor are we anything to do with the spamming, I don't suppose we will get a reply.

I have read many reports of innocent parties being caught up in their net and didn't realise that the reputation score would use such a flaky source as part of its basis.

[StevenUnderwood]

I just wanted to try and see the distinction between IP blocking as opposed to spam blocking. Until there is a solution that tempers IP blocking with known good domains we are unlikely to see anything that is better than the proverbial cracking of a nut with a sledgehammer.

With most IP blocking, however, the sender will get a message stating their message did not get through because it is implemented during the SMTP transaction.

With most "spam blocking" the sender will never know their message was not seen because as far as the server sees, the message was delivered.

IMO, blocking IP's that have spammed recently or often before receipt is still the best solution I have seen.

[Miss Betsy]

I have read many reports of innocent parties being caught up in their net and didn't realise that the reputation score would use such a flaky source as part of its basis.

IMHO, there are no 'innocents' on the internet in regard to spam. Those who are caught up, as you were, are simply ignorant of how the internet works and the 'natural to the the internet' solution to spam. Offline, 'innocent' business owners who are located in an area that is ruined for their business because of lax zoning laws or the building of a Wal*Mart or other reasons why their business location is no longer good for them have no recourse. Some are savvy enough to survive; others take losses, but recover; others lose out. It is no different online. Ignorance is not bliss for business owners.

Miss Betsy