Re: Re: Website link for 217.15.102.67

----- Original Message ----- 
From: "Alexey Lobanov (dsbl)" <[email protected]>
To: "Chris Z." <[email protected]>
Cc: <[email protected]>
Sent: Friday, September 23, 2005 18:18
Subject: Re: [DSBL-Contact] Re: Website link for 217.15.102.67


> Hello.
>
> First, few explanations. DSBL is neither a form nor a state
> institutions; mailserver admins use DSBL database absolutely
> voluntarily, because they trust DSBL data and accept DSBL policy. If
> they don't, they will simply delete any mentions about "list.dsbl.org"
> from mailserver confugurations, and your mail will go smoothly.
>
> So, all your writings are purposed mostly for those server admins: if
> you convince them that the current DSBL policy is wrong, DSBL will not
> be used.
>
> On 23/09/05 12:27, Chris Z. wrote:
>
>> hi again,
>>
>> we dont publish any data, server is owned by a non-computer related
>> company whcih has nothing to do with publising DNS enties and does not
>> have DNS servers. Someone else had published some DNS entries which are
>> incorrect and i cannot resolve that issue since its a DNS server issue
>> at some ISP and out of my control.
>>
>> You can test the IP for spaming and if it does, well, keep it in ur
>> list, but if it doesnt, pls remove it because it shouldnt be there since
>> it does not spam.
>> Some DNS server incorrect reverse DNS enrty is not a reason to keep some
>> IP in the blacklist of spammers.
>
> 1. Please look at http://postmaster.aol.com/guidelines/standards.html
> item 4. AOL is not the only mail system implementing this policy.
>
> 2. Incorrect DNS is a part of 217.15.102.67 misbehavior. This system was
> compromised in past AND is still anonymous. DSBL believes that
> this combination is absolutely enough for to label this server as an
> insecure.
>
>> Plus, u know well it isnt a spammer system, it was attacked by a virus
>> (as u suggested in previous mail) which uses windows buffer overflow to
>> gain access to the system.
>> You also know that its not sending any spam, so why insist in keeping it
>> in the list??
>
> No, we don't know it and cannot know it. Only you, the server
> owner|admin, know it.
>
>> You feed good about it? and 24-25 hrs removal? that sounds
>> reasonable to you?
>>
>> thanks
>>
>> PS if i enable reverse DNS checks on the mail server it will refuse a
>> great many numbers of legitimate emails which dont reverse DNS properly
>> and u know that.
>
> See AOL policy again. Many corporate systems implement same policy:
> anonymous sources of e-mail are less and less welcome in Internet.
>
>> reverse DNS is not called accountability.
>
> Correct: it is only a part of accountability.
>
>> Have u ever blacklisted a real
>> spammer?
>
> http://dsbl.org/faq-listed#accuse. DSBL does not try to detect and list
> real spammers, in difference from Spamhaus. Instead, DSBL tries to
> detect and flag Internet hosts used by spammers. More than 70% of modern
> spam is spreaded through hijacked machines like yours one.
>
>> they can easily prevent u from doing so
>
> Spammers have established DoS attacks against DSBL system, with no big
> success.
>
>> (the spam me and u > receive is evidence for it).
>
> Sorry? I don't understand your last idea.
>
> Best,
> Alexey
>
>
>
>>
>> ----- Original Message ----- From: "Alexey Lobanov (dsbl)"
>> <[email protected]>
>> To: "Chris Z." <[email protected]>
>> Cc: <[email protected]>
>> Sent: Friday, September 23, 2005 08:46
>> Subject: Re: [DSBL-Contact] Re: Website link for 217.15.102.67
>>
>>
>>> Hello.
>>>
>>> On 23/09/05 09:45, Chris Z. wrote:
>>>
>>>> I cannot fix the DNS entry, its not on my server or any server under my
>>>> control and it will likely take days. Now be a man and remove the entry
>>>> from your system, since your removal system does not allow me to do it.
>>>
>>>
>>> Yes, because your system fails accountability test. You
>>> (non-intentionally) publish false data in DNS, and this problem must be
>>> fixed at your side.
>>>
>>>>
>>>> broken DNS entries has nothing to do with spamming.
>>>
>>>
>>> Broken DNS entries effectively prevent proper reporting of abuse evens
>>> to host owners. It is exactly what "removalquery" checks, and it is
>>> called "Accountability".
>>>
>>>> But neither people
>>>> who get infected by viruses (courtesy of MS Corp) should be 
>>>> blacklisted.
>>>
>>>
>>> People are not blacklisted anyway; I hope, you are not a cyborg with
>>> implanted network interface? In opposite, insecure and hijacked
>>> computers (which are controlled by villains instead of legitimate
>>> owners) - may and should be blacklisted (I believe).
>>>
>>>> Condeming the victims, when u cannot condem the criminals...nice...
>>>
>>>
>>> Blacklisting is not a punishment. It is a safety precaution, nothing
>>> more: the Internet community wants to know and insulate insecure data
>>> sources. At least, until they become secure.
>>>
>>> Best,
>>> Alexey
>>> DSBL volunteer
>>>
>>>>
>>>> ----- Original Message ----- From: "Dick Wesseling" <[email protected]>
>>>> To: "chris z." <[email protected]>
>>>> Cc: <[email protected]>
>>>> Sent: Friday, September 23, 2005 03:07
>>>> Subject: Re: Website link for 217.15.102.67
>>>>
>>>>
>>>>>
>>>>> "chris z." <[email protected]> wrote:
>>>>>
>>>>>> Someone has blacklisted the above IP - 217.15.102.67
>>>>>
>>>>>
>>>>>
>>>>> If you look at the evidence at http://dsbl.org/listing?217.15.102.67
>>>>> you will see SOCKS and HTTP proxies at unusual port addresses. A sure
>>>>> sign of virus infection. Your computer is now owned by somebody else.
>>>>> Has this been fixed? If not, removing yourself would be premature.
>>>>>
>>>>>> Can you please remove it from your system as it causes huge amount
>>>>>> trouble due to the fact that is cannot be removed from your system as
>>>>>> the IP is incorrectly resolved to abakus.com.mt.
>>>>>
>>>>>
>>>>>
>>>>> The point of the DSBL removal procedure is to verify that there is an
>>>>> abuse/postmaster for the IP that can be contacted if there is a
>>>>> problem.
>>>>> Chances are that if you would have had correct reverse DNS, you would
>>>>> have been notified of the problem before ending up in DSBL and other
>>>>> blocklists.
>>>>>
>>>>>
>>>>>> this is getting radiculous
>>>>>
>>>>>
>>>>>
>>>>> [email protected] receives an enormous amount of spam. The trouble is 
>>>>> that
>>>>> DSBL cannot use its own list to filter incoming mail. For similar
>>>>> reasons DSBL cannot use other blocklists. The only solution
>>>>> remaining is
>>>>> a rigid sanity check on messages sent to this list, sorry about that.
>>>>>
>>>>> The recommended course of action is:
>>>>>
>>>>> - remove your trojan
>>>>> - fix your broken reverse DNS
>>>>>
>>>>> Once this is done you can request removal.
>>>>>
>>>>
>>>
>>
>
>