Re: Re: Website link for 217.15.102.67

okeys, wil try over and over again

----- Original Message ----- 
From: "Alexey Lobanov (dsbl)" <[email protected]>
To: "Chris Z." <[email protected]>
Cc: <[email protected]>
Sent: Wednesday, September 28, 2005 09:33
Subject: Re: [DSBL-Contact] Re: Website link for 217.15.102.67


> Hello.
>
> On 28/09/05 10:46, Chris Z. wrote:
>
>>
>> Hi,
>>
>> 217.15.102.67 is used at the moment by uibnetwork.com domain.
>> Its MX record point to mailhost.uibnetwork.com which resolves to that IP.
>> Why the reverse DNS entry points to another domain i have no idea
>> whatsoever. I can only guess that this IP was used by another domain
>> before (abakus.com.mt) and the entry remained since.
>
> Correct.
>
>>
>> I have contacted the ISP few times already but so far it remains as is.
>> I have no control over what IP addresses people may enter into their DNS
>> servers. If u have any suggestions how i can posibly solve that issue,
>> pls let me know.
>
> As far as I understand, you pay to the people who have control. So, you
> main tool can be the payment recipe; if your ISP does not want to help
> you, it violates the contract.
>
>>
>> But at the moment you are blocking a company mail which does not spam
>
> DSBL did never claim that your company sends any spam. Instead, DSBL
> claims that your company server is insecure and unaccountable.
> Unfortunately, this statement is still true, and your words above just
> confirm this fact. You (or your ISP, no matter) publish explicitly false
> data in DNS, pointing to other, irrelevant company.
>
>> and you refusing to remove that IP based on incorrect reverse DNS entry
>> in some other company servers which has nothing to do with us.
>
> If your ISP "has nothing to do with you", you should have no any
> Internet connectivity at all. But you definitely have.
>
>> Thinking
>> of it, you should block abakus.com.mt instead since they have the
>> incorrect DNS entry if you want to be fair.
>>
>> By now, however, i have bypassed your blocking and they can email
>> freely.
>
> Good.
>
>> Stil i would like to see their IP removed from the spammers
>> blacklist.
>
> I repeat: DSBL is not a list of spammers. It is a list of insecure and
> misconfigured servers.
>
>> Well, what do u suggest we do next?
>
> Still same: talk with your ISP and enforce it to fix the outdated
> information in DNS. They must do it for you.
>
> best,
> Alexey
>
>
>>
>> regards
>> Chris
>>
>> ----- Original Message ----- From: "Alexey Lobanov (dsbl)"
>> <[email protected]>
>> To: "Chris Z." <[email protected]>
>> Cc: <[email protected]>
>> Sent: Friday, September 23, 2005 18:18
>> Subject: Re: [DSBL-Contact] Re: Website link for 217.15.102.67
>>
>>
>>> Hello.
>>>
>>> First, few explanations. DSBL is neither a form nor a state
>>> institutions; mailserver admins use DSBL database absolutely
>>> voluntarily, because they trust DSBL data and accept DSBL policy. If
>>> they don't, they will simply delete any mentions about "list.dsbl.org"
>>> from mailserver confugurations, and your mail will go smoothly.
>>>
>>> So, all your writings are purposed mostly for those server admins: if
>>> you convince them that the current DSBL policy is wrong, DSBL will not
>>> be used.
>>>
>>> On 23/09/05 12:27, Chris Z. wrote:
>>>
>>>> hi again,
>>>>
>>>> we dont publish any data, server is owned by a non-computer related
>>>> company whcih has nothing to do with publising DNS enties and does not
>>>> have DNS servers. Someone else had published some DNS entries which are
>>>> incorrect and i cannot resolve that issue since its a DNS server issue
>>>> at some ISP and out of my control.
>>>>
>>>> You can test the IP for spaming and if it does, well, keep it in ur
>>>> list, but if it doesnt, pls remove it because it shouldnt be there 
>>>> since
>>>> it does not spam.
>>>> Some DNS server incorrect reverse DNS enrty is not a reason to keep 
>>>> some
>>>> IP in the blacklist of spammers.
>>>
>>>
>>> 1. Please look at http://postmaster.aol.com/guidelines/standards.html
>>> item 4. AOL is not the only mail system implementing this policy.
>>>
>>> 2. Incorrect DNS is a part of 217.15.102.67 misbehavior. This system was
>>> compromised in past AND is still anonymous. DSBL believes that
>>> this combination is absolutely enough for to label this server as an
>>> insecure.
>>>
>>>> Plus, u know well it isnt a spammer system, it was attacked by a virus
>>>> (as u suggested in previous mail) which uses windows buffer overflow to
>>>> gain access to the system.
>>>> You also know that its not sending any spam, so why insist in keeping 
>>>> it
>>>> in the list??
>>>
>>>
>>> No, we don't know it and cannot know it. Only you, the server
>>> owner|admin, know it.
>>>
>>>> You feed good about it? and 24-25 hrs removal? that sounds
>>>> reasonable to you?
>>>>
>>>> thanks
>>>>
>>>> PS if i enable reverse DNS checks on the mail server it will refuse a
>>>> great many numbers of legitimate emails which dont reverse DNS properly
>>>> and u know that.
>>>
>>>
>>> See AOL policy again. Many corporate systems implement same policy:
>>> anonymous sources of e-mail are less and less welcome in Internet.
>>>
>>>> reverse DNS is not called accountability.
>>>
>>>
>>> Correct: it is only a part of accountability.
>>>
>>>> Have u ever blacklisted a real
>>>> spammer?
>>>
>>>
>>> http://dsbl.org/faq-listed#accuse. DSBL does not try to detect and list
>>> real spammers, in difference from Spamhaus. Instead, DSBL tries to
>>> detect and flag Internet hosts used by spammers. More than 70% of modern
>>> spam is spreaded through hijacked machines like yours one.
>>>
>>>> they can easily prevent u from doing so
>>>
>>>
>>> Spammers have established DoS attacks against DSBL system, with no big
>>> success.
>>>
>>>> (the spam me and u > receive is evidence for it).
>>>
>>>
>>> Sorry? I don't understand your last idea.
>>>
>>> Best,
>>> Alexey
>>>
>>>
>>>
>>>>
>>>> ----- Original Message ----- From: "Alexey Lobanov (dsbl)"
>>>> <[email protected]>
>>>> To: "Chris Z." <[email protected]>
>>>> Cc: <[email protected]>
>>>> Sent: Friday, September 23, 2005 08:46
>>>> Subject: Re: [DSBL-Contact] Re: Website link for 217.15.102.67
>>>>
>>>>
>>>>> Hello.
>>>>>
>>>>> On 23/09/05 09:45, Chris Z. wrote:
>>>>>
>>>>>> I cannot fix the DNS entry, its not on my server or any server
>>>>>> under my
>>>>>> control and it will likely take days. Now be a man and remove the
>>>>>> entry
>>>>>> from your system, since your removal system does not allow me to do
>>>>>> it.
>>>>>
>>>>>
>>>>>
>>>>> Yes, because your system fails accountability test. You
>>>>> (non-intentionally) publish false data in DNS, and this problem must 
>>>>> be
>>>>> fixed at your side.
>>>>>
>>>>>>
>>>>>> broken DNS entries has nothing to do with spamming.
>>>>>
>>>>>
>>>>>
>>>>> Broken DNS entries effectively prevent proper reporting of abuse evens
>>>>> to host owners. It is exactly what "removalquery" checks, and it is
>>>>> called "Accountability".
>>>>>
>>>>>> But neither people
>>>>>> who get infected by viruses (courtesy of MS Corp) should be
>>>>>> blacklisted.
>>>>>
>>>>>
>>>>>
>>>>> People are not blacklisted anyway; I hope, you are not a cyborg with
>>>>> implanted network interface? In opposite, insecure and hijacked
>>>>> computers (which are controlled by villains instead of legitimate
>>>>> owners) - may and should be blacklisted (I believe).
>>>>>
>>>>>> Condeming the victims, when u cannot condem the criminals...nice...
>>>>>
>>>>>
>>>>>
>>>>> Blacklisting is not a punishment. It is a safety precaution, nothing
>>>>> more: the Internet community wants to know and insulate insecure data
>>>>> sources. At least, until they become secure.
>>>>>
>>>>> Best,
>>>>> Alexey
>>>>> DSBL volunteer
>>>>>
>>>>>>
>>>>>> ----- Original Message ----- From: "Dick Wesseling" <[email protected]>
>>>>>> To: "chris z." <[email protected]>
>>>>>> Cc: <[email protected]>
>>>>>> Sent: Friday, September 23, 2005 03:07
>>>>>> Subject: Re: Website link for 217.15.102.67
>>>>>>
>>>>>>
>>>>>>>
>>>>>>> "chris z." <[email protected]> wrote:
>>>>>>>
>>>>>>>> Someone has blacklisted the above IP - 217.15.102.67
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> If you look at the evidence at http://dsbl.org/listing?217.15.102.67
>>>>>>> you will see SOCKS and HTTP proxies at unusual port addresses. A 
>>>>>>> sure
>>>>>>> sign of virus infection. Your computer is now owned by somebody 
>>>>>>> else.
>>>>>>> Has this been fixed? If not, removing yourself would be premature.
>>>>>>>
>>>>>>>> Can you please remove it from your system as it causes huge amount
>>>>>>>> trouble due to the fact that is cannot be removed from your
>>>>>>>> system as
>>>>>>>> the IP is incorrectly resolved to abakus.com.mt.
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> The point of the DSBL removal procedure is to verify that there is 
>>>>>>> an
>>>>>>> abuse/postmaster for the IP that can be contacted if there is a
>>>>>>> problem.
>>>>>>> Chances are that if you would have had correct reverse DNS, you 
>>>>>>> would
>>>>>>> have been notified of the problem before ending up in DSBL and other
>>>>>>> blocklists.
>>>>>>>
>>>>>>>
>>>>>>>> this is getting radiculous
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> [email protected] receives an enormous amount of spam. The trouble is
>>>>>>> that
>>>>>>> DSBL cannot use its own list to filter incoming mail. For similar
>>>>>>> reasons DSBL cannot use other blocklists. The only solution
>>>>>>> remaining is
>>>>>>> a rigid sanity check on messages sent to this list, sorry about 
>>>>>>> that.
>>>>>>>
>>>>>>> The recommended course of action is:
>>>>>>>
>>>>>>> - remove your trojan
>>>>>>> - fix your broken reverse DNS
>>>>>>>
>>>>>>> Once this is done you can request removal.
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>>
>>
>