Re: Trying to find out cause of blacklisting

In article <[email protected]>,
 "Mike Easter" <[email protected]> wrote:

> James wrote:
> 
> > I've been running mail servers (qmail) for about a decade, and I found
> > out yesterday that one of them had been blacklisted by SpamCop.
> 
> You could have found out a lot more information here or even all by
> yourself by naming the IP here then, which you didn't do, or by
> following the links yourself which are provided for a listed IP, which
> are no longer provided to the public for an unlisted IP.
> 
> The other advantage of naming the IP here would be the possibility that
> some of us here might be able to 'guess' at the problem for some
> particular server.  Another advantage would be that given an IP, we can
> say how any spamcop report about that IP would be addressed.
> 
> It is also possible that if the listing were caused by hitting spamtraps
> alone that no address would have been provided any reports about the
> spamsourcing.
> 
> > nobody
> > from SpamCop has replied to my request for details of exactly why it
> > was blacklisted.
> 
> If it were listed for hitting spamtraps, the evidence is not provided.
> Also, if the form of your request were to 'dispute' the listing, that
> won't get you anywhere.  The deputy would look at the parse for the
> spamtrap hits and find the spamsource to have been accurately derived,
> and the dispute would be ignored.
> 
> An admin can make request to be notified about spamcop reports, but the
> admin won't get links to the evidence for spamtrap hits.
> 
> Servers are most often listed because of some kind of backscatter or
> autoresponder behavior -- in which the server receives a spam and
> accepts the spam for delivery and then can't deliver the spam to the
> mailbox, and so then the server which has foolishly accepted a spam it
> can't deliver decides to create a newmail addressed to the spam's bogus
> From which might be a reporter or a spamtrap..
> 
> That newmail hits a spamtrap and that abusive backscatter is spamcop
> reportable and contributes to the server becoming spamcop blocklisted.
> 
> > If I could get a copy of the offending message, with full headers, it
> > would be possible to find out how/why this happened, as I don't want
> > it to happen again.
> 
> If it hit a spamtrap, that's not going to happen.  If it hit a reporter,
> every SC report is reported to what is presumed to be the appropriate
> admin to be notified.  If you aren't the one, then someone else got the
> report with a link to the evidence.
> 
> > I have had no other reports of Spam from that server, so it makes it
> > all the more perplexing.  If somebody could point me to somebody who
> > could help me on this, I'd appreciate it.
> 
> How did you try to contact a SC person and what is the IP of the
> previously listed server?


Thanks for your reply.  The reason given was indeed a spamtrap, but I'm 
just trying to figure out what the problem is.  In the past, the only 
time this server has had this issue is when customer CGIs were abused, 
so if this was the case, I wanted to track it down and deal with it (I 
have long since removed known problem CGIs, but customers have their own 
CGIs on this particular server).

I tried to contact a person via the dispute page, which had a place for 
comments and my contact info.  The offending IP was 208.8.16.10

It could be due to a misdirected bounce, but this is the first I've 
heard of anyone listing on a major BL due to that.  We do NOT bounce 
email that is flagged by Spamassassin or ClamAV, but misdirected 
unflagged email is bounced and customers do have autoresponders.  It 
would be good to know which, if any of those is the cause.