Menu
Reply
  • 6
  • 0
  • 0
PaulRob
Tuning in
226 Views
Message 1 of 6
Flag for a moderator

IP listed as a spammer?

I have been trying to email a friend in South Africa and I get back a rejection message from some duchebag service called uceprotect.net who want to charge me for removing my IP from a blocking list.

This is ridiculous!!  They are claiming that I am using an IP of 80.0.253.65 which I have never used.

Any one know what this is all about and how it can be stopped? 

0 Kudos
Reply
  • 13.66K
  • 720
  • 4.73K
Superuser
Superuser
197 Views
Message 2 of 6
Flag for a moderator

Re: IP listed as a spammer?

I wrote a post about block lists here.  If you need more information take a look. - http://community.virginmedia.com/t5/Email/Ravenstar-s-Email-FAQ-s/m-p/2420093/highlight/true#M129651

But let's straighten some things out.

I wouldn't describe UCEProtect as a douchebag service.  They tend to take exception to people using that tone.

Their wording could definitely be better on their web pages but I presume it's because they expect mail administrators to be reading them rather than the average user.

  • If you read the link above you should now realise that 80.0.253.65 isn't your IP it's Virgin Media's mail server - (Actually it's one of 32 mail servers)
  • You don't have to pay to have UCEProtect L1 entries removed.  In fact these entries automatically expire after 7 days.  UCEProtect do charge for express delistings if people want the entries removed sooner than this.
  • You can't delist that IP anyway it has to be Virgin Media that does this.
  • Having just checked the UCEProtect Database myself it appears that the IP has already been delisted so unless your mail ends up going out through a different server, your mail should now get through.

UCEPROTECT-Level1

(Single IP)

IP Status Listingrisk Optional express delisting
WARNING!
PROBLEM MUST BE FIXED FIRST
TO PREVENT NEW LISTINGS

80.0.253.65NOT LISTEDLOWNot available

 


UCEPROTECT-Level2

Networks this IP belongs to

Networks Status Level 1 listed spammers
within the last 7 days Level 2 Escalation limit
by Level 1 records Optional express delisting
WARNING!
PROBLEM MUST BE FIXED FIRST
TO PREVENT NEW LISTINGS

80.0.0.0/13NOT LISTED
16
1165
Not available
80.0.0.0/15NOT LISTED
7
445
Not available
80.0.0.0/16NOT LISTED
4
275
Not available

 

Ravenstar68 

________________________________________


Only use Helpful answer if your problems been solved.

  • 6
  • 0
  • 0
PaulRob
Tuning in
166 Views
Message 3 of 6
Flag for a moderator

Re: IP listed as a spammer?

As you said "Their wording could definitely be better on their web pages".  In these days now where ransom ware is becoming prevalent yes their wording could be a lot better indeed!  I am sick of having my mail disrupted though by these services.  I also use an email address with domain @centurytel.net and that currently is being blocked by some other service called ecelerity for 'spam like characteristics when I am trying to get to @btinternet.com friends.  I never have, and never will, send spam and this is all incredibly annoying and frustrating when you are trying to accomplish stuff, especially when BT Internet services refuse to be of any assistance whatever.

Thank you for your prompt reply though - I wish @btinternet.com was half as responsive!

Paul

0 Kudos
Reply
  • 6
  • 0
  • 0
PaulRob
Tuning in
165 Views
Message 4 of 6
Flag for a moderator

Re: IP listed as a spammer?

So since you said I have nothing to worry about I resent the email that had been previously rejected together with the PDF attachment that I want my friend in South Africa to read (his domain is mweb.co.za and I got this back by return almost immediately!

This is the mail system at host know-smtprelay-1-imp.

I am sorry to have to inform you that your message, "Where should I put this on the website?", could not be delivered to xxx@mweb.co.za.

The remote mail system said;

 550:rejected because 80.0.253.65 is in a black list at dnsbl-1.uceprotect.net

 The original message is attached.

(I have removed his email name as this is a public forum and replaced it with xxx)

So what, pray, is now the problem?

Paul

0 Kudos
Reply
  • 13.66K
  • 720
  • 4.73K
Superuser
Superuser
150 Views
Message 5 of 6
Flag for a moderator

Re: IP listed as a spammer?

At a guess the recipients domain is using an outdated version of the UCEProtect L1 Database

I'll explain. There are several ways a mail server can query a blacklist.

Directly via DNS by reversing the order of octets of the IP address and adding the databases host name to the end, then checking for an A record

Here's what happens when I do just this.

C:\Users\timdu>dig 65.253.0.80.dnsbl-1.uceprotect.net @8.8.8.8

; <<>> DiG 9.10.4-P2 <<>> 65.253.0.80.dnsbl-1.uceprotect.net @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10240
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;65.253.0.80.dnsbl-1.uceprotect.net. IN A

;; AUTHORITY SECTION:
dnsbl-1.uceprotect.net. 1799    IN      SOA     dnsbl-mirrors.uceprotect.net. sonderlocke.fast9.uceprotect.net. 2016111818 3600 3600 86400 3000

;; Query time: 52 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Nov 18 17:34:24 GMT Standard Time 2016
;; MSG SIZE  rcvd: 131


C:\Users\timdu>

The server returns NXDOMAIN - which means the IP address is not in the database.  This echoes the check I did here - http://www.uceprotect.net/en/rblcheck.php

However while this might be OK for a small mailserver that doesn't get many mails.  It becomes inefficient as the volume of mails increase.  For this reason many mail providers will download a copy of the database regularly and use that copy to check the IP's against.

Depending on how often they synchronise their lists, they may be using an outdated one.  Certainly I know the IP address has been on UCEPROTECT L1 in the past.  But it definitely isn't showing at the moment.

Ravenstar68

 

________________________________________


Only use Helpful answer if your problems been solved.

  • 6
  • 0
  • 0
PaulRob
Tuning in
136 Views
Message 6 of 6
Flag for a moderator

Re: IP listed as a spammer?

Well I can really see why you are a Superuser on this forum Ravenstar68!!  It is all pixy dust and Greek to me but I get the gist of what you are saying and will suggest to my recipient that he asks his ISP to refresh their downloaded copy and hope they can do that as I am still getting blocking messages!

Now I wish you could go and sort out BTInternet.com too LOL!

Thanks

Paul

0 Kudos
Reply