[Dshield] mail1.giac.net spamcop listed

Johannes B. Ullrich jullrich at sans.org
Wed Dec 10 14:30:20 GMT 2003


the IP address of the mail server is
65.173.218.103, and it is still listed.
http://www.spamcop.net/w3m?action=checkblock&ip=65.173.218.103

.101 is the dshield website.



On Wed, 2003-12-10 at 08:56, Rick Klinge wrote:
> I don't see it listed.. am I missing something?
> 
> http://www.dnsstuff.com/tools/ip4r.ch?ip=65.173.218.101+
> 
> Even so.. I would not disable using a blacklist but rather add any must have
> email to a 'whitelist'.
> 
> ~Rick
> 
> > -----Original Message-----
> > From: list-bounces at dshield.org [mailto:list-bounces at dshield.org]On
> > Behalf Of Johannes B. Ullrich
> > Sent: Wednesday, December 10, 2003 7:35 AM
> > To: General DShield Discussion List
> > Subject: Re: [Dshield] mail1.giac.net spamcop listed
> >
> >
> >
> > So far, all attempts to get our server unlisted have been without
> > success. For now, if you are using dshield, make sure you are
> > not using the 'bl.spamcop.net' blocklist.
> >
> > Spamcop states that the list is not for production use and considered
> > experimental.
> >
> > As people on the list probably know, the sample header they show is from
> > one of our submission confirmations, which we only send to submitters
> > and which can be disabled in your profile.
> >
> >
> > On Wed, 2003-12-10 at 07:27, Hanke Penning wrote:
> > > Hi out there!
> > >
> > > mail1.giac.net is listed in spamcop.
> > >
> > > 65.173.218.103 listed in bl.spamcop.net (127.0.0.2)
> > >
> > > Since SpamCop started counting, this system has been reported less than
> > > 10 times by less than 10 users. It has been sending mail
> > consistently for
> > > at least 43.5 days. In the past 150.5 days, it has been listed 4 times
> > > for a total of 3.1 days
> > >
> > >     * In the past week, this system has: Been reported as a source of
> > > spam less than 10 times
> > >     * Been witnessed sending mail about 30 times
> > >
> > > A sample sent sometime during the 24 hours beginning Thursday, December
> > > 04, 2003 01:00:00 +0100:
> > > Received: from -.-.net (- -.org) (65.173.218.103)
> > >   by - with - - Dec 2003 - -
> > > Subject: - submission confirmation
> > > From: ad.. at ..d.org
> > >
> > >
> > >
> > > If you are using bl.spamcop.net as a spamfilter no mails will be
> > > received.
> > >
> > > Yours sincerly
> > >
> > > Hanke Penning
> > >
> 
> ___________________________________________________________________
> Virus Scanned and Filtered by http://www.FamHost.com E-Mail System.
> 
> _______________________________________________
> list mailing list
> list at dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
-- 
CTO SANS Internet Storm Center               http://isc.sans.org
phone: (617) 786 1563            
  fax: (617) 786 1550                          jullrich at sans.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://www.dshield.org/pipermail/list/attachments/20031210/f653b429/attachment.bin


More information about the list mailing list