Spammy servers and NOC servers

[hobbes747]

I used Jaguar a while back, left and have now returned. I'm crazy about this host, it's been nothing but good to me. Great service, quick and friendly staff. I recommend it all of the time. Since I've been back, I've gotten two personal sites and have signed up two clients so far with more to come, and I'm looking at going Dedicated with one site, maybe more.

But a few things, about two months ago, Spamcop declared one of my personal site's server as a spam server. I went through the process of correcting it, but now all of the email I get back from one of my clients is marked "{Spam?}" in the subject line.

Now just about a week ago, the other personal site's server was declared a spam server by Outblaze.

Those sites are on two completely different servers. I had heard of this happening right before I left Jaguar, but it hadn't happened to me.

Isn't there a way to monitor the system better or lock down access to the CGI mailer? Is it bad clients signing up or people feeding into the CGI/other people's scripts? Will this keep happening? It would be embarassing if it happened to a client.

Also, why do the NOC servers go out occasionally and frequently? Sometimes it's for 5 minutes and others for a few hours. I can get to the site by IP, but the domain name doesn't work. The sites are all on different registrars, btw.

Thanks.

[Galen]

Sounds like spammers spoofing your address. They do that to me too. Not much you can really do about it, I'm afraid.

If you can still reach your site by IP but not by domain name, then that's a DNS problem that you'll have to talk to your registrar about.

[hobbes747]

Okay, but it's the whole server that gets tagged, not just my email address. And it's two completely separate email accounts on two different Jaguar servers.

And, they are all on different registrars. Various visitors are telling me that its the NOC going out, with their pings and traceroutes in tow.

[Connie]

This is just a guess. The whole sever is getting tagged because you are sending
e-mail through port 425. You are doing that because your ISP has blocked port
25.

Is that close?

[hobbes747]

I wish it were that easy. On Port 25, both PCs in the house. Thanks tho.

[jason]

I think that one of the biger reasons that servers get listed on blacklists is because of new clients on them more than people hijacking scripts like Formmail and the like. Older servers, which aren't having new accounts added to them regularly haven't been much of a problem. Since JPC offers instant setups it is possible for a spammer to get in, and spam the heck out of the server. When they get caught JPC promptly shuts them down, but sometimes that's too late and the blacklists have already picked up on it. (In the spammers' minds, they see the instant setup and the 30 day guarantee as an easy in and out whithout having to pay a dime.)

As for the spam subject you report, are you refering to replies that you are receiving from your recipient or arre you talking about bounced messages? It sounds like your recipient's ISP has an ultra-sensitive spam filter or something about your message looks like it could be spam. If the spam filter is like SpamAssassin the headers of the message may include an explanation of why it is being marked as spam. If it is a reply you'll probably have to ask the recipient to send you the full headers of the original message so you can see this. If it is a bounce then that info might be in the headers of the bounce message.

Hope this helps.

--Jason

[hobbes747]

Good point, hadn't thought about the 30 day/Instant setup combo.

Originally, the emails bounced. I went to Jaguar and they took care of it with Spamcop. But now when they reply to me, the emails say 'Re: Stuff you wrote about {Spam?}' as that's how it obviously went to them. They are located on a smaller ISP.

The last one that happened was a bounce from Tokyo.com.

Here is one of the first:

foo@foo.com
SMTP error from remote mailer after RCPT TO:<foo@foo.com>:
remote foo:
554 Service unavailable; Client host [69.73.173.39] blocked using bl.spamcop.net; Blocked - see http://www.spamcop.net/bl.shtml?69.73.173.39
foo@foo.com
SMTP error from remote mailer after RCPT TO:<foo@foo.com>:
remote foo:
554 Service unavailable; Client host [69.73.173.39] blocked using bl.spamcop.net; Blocked - see http://www.spamcop.net/bl.shtml?69.73.173.39

------ This is a copy of the message, including all the headers. ------

Return-path: <me@foo.com>
Received: from local foo
by freedom.nocdirect.com with asmtp (Exim 4.34)
id 1BcMz0-0003Yd-7b; Mon, 21 Jun 2004 06:29:02 -0500
Me<me@foo.com>
To: <foo@foo.com>,
Them<foo@foo.com>
Subject: RE: FTP access
Date: Mon, 21 Jun 2004 06:28:54 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0004_01C45759.06D673C0"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
Thread-Index: AcRXgu84noIhNQPHR7uAuHiKFWV9FA==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165

This is a multi-part message in MIME format.

------=_NextPart_000_0004_01C45759.06D673C0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit