You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marc Perkel <su...@junkemailfilter.com> on 2010/10/07 14:27:39 UTC
How do I get delisted from SORBS? [OT]
Got this listing on sorbs:
SORBS DNSBL <http://www.de.sorbs.net/> 127.0.0.2 "Aggregate zone
See: http://www.sorbs.net/lookup.shtml?65.49.42.106"
http://www.de.sorbs.net/overview.shtml
Went to their web site and can't find a way to remove it. Their web site
is barely responsive and there doesn't seem to be a removal tool. Anyone
else having this problem or can give me some insight as to what is going
on?
--
Marc Perkel - Sales/Support
support@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
Re: How do I get delisted from SORBS? [OT]
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Marc Perkel,
Am 2010-10-07 05:27:39, hacktest Du folgendes herunter:
> Got this listing on sorbs:
>
> SORBS DNSBL <http://www.de.sorbs.net/> 127.0.0.2 "Aggregate
> zone See: http://www.sorbs.net/lookup.shtml?65.49.42.106"
> http://www.de.sorbs.net/overview.shtml
>
>
> Went to their web site and can't find a way to remove it. Their web
> site is barely responsive and there doesn't seem to be a removal
> tool. Anyone else having this problem or can give me some insight as
> to what is going on?
Send a drone with a nuclear warhead to there DataCenter! :-D
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +33-9-52705884 fix
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: How do I get delisted from SORBS? [OT]
Posted by mouss <mo...@ml.netoyen.net>.
Le 07/10/2010 17:24, Marc Perkel a écrit :
>
>
> On 10/7/2010 7:56 AM, Matus UHLAR - fantomas wrote:
>>> * Marc Perkel<su...@junkemailfilter.com>:
>>>> Got this listing on sorbs:
>> On 07.10.10 16:33, Ralf Hildebrandt wrote:
>>> No idea. We also got listed and can't even find out why. It says "last
>>> occurence somedate.in.2006" - WTF?
>> our ranges that have been removed from DUHL years ago got there again.
>> Probably old records re-appeared because of something...
>
>
> Sure is screwing me up. Got several customers whose email is bouncing
> when we are forward it as good. I'm disabling all sorbs tests on my
> end to prevent false positives.
>
sorbs have problems (apparently with their database migration).
http://isc.sans.edu/diary.html?storyid=9685
Re: How do I get delisted from SORBS? [OT]
Posted by Marc Perkel <su...@junkemailfilter.com>.
On 10/7/2010 7:56 AM, Matus UHLAR - fantomas wrote:
>> * Marc Perkel<su...@junkemailfilter.com>:
>>> Got this listing on sorbs:
> On 07.10.10 16:33, Ralf Hildebrandt wrote:
>> No idea. We also got listed and can't even find out why. It says "last
>> occurence somedate.in.2006" - WTF?
> our ranges that have been removed from DUHL years ago got there again.
> Probably old records re-appeared because of something...
Sure is screwing me up. Got several customers whose email is bouncing
when we are forward it as good. I'm disabling all sorbs tests on my end
to prevent false positives.
--
Marc Perkel - Sales/Support
support@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
Re: How do I get delisted from SORBS? [OT]
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> * Marc Perkel <su...@junkemailfilter.com>:
> > Got this listing on sorbs:
On 07.10.10 16:33, Ralf Hildebrandt wrote:
> No idea. We also got listed and can't even find out why. It says "last
> occurence somedate.in.2006" - WTF?
our ranges that have been removed from DUHL years ago got there again.
Probably old records re-appeared because of something...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I wonder how much deeper the ocean would be without sponges.
Re: How do I get delisted from SORBS? [OT]
Posted by Benny Pedersen <me...@junc.org>.
On Fri, 22 Apr 2011 18:19:09 -0700 (PDT), maddog2020
<la...@live.com> wrote:
> Corpus here doesn't seem to understand that your can get blacklisted if
you
> email host puts you on a shared server with a spammer. Therefore, by no
> fault of your own, you are effectively blacklisted. Furthermore, it is
more
> than likely that the spammer on my shared server does not have an email
> address or even know about a domain i'm trying to send email to. So
because
> this spammer-1 sends a message that SORBS consider's spam to XYZ.com,
> ABC.com blocks my email along with anyone else that is hosted on my
server
> eventhough no one at any of the domains hosted on my server intends to
spam
> ABC.com all because they use SORBS and are too lazy to create their own
> blacklist. What kind of sense does that make?
dont know, but i agre ip blacklist will be last resort if
postmaster@sender_domain.example.org does not solve it, to many hosts
somply host 700 domains on one ip webserver and dont care of ip blacklists
or even scan outgoing emails from that WEBSERVER ip
suggested is to have diff ip for MAILSERVER and WEBSERVER or atleast scan
outgoing mails
> As for SORBS, the easy way to get delisted and quit whining about how
> long it takes, is to *not* get listed in the first place. It's really a
> case of actions have consequences. Not careful in your output, don't
> expect any sympathy.
atleast sorbs have still not listed my own ip as dynamic as spamhaus had
for around 2 weeks ago, but it was simple me that used my postmaster @ junc
dot org and acted on a respondse email to spamhaus and it was delisted in
less then one hour
use dnswl.org to help you out with pr domain whitelisting, and then hope
sorbs use dnswl
my ripe range is listed as mix of mobile dynamic and static ips and on top
of that its less then 12 months old range, still keep problems of dns not
working since its not unlisted in border routers and dns servers where the
range is acl blackholed
eg rfc-ignorant.org was not possible to use for my spammassassin, that is
resolved now
Re: How do I get delisted from SORBS? [OT]
Posted by maddog2020 <la...@live.com>.
Corpus here doesn't seem to understand that your can get blacklisted if you
email host puts you on a shared server with a spammer. Therefore, by no
fault of your own, you are effectively blacklisted. Furthermore, it is more
than likely that the spammer on my shared server does not have an email
address or even know about a domain i'm trying to send email to. So because
this spammer-1 sends a message that SORBS consider's spam to XYZ.com,
ABC.com blocks my email along with anyone else that is hosted on my server
eventhough no one at any of the domains hosted on my server intends to spam
ABC.com all because they use SORBS and are too lazy to create their own
blacklist. What kind of sense does that make?
As for SORBS, the easy way to get delisted and quit whining about how
long it takes, is to *not* get listed in the first place. It's really a
case of actions have consequences. Not careful in your output, don't
expect any sympathy.
--
View this message in context: http://old.nabble.com/How-do-I-get-delisted-from-SORBS---OT--tp29905820p31459742.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: How do I get delisted from SORBS? [OT]
Posted by "corpus.defero" <co...@idnet.com>.
On Fri, 2010-10-08 at 08:19 -1000, Alexandre Chapellon wrote:
> > This is not correct. Barracuda offer a 24 hour phone service when you
> > can speak to a real person should you have an issue. Getting delisted is
> > simple but ongoing offenders can simply forget it.
> Cool! Calling some indian call center to get an idea of why one single
> IP is listed.... What a great tool!
Err, it's *not* an Indian call centre. They have a support office in
India, but the majority of calls are handled in the USA and UK - and
they operate around the clock 'following the sun'. The only time India
would handle a call is if (a) something went very wrong (b) you were
located in India seeking service in India.
Barracuda are *very* good at reputation lists - one of the best for all
their other failings. They can easily tell you the extent of your
spamming and support it with evidence. If you've got listed at Barracuda
*YOU HAVE SENT SPAM* so quit bleating.
>
> Barracuda was listing more than 8000 of my IPs. Thoose IP was listed
> years ago and never unlisted. Port 25 was blocked for months for this
> subnets and Barracuda explicitly refused to do bulk removal ...
> because it was too much wrok for them... We had to hire someone to
> manually delist filling their form (with captcha). Now manual
> delisting is over for weeks and *none* of the delisted IPs has been
> listed again...
> Yes am a bit angry against barracuda issue handling :).
Don't spam then. Simple. I think you've mistaken me for someone that
gives a damn.
Re: How do I get delisted from SORBS? [OT]
Posted by Alexandre Chapellon <al...@mana.pf>.
Le vendredi 08 octobre 2010 à 18:55 +0100, corpus.defero a écrit :
> On Thu, 2010-10-07 at 08:56 -1000, Alexandre Chapellon wrote:
> on getting delisted at SORBS.
> > At least they give a time window :) Try to know why you're listed at
> > barracuda: This is true pain!
> This is not correct. Barracuda offer a 24 hour phone service when you
> can speak to a real person should you have an issue. Getting delisted is
> simple but ongoing offenders can simply forget it.
Cool! Calling some indian call center to get an idea of why one single
IP is listed.... What a great tool!
> > Indeed no IP should be blacklisted undefinitely... at least without
> > checking regularily.
> I don't agree. An IP that hops on and off lists should stay ON until the
> blocklist operator is satisfied that no further abuse will come from it.
"until the blocklist operator is satisfied"... That's exactly what I
said.
Barracuda was listing more than 8000 of my IPs. Thoose IP was listed
years ago and never unlisted. Port 25 was blocked for months for this
subnets and Barracuda explicitly refused to do bulk removal ... because
it was too much wrok for them... We had to hire someone to manually
delist filling their form (with captcha). Now manual delisting is over
for weeks and *none* of the delisted IPs has been listed again...
Yes am a bit angry against barracuda issue handling :).
> Hoping on and off as spammers/esp's run around a ring of IP's for a few
> weeks defeats the point somewhat.
>
> As for SORBS, the easy way to get delisted and quit whining about how
> long it takes, is to *not* get listed in the first place. It's really a
> case of actions have consequences. Not careful in your output, don't
> expect any sympathy.
>
>
>
--
Follow us on: twitter https://www.twitter.com/manainternet
Re: How do I get delisted from SORBS? [OT]
Posted by Per Jessen <pe...@computer.org>.
corpus.defero wrote:
> This is all OT for a Spamassassin. If you want to bitch about
> blocklists why not do it on SPAM-L or at NANAE?
I'm not bitching about anything.
/Per Jessen, Zürich
Re: How do I get delisted from SORBS? [OT]
Posted by "corpus.defero" <co...@idnet.com>.
On Sat, 2010-10-09 at 15:58 +0200, Per Jessen wrote:
> corpus.defero wrote:
>
> > On Fri, 2010-10-08 at 20:13 +0200, Per Jessen wrote:
> >> corpus.defero wrote:
> >>
> >> > On Thu, 2010-10-07 at 08:56 -1000, Alexandre Chapellon wrote:
> >> >> Indeed no IP should be blacklisted undefinitely... at least
> >> >> without checking regularily.
> >> > I don't agree. An IP that hops on and off lists should stay ON
> >> > until the blocklist operator is satisfied that no further abuse
> >> > will come from it.
> >>
> >> How does that differ from what Alexandre said?
> > It differs because I am saying they *should* remain listed forever.
>
> Actually, as far as I can tell, you said "until the blocklist operator
> is satisfied that no further abuse will come from it" which is clearly
> not "forever".
No, in my clarification I have been precise and clear and said:
"I am saying they *should* remain listed forever"
Really, I cannot be any more exact than that.
This is all OT for a Spamassassin. If you want to bitch about blocklists
why not do it on SPAM-L or at NANAE?
Re: How do I get delisted from SORBS? [OT]
Posted by Per Jessen <pe...@computer.org>.
corpus.defero wrote:
> On Fri, 2010-10-08 at 20:13 +0200, Per Jessen wrote:
>> corpus.defero wrote:
>>
>> > On Thu, 2010-10-07 at 08:56 -1000, Alexandre Chapellon wrote:
>> >> Indeed no IP should be blacklisted undefinitely... at least
>> >> without checking regularily.
>> > I don't agree. An IP that hops on and off lists should stay ON
>> > until the blocklist operator is satisfied that no further abuse
>> > will come from it.
>>
>> How does that differ from what Alexandre said?
> It differs because I am saying they *should* remain listed forever.
Actually, as far as I can tell, you said "until the blocklist operator
is satisfied that no further abuse will come from it" which is clearly
not "forever".
> Personally if I were running the show I'd seek a large deposit to
> remove an IP and any repeat would result in the loss of that deposit
> with no further chance to remove the IP until it was clearly and
> demonstrably reassigned.
I doubt if a list with such a policy would be of much interest to
anyone. Just my opinion, of course.
/Per Jessen, Zürich
Re: How do I get delisted from SORBS? [OT]
Posted by "corpus.defero" <co...@idnet.com>.
On Fri, 2010-10-08 at 20:13 +0200, Per Jessen wrote:
> corpus.defero wrote:
>
> > On Thu, 2010-10-07 at 08:56 -1000, Alexandre Chapellon wrote:
> >> Indeed no IP should be blacklisted undefinitely... at least without
> >> checking regularily.
> > I don't agree. An IP that hops on and off lists should stay ON until
> > the blocklist operator is satisfied that no further abuse will come
> > from it.
>
> How does that differ from what Alexandre said?
It differs because I am saying they *should* remain listed forever.
Personally if I were running the show I'd seek a large deposit to remove
an IP and any repeat would result in the loss of that deposit with no
further chance to remove the IP until it was clearly and demonstrably
reassigned.
Hopefully my take on it, and how it differs is now clear for you.
Warm regards
Re: How do I get delisted from SORBS? [OT]
Posted by Per Jessen <pe...@computer.org>.
corpus.defero wrote:
> On Thu, 2010-10-07 at 08:56 -1000, Alexandre Chapellon wrote:
>> Indeed no IP should be blacklisted undefinitely... at least without
>> checking regularily.
> I don't agree. An IP that hops on and off lists should stay ON until
> the blocklist operator is satisfied that no further abuse will come
> from it.
How does that differ from what Alexandre said?
> As for SORBS, the easy way to get delisted and quit whining about how
> long it takes, is to *not* get listed in the first place.
Which is clearly not to get *delisted*, but to avoid having the need to
be.
> It's really a case of actions have consequences. Not careful in your
> output, don't expect any sympathy.
Well, in this case, SORBS screwed up royally, so consequence = don't use
them?
/Per Jessen, Zürich
Re: How do I get delisted from SORBS? [OT]
Posted by "corpus.defero" <co...@idnet.com>.
On Thu, 2010-10-07 at 08:56 -1000, Alexandre Chapellon wrote:
on getting delisted at SORBS.
> At least they give a time window :) Try to know why you're listed at
> barracuda: This is true pain!
This is not correct. Barracuda offer a 24 hour phone service when you
can speak to a real person should you have an issue. Getting delisted is
simple but ongoing offenders can simply forget it.
> Indeed no IP should be blacklisted undefinitely... at least without
> checking regularily.
I don't agree. An IP that hops on and off lists should stay ON until the
blocklist operator is satisfied that no further abuse will come from it.
Hoping on and off as spammers/esp's run around a ring of IP's for a few
weeks defeats the point somewhat.
As for SORBS, the easy way to get delisted and quit whining about how
long it takes, is to *not* get listed in the first place. It's really a
case of actions have consequences. Not careful in your output, don't
expect any sympathy.
Re: How do I get delisted from SORBS? [OT]
Posted by Alexandre Chapellon <al...@mana.pf>.
Le jeudi 07 octobre 2010 à 16:33 +0200, Ralf Hildebrandt a écrit :
> * Marc Perkel <su...@junkemailfilter.com>:
> > Got this listing on sorbs:
> >
> > SORBS DNSBL <http://www.de.sorbs.net/> 127.0.0.2 "Aggregate
> > zone See: http://www.sorbs.net/lookup.shtml?65.49.42.106"
> > http://www.de.sorbs.net/overview.shtml
>
> I feel your pain.
>
> > Went to their web site and can't find a way to remove it. Their web
> > site is barely responsive and there doesn't seem to be a removal
> > tool. Anyone else having this problem or can give me some insight as
> > to what is going on?
>
> No idea. We also got listed and can't even find out why. It says "last
> occurence somedate.in.2006" - WTF?
>
At least they give a time window :) Try to know why you're listed at
barracuda: This is true pain!
Indeed no IP should be blacklisted undefinitely... at least without
checking regularily.
--
Follow us on: twitter https://www.twitter.com/manainternet
Re: How do I get delisted from SORBS? [OT]
Posted by Ralf Hildebrandt <Ra...@charite.de>.
* Marc Perkel <su...@junkemailfilter.com>:
> Got this listing on sorbs:
>
> SORBS DNSBL <http://www.de.sorbs.net/> 127.0.0.2 "Aggregate
> zone See: http://www.sorbs.net/lookup.shtml?65.49.42.106"
> http://www.de.sorbs.net/overview.shtml
I feel your pain.
> Went to their web site and can't find a way to remove it. Their web
> site is barely responsive and there doesn't seem to be a removal
> tool. Anyone else having this problem or can give me some insight as
> to what is going on?
No idea. We also got listed and can't even find out why. It says "last
occurence somedate.in.2006" - WTF?
--
Ralf Hildebrandt
Geschäftsbereich IT | Abteilung Netzwerk
Charité - Universitätsmedizin Berlin
Campus Benjamin Franklin
Hindenburgdamm 30 | D-12203 Berlin
Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
ralf.hildebrandt@charite.de | http://www.charite.de
Re: How do I get delisted from SORBS? [OT]
Posted by Marc Perkel <su...@junkemailfilter.com>.
On 10/7/2010 6:42 AM, Per Jessen wrote:
> Marc Perkel wrote:
>
>> Got this listing on sorbs:
>>
>> SORBS DNSBL<http://www.de.sorbs.net/> 127.0.0.2 "Aggregate
>> zone See: http://www.sorbs.net/lookup.shtml?65.49.42.106"
>> http://www.de.sorbs.net/overview.shtml
>>
> host 106.42.49.65.dnsbl.sorbs.net.
> 106.42.49.65.dnsbl.sorbs.net has address 127.0.0.10
>
> 127.0.0.10 -> dynamic address
>
> Something's clearly not quite right at SORBS.
>
>
>
> /Per Jessen, Zürich
>
>
The Sorbs web site is broken too. Can't get to any delisting pages.
Running very slow and lots of errors. Sorbs is definitely broken today.
--
Marc Perkel - Sales/Support
support@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
Re: How do I get delisted from SORBS? [OT]
Posted by Per Jessen <pe...@computer.org>.
Marc Perkel wrote:
> Got this listing on sorbs:
>
> SORBS DNSBL <http://www.de.sorbs.net/> 127.0.0.2 "Aggregate
> zone See: http://www.sorbs.net/lookup.shtml?65.49.42.106"
> http://www.de.sorbs.net/overview.shtml
>
host 106.42.49.65.dnsbl.sorbs.net.
106.42.49.65.dnsbl.sorbs.net has address 127.0.0.10
127.0.0.10 -> dynamic address
Something's clearly not quite right at SORBS.
/Per Jessen, Zürich
Re: How do I get delisted from SORBS? [OT]
Posted by Ram <ra...@netcore.co.in>.
On Thu, 2010-10-07 at 05:27 -0700, Marc Perkel wrote:
> Got this listing on sorbs:
>
> SORBS DNSBL <http://www.de.sorbs.net/> 127.0.0.2 "Aggregate zone
> See: http://www.sorbs.net/lookup.shtml?65.49.42.106"
> http://www.de.sorbs.net/overview.shtml
>
>
> Went to their web site and can't find a way to remove it. Their web site
> is barely responsive and there doesn't seem to be a removal tool. Anyone
> else having this problem or can give me some insight as to what is going
> on?
>
If you create a support ticket they respond ( usually within a
month :-) ) and most likely delist the ip address.
The problem with sorbs is that they take unreasonably long time to list
or delist
I have had machines listed because of relaying spams due to bad
passwords. While the listing itself is quiet reasonable .. SORBS seems
to notice the oubreak only a month after the spam outbreak happened and
was stopped.
Thanks
Ram