I've just set up my mail server to use the RBL at
ips.backscatter.org. It's doing well in that it's blocking about 3
spams a second of backscatter spam, and only letting one through every
few minutes, but I'm less sure of the situation regarding false
positives, so have been keeping an eye on it.

In my logs I've just found a false positive:

Apr 1 05:49:01 a3 postfix/smtpd[13505]: NOQUEUE: reject: RCPT from
n12c.bullet.scd.yahoo.com[66.218.67.49]: 554 5.7.1 Service
unavailable; Client host [66.218.67.49] blocked using
ips.backscatter.org; from= realuser=mydomain.co.nz@returns.groups.yahoo.com>
to=mydomain.co.nz> proto=SMTP
helo=<n12c.bullet.scd.yahoo.com>

The testing tool at <http://www.backscatterer.org/index.php?
target=test> says this IP (66.218.67.49) is not listed.

Using 'rblcheck' from the command line confirms the IP is listed.

Hi,

Since backscatterer.org doesn't provide a means to contact them, I hope
they at least read this newsgroup.

When loading http://www.backscatterer.org/?ip=165.76.0.201 the web-server
returns a form that includes a socalled CAPTCHA image. While personally
I think that such images provide more harm (for humans) than benefits
(against robots) that's not my point here. The problem is, actually, that
the web-server seems to deliver the image with a wrong content-type:

Date: Thu, 27 Mar 2008 14:49:52 GMT
Server: Microsoft-IIS/5.0
X-Powered-By: PHP/4.3.8
Set-Cookie: PHPSESSID=80b9ed7a68b4c69b977596aedec663d1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Connection: close
Proxy-Connection: close

Ok I have had a great three weeks sorting out email problems.

First of all when you get this problem nobody knows anything about it,
then when you finally send emails nobody replies either.

I finally joined http://www.emailreach.com which was good, actually
really good. I've gone from a 10 score to 3, apprently 2 is a good
score.

I've got still got a few problems to fix, one of them is this here
with UCEPROTECT.

My IP addresses are 72.167.52.118 - 72.167.52.22 and they are with Go
Daddy.

I have not been sending spam but I did receive a few bounced emails
from somebody using one of my addresses.

The website is www.pousada.com.br.

How do I go about getting off tis Blacklist, thanks........

I was referred to this website by UCE Protect, after being advised
(via a third party) that my IP address had been blacklisted.

My problem is that I don't understand the information provided on the
UCE Protect site, nor on the backscatter site, and I don't know how to
go about fixing the problem.

I do manage several large email lists using the affected domain (using
ezmlm and qmail) which were set up for me by a contract technician. I
have been managing these lists, using the same software (via various
upgrades, obviously), for more than 10 years - so I am a bit surprised
to find myself listed (according to the UCE Protect site, I have been
listed three or four times previously).

I would like to fix whatever it is I am doing that is causing the
problem, but I can't work out what I am doing wrong. I don't know what
'backscatter' or 'sender callouts' are (even after reading all the
documentation and doing a google search), but as far as I know I am
not using such devices.

I'm finding it very difficult to understand how all my blocks got
listed when we have received Zero complaints in the last 3 months, all
those before (about one per month) were responded to within hours and
solved within 24.

One would think that my upstreams would have at least forwarded a
complaint. All that is being said is that I've been listed here.

Any suggestions other than blindly paying to be delisted? If there
really is a problem, I sincerely would like to know what it is.

Thanks in advance for any response.

Kevin

Hello

I run a mailserver with postfix, spam assassin ... etc, And I reject
mail directly from postfix with zen.spamhaus

This week I've receive 500 mails / days wich was DSN,
Autoresponder ... etc

A spammer use My email address as From address, Si misconfigured
server send me Non delivery mail

How to stop this ??

I'have try a spam assassin rules with ips.backscatterer.org score 10 !
But It not reduce a lot the spam.

I can't blacklist all server who send me those mails, because they are
more than 200 and the list growth :-s

What Must I do ???

Thanks

In My log I have find a list of IP of misconfigured server who send me
this Non delivery mail in 1 day :

134.174.120.82
143.90.14.86
164.106.102.4
168.150.238.164
192.50.9.4
193.161.175.27
193.164.143.246
193.19.181.98
193.251.52.43
193.252.23.21
193.99.214.199
194.105.166.16
194.109.24.100
194.127.3.30
194...

Our IP 213.133.106.116 ist listed on backscatterer.org at the moment.
We 've checked our server and the "mailbox is full" bounce is the one
and only bounce our server is sending. This is allowed by us, because
such messages are necessary and seldom, because full mailboxes are in
daily mailtraffic seldom. This can not be abused for backscattering.
Please be so kind and explain us, why such a message nevertheless
causes an entry. We think, uceprotect work in this case not correct.

What is your opinion about ?

Below the snippet from our smtplog:

....de> R=vmail_user T=vmail_delivery defer (-22): mailbox is full
(MTA-imposed quota ex ceeded while writing to tmp/.....

Kind regards

Bernd Kaiser

We have been listed on this blacklist for longer than the 7 days they
say it takes to get removed. The problem was fixed 8 days ago, yet we
are still listed. We were unfortunate enough to be listed on 3 other
black lists, and those allowed us to request to be removed
immediately. What kind of tests can I do to see why we are still on
this list? It is seriously hindering our business not to be able to
send email, but we think the $50 removal fee is preposterous. Our IP
is 64.186.32.26.
Any responses would be appreciated.
Thank you,
Jill

Can you please help how can we delist iif.hu. What was the problem?

Katalin Ganzler

Today, I became aware that my mail server at 62.153.141.98 was
blacklisted by apews.org [1]. The block actually spans the entire range
of 62.153.0.0/16 which is quite unfortunate as this range is split
over a huge number of subnets. My network including the mail server in
question is 62.153.141.96/29 -- as can be easily verified by retrieving
the associated record from RIPE [2].

To me it makes no sense to block an entire /16 range which has been
splitted into individual RIPE-listed subnets. I can guarantee that
at no time spams were originating from this mail server at 62.153.141.98
or from anywhere within 62.153.141.96/29. No webserver is run in this
subnet nor anything else which would justify a block.

Andreas.

[1] http://www.apews.org/?page=test&C=130&E=280599&ip=62.153.141.98
[2] whois -h whois.ripe.net 62.153.141.98