Forum: Ruby ruby-lang emails getting blocked

Announcement (2017-05-07): www.ruby-forum.com is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see rubyonrails.org/community and ruby-lang.org/en/community for other Rails- und Ruby-related community platforms.
9c7f2f44463d1d4890f73e8a8229dd29?d=identicon&s=25 Caleb Tennis (Guest)
on 2006-02-14 21:07
(Received via mailing list)
It seems that beryllium.ruby-lang.org has found itself on spamcop's
blocking list (which explains why I haven't gotten any mails in about 15
hours):

http://www.spamcop.net/bl.shtml?210.163.138.100

Caleb
19f65b7dca6831edf989224b5ebd3fe0?d=identicon&s=25 unknown (Guest)
on 2006-02-14 21:16
(Received via mailing list)
On Wednesday 15 February 2006 05:06 am, Caleb Tennis wrote:
> http://www.spamcop.net/bl.shtml?210.163.138.100

http://www.spamcop.net/w3m?action=blcheck&ip=210.1...

I don't understand, unless someone was using a faked address and
actually hit
one of the spam traps, how could this happen?

Tsume
0ec4920185b657a03edf01fff96b4e9b?d=identicon&s=25 Yukihiro Matsumoto (Guest)
on 2006-02-15 00:21
(Received via mailing list)
Hi,

In message "Re: ruby-lang emails getting blocked"
    on Wed, 15 Feb 2006 05:16:00 +0900, tsumeruby@tsumelabs.com writes:

|On Wednesday 15 February 2006 05:06 am, Caleb Tennis wrote:
|> http://www.spamcop.net/bl.shtml?210.163.138.100
|
|http://www.spamcop.net/w3m?action=blcheck&ip=210.1...
|
|I don't understand, unless someone was using a faked address and actually hit
|one of the spam traps, how could this happen?

I don't know.  If anyone has any idea, please tell me.  We do want to
resolve the issue.

							matz.
19f65b7dca6831edf989224b5ebd3fe0?d=identicon&s=25 unknown (Guest)
on 2006-02-15 01:16
(Received via mailing list)
On Wednesday 15 February 2006 08:19 am, Yukihiro Matsumoto wrote:
> |I don't understand, unless someone was using a faked address and actually
> | hit one of the spam traps, how could this happen?
>
> I don't know.  If anyone has any idea, please tell me.  We do want to
> resolve the issue.
>
> 							matz.

Well, I know how the list was blocked, but the question is, "how was it
triggered?" The spamcop list only lists addresses which send mail to the
spam
trap email addresses. So someone 1) must have learned the location of
one of
these spam traps, or 2) send a email which had a reply to address to a
spam
trap by accident. Either way, needs to be solved. Someone needs to
complete
the delisting form on the spamcop website.

http://www.spamcop.net/w3m?action=blcheck&ip=210.1...

Tsume
7f649f7754960581ea9d7f7ee518d782?d=identicon&s=25 Phil Duby (Guest)
on 2006-02-15 03:34
(Received via mailing list)
"Yukihiro Matsumoto" <matz@ruby-lang.org> wrote in message
news:1139959143.551422.16561.nullmailer@x31.priv.netlab.jp...
> |I don't understand, unless someone was using a faked address and actually
> hit
> |one of the spam traps, how could this happen?
>
> I don't know.  If anyone has any idea, please tell me.  We do want to
> resolve the issue.
>
> matz.

Spammer use random faked return (from) addresses in junk mail headers.
If
an email with one of the spam trap address as the from was bounced by
the
ruby-lang.org server, spamcops process would see the [bounce] message as
originating from ruby-lang.org.  I believe the process is totally
automated,
so no human checks to see if the message was a bounce.

Given spamcop's stance on mail management, RFC's, and bounce messages,
even
if that is the case, spamcop would probably still list the server as a
spam
source, because it is sending 'backscatter' spam (the bounce).  IIRC one
of
the RFCs says a delayed bounce using the from address in the message
headers
is not approprite.  It must be bounced during the initial transfer, to
the
originating IP.
See http://www.spamcop.net/fom-serve/cache/329.html for their
information on
auto-responders and bounces

Undeliverable messages should be bounced early like that, but a list
server
that is sending confirmation / authentication messages can get caught in
some combinations.

Of course as Tsume said, it could be someone attempting to signup from
the
web page using one of the spam trap addresses, and the legitimate
confirmation request email getting the server listed.  That combination
can
be elimiated if you can use a different server for sending the
confirmation
messages from the one used to send the mailing list messages.  The
confirmation server would get listed, but the list server would still be
clear.

I have not been an active user of spamcop for some time.  They used to
have
reasonably helpful people on their own news server.  They do (did) tend
to
be a bit sarcastic with any sort of rant about why 'my' server should
never
have been listed, and 'orders' to get it delisted NOW, or anything they
viewed as a spammer trying to find a way to 'work' the system.

A polite request for information about the emails that triggered the
listing
(source headers, maybe content, but not the spam trap address), with the
information from the spamcop block list entry, that you are running a
mailing list, and expressing a desire to find out what is wrong with
'your'
system / process could be productive.  Maybe suggest that your signup
verification may have been the cause.
See http://www.spamcop.net/help.shtml for links to thier NNTP servers.
Probably the main SpamCop (general) news group is best to start.
19f65b7dca6831edf989224b5ebd3fe0?d=identicon&s=25 unknown (Guest)
on 2006-02-15 05:38
(Received via mailing list)
On Wednesday 15 February 2006 11:33 am, Phil Duby wrote:
> A polite request for information about the emails that triggered the
> listing (source headers, maybe content, but not the spam trap address....

You mean the admins shouldn't demand or threaten to sue, just to turn
the
situation in to a hilarious cart00nie?!

(ex. http://www.ahbl.org/cart00nies/ )


Tsume
7f649f7754960581ea9d7f7ee518d782?d=identicon&s=25 Phil Duby (Guest)
on 2006-02-16 02:40
(Received via mailing list)
<tsumeruby@tsumelabs.com> wrote in message
news:200602151339.27833.tsumeruby@tsumelabs.com...
> Tsume
I had seen some similar samples before (in the spampal news groups), but
not
a collection :-)

And yes, try to avoid becoming the butt / content of a cart00nie
This topic is locked and can not be replied to.