While checking my mail stats, i found some rejected emails because my IP range is blocked at spews.org.

Many of my client are complainig because their sent messages are not arriving to their destination because of this spews block.

What can i do, to revert this??

http://www.spews.org/html/S829.html

This is the spammer info.

1, 69.57.132.0/24, EV1 (ns2.union-dns.info)
1, 69.57.132.0/22, EV1 (ns2.union-dns.info)
1, 69.57.128.0/21, EV1 (ns2.union-dns.info)
1, 81.9.53.118, www.union-billing.net / ns3.union-dns.info (on listed eltel.net spam house)
1, 217.69.120.5, union-billing.net / ns1.union-dns.info / ns3.union-dns.info

Domain Name: UNION-BILLING.NET

Registrant:
Kristal Group LTD
Marina Chernova (libbett2000@yahoo.com)
Chambers, PO Box 146, Wickhams Cay
Road Town
Tartola,80427
VG
Tel. +375.296266787

Creation Date: 30-Apr-2003
Expiration Date: 30-Apr-2004

Domain servers in listed order:
ns0.union-dns.info
ns1.union-dns.info
ns2.union-dns.info
ns3.union-dns.info
ns4.union-dns.info
ns5.union-dns.info

Status: ACTIVE
-----------------------------------------------------------------------
-----------------------------------------------------------------------
Domain ID:D2723858-LRMS
Domain Name:UNION-DNS.INFO
Created On:27-Jun-2003 11:54:50 UTC
Last Updated On:04-Aug-2003 10:26:32 UTC
Expiration Date:27-Jun-2004 11:54:50 UTC
Sponsoring Registrar:R159-LRMS
Status:ACTIVE
Status:CLIENT LOCK
Status:OK
Registrant ID:C3353880-LRMS
Registrant Name:Marina Chernova
Registrant Organization:Kristal Group LTD
Registrant Street1:Chambers, PO Box 146, Wickhams Cay
Registrant City:Road Town
Registrant State/Province:Tartola
Registrant Postal Code:80427
Registrant Country:VG
Registrant Phone:+375.296266787
Registrant Email:libbett2000@yahoo.com
Admin ID:C3353880-LRMS
Admin Name:Marina Chernova
Admin Organization:Kristal Group LTD
Admin Street1:Chambers, PO Box 146, Wickhams Cay
Admin City:Road Town
Admin State/Province:Tartola
Admin Postal Code:80427
Admin Country:VG
Admin Phone:+375.296266787
Admin Email:libbett2000@yahoo.com
Billing ID:C3353880-LRMS
Billing Name:Marina Chernova
Billing Organization:Kristal Group LTD
Billing Street1:Chambers, PO Box 146, Wickhams Cay
Billing City:Road Town
Billing State/Province:Tartola
Billing Postal Code:80427
Billing Country:VG
Billing Phone:+375.296266787
Billing Email:libbett2000@yahoo.com
Tech ID:C3353880-LRMS
Tech Name:Marina Chernova
Tech Organization:Kristal Group LTD
Tech Street1:Chambers, PO Box 146, Wickhams Cay
Tech City:Road Town
Tech State/Province:Tartola
Tech Postal Code:80427
Tech Country:VG
Tech Phone:+375.296266787
Tech Email:libbett2000@yahoo.com
Name Server:NS0.UNION-DNS.INFO
Name Server:NS1.UNION-DNS.INFO
Name Server:NS2.UNION-DNS.INFO
Name Server:NS3.UNION-DNS.INFO
Name Server:NS4.UNION-DNS.INFO
Name Server:NS5.UNION-DNS.INFO
-----------------------------------------------------------------------

dah...when did SPEWS come back? I am having the same problem, guess it's time to send an email off to abuse.

Had a problem as well. Monkeys.com is the new SPEWS - and I mean that in the sense that these guys believe that they're doing a world of good buy blocking out huge sections of the internet over one box. Had a /20 blocked.

spews is still down so anyone still using them -- it's their fault. nothing you can do about it.

Nope, SPEWS is working again. http://www.spews.org/ is up and their lists are all working as normal, so far as I've been told (I don't use the lists myself, and never will).

Damn just when I thought the net had become a better place SPEWS starts up again

Whilst I don't advocate spam in anyway, spews goes over the top.

From what I seen on their website in the 'news':

News on News

Far too many listings/delistings to keep this current. Updates may occur in the future.

Doesn't look like they're too 'up and running'.

IIFC monkeys is just one very over worked person.

-drmike

Complain very loudly to abuse@ev1.net. Please remember that IP blocks only get listed when there's no follow up or removal of the spammer when the first series of complaints are sent to abuse. In other words, someone dropped the ball at RS.

-drmike

I'm really upset and sick with spews.org. Why do they have to block the whole block of IP instead of single IP that involved with SPAM? Such a stupid idiot SPAM admin!

They are trying to get you to do their work for them by complaining to your ISP to kick the spammers.

However most sysadmins don't have the time to spend hours talking to their ISP!

Contact the people that run the mail servers that are blocking your IPs and help spread the word about how spews blocks whole ranges....

spews does not have mail server admins best interest in mind..... this is vigilantism at its worst.

We should somehow create a rbl for mail servers that use spews.... and then block email from them until they rid their servers of spews.

Your kidding..... I use monkeys, spamcop and ordb.... is anyone else noticing this with monkeys? I hope not or they will deeep sixed from mail servers too.

Is it too much to ask for a good, professional block list?

We need one that's run be reasonable, accountable people, not anti-spam extremists.

I'd be willing to pay for a a professionally managed list I can trust.

We do have a professionally run anti spam list. Its called SPEWS. What we need is a professional run hosting company. Instead of complaining about SPEWS, i would be complaining about ev1. Remember SPEWS only upgrades to an entire block when the spammer remains after repeated spaming from the same IP over and over again. Reread that - the class C is blocked due to ev1 leaving a spammer instead of having them removed. The fault is ev1's, not SPEWS.

Have you asked ev1 why they havent dealt with the spammer? They lost my business after 10 months of being ignored about a spammer being within my class C with no follow up.

Doesn't say much of ev1 that this is still going on a year after I left.


edit: I had 119 UCEs out of ev1 space just within the last week.(And yes, I checked teh ip address) I'm about ready to block the entire netspace myself.

-drmike

drmike -

As of this moment we have absolutely nothing listed on either spews or spamhaus...

How many major hosts can say that?

Randy Williams, CTO

Randy, that is a good claim... but as fast as someone can sign up on your company... you can get listed.

Yes your abuse dept is diligent.. but its the other dept (spews for ex.) that has to work fast.. if they do not.. then the ole ball is in their court and you have to wait

Nice to see the change in policy finally. Sorry it took so long and it cost you my business. Of course repeated phone calls and emails to you folks not being followed up or returned also helped.

-drmike

and, yes, I've got to agree with that. (the how quickly you can get listed bit not the abuse dept is diligent. I see sites are still up that were reported recently.)

I do finally see my block is out of SPEWS which I'm greatful. It's a pity they couldn't deal with the issue while I was with them.

-drmike

Also for the record, I was very happy with the other service I received with rackshack while I was with them. Tech Support wasn't too bad, (We did have 3 tickets never resolved that were just closed up with no follow up when pointed out to support@ though which I wasn't way too happy with. Randy never returned my voicemail but that was over a year ago so I won't hold him to them.) sales wasn't an issue not was this area. I tried to help others as much as I received help. (Notice I'm still in the top 50 posters here. Pretty good for only 10 months.

What bothered me was during those 10 months, my box was in SPEWS along with other databases and it seemed like no one at RS was willing to deal with the issue.

I also wonder how many of those 119 UCE's I recently received are still hosted within RS space. I can pull up 3 from memory and checking at dnsstuff, I see that all 3 are still within RS space.

I still suggest RS servers to others but I do point out that they may have spam issues. I know of at least 2 customers who are currently hosted with RS and point out 1 has recently complained about emails being blocked. (I have a feeling that these are on private lists.)

Thank you for listening. I wish everyone well.

-drmike

Techie, I just PMed you an IP address (I know better than to post it here.) Looks like it's been open for at least three months and is one that I complained about earlier. I believe its a server address. (it comes up as a ev1server address.)

Care to comment?

thanks,
-drmike

(I'm not trying to pick a fight. really, I'm not. It just bothers me that it appears complaints to abuse@ and postings to news.admin.net-abuse.sightings appear to be going unanswered.)

drmike

can you please provide me with the ip address as well?

My Box's IP was listed under http://dsbl.org/main and when I try to remove it, it requires that the email postmaster@IP or abuse@IP to be setup.

How can I setup a similar email?

First you will need to setup Rdns so that when dsbl.org looks for the reverse for your IP it will then need to send an email to postmaster@yourdomain.com or abuse@yourdomain.com. Depending on what control panel you have you will then need to setup a postmaster and an abuse address. See links below why you would need the abuse and postmaster addresses

Abuse Address Required


Postmaster Address Required

Hope this helps!

Hi Chrisn,
My Ip seems to have no Reverse DNS, thank you!

You have to submit a ticket with tech support. I believe it's one of the options you have.

Note, they may or may not do it for you. I had an issue that was never resolved with them when they did mine. (They RDNSed my main IP address with my name for the secure IP address, never RDNSed my secure IP address and then just closed the couple of tickets when I asked them to fix the issue.)

It may take a couple of tickets to get them to follow through.

-drmike