February 10, 2012

L2.APEWS.ORG False Positive #12

This is another from the travel and tourism newsletters, not sure yet if the listing is tied to the recent "infomercials". We will check the listing, and delisting if it occurs, in due course. The email header follows;

Thur 2012-02-09 16:47:29: [60:170] Accepting SMTP connection from [98.158.230.106]
Thur 2012-02-09 16:47:29: [60:170] Looking up PTR record for 98.158.230.106 (106.230.158.98.IN-ADDR.ARPA)
Thur 2012-02-09 16:47:30: [60:170] D=106.230.158.98.IN-ADDR.ARPA TTL=(59) PTR=[business-travelupdate.com]
Thur 2012-02-09 16:47:30: [60:170] Gathering A-records for PTR hosts
Thur 2012-02-09 16:47:30: [60:170] D=business-travelupdate.com TTL=(1440) A=[98.158.230.106]
Thur 2012-02-09 16:47:30: [60:170] --> 220 xxx.xxx.xxx ESMTP MDaemon 6.7.9; Thur, 09 Feb 2012 16:47:30 -0500
Thur 2012-02-09 16:47:30: [60:170] <-- EHLO business-travelupdate.com
Thur 2012-02-09 16:47:30: [60:170] Performing reverse lookup on business-travelupdate.com (looking for 98.158.230.106)
Thur 2012-02-09 16:47:30: [60:170] D=business-travelupdate.com TTL=(1440) A=[98.158.230.106]
Thur 2012-02-09 16:47:30: [60:170] --> 250-xxx.xxx.xxx Hello business-travelupdate.com, pleased to meet you
Thur 2012-02-09 16:47:30: [60:170] --> 250-ETRN
Thur 2012-02-09 16:47:30: [60:170] --> 250-AUTH=LOGIN
Thur 2012-02-09 16:47:30: [60:170] --> 250-AUTH LOGIN CRAM-MD5
Thur 2012-02-09 16:47:30: [60:170] --> 250-8BITMIME
Thur 2012-02-09 16:47:30: [60:170] --> 250 SIZE 0
Thur 2012-02-09 16:47:31: [60:170] <-- MAIL FROM:
Thur 2012-02-09 16:47:31: [60:170] Performing reverse lookup on business-travelupdate.com (looking for 98.158.230.106)
Thur 2012-02-09 16:47:31: [60:170] D=business-travelupdate.com TTL=(1439) A=[98.158.230.106]
Thur 2012-02-09 16:47:31: [60:170] Spam Blocker A-record resolution of [106.230.158.98.L2.APEWS.ORG] in progress (DNS Server: 192.168.1.2)...
Thur 2012-02-09 16:47:31: [60:170] Spam Blocker D=106.230.158.98.L2.APEWS.ORG TTL=(35) A=[127.0.0.2]
Thur 2012-02-09 16:47:31: [60:170] L2.APEWS.ORG LISTED
Thur 2012-02-09 16:47:31: [60:170] Message will be accepted and X-RBL-Warning: header will be inserted.
Thur 2012-02-09 16:47:31: [60:170] --> 250 , Sender ok
Thur 2012-02-09 16:47:31: [60:170] <-- RCPT TO:
Thur 2012-02-09 16:47:31: [60:170] --> 250 , Recipient ok
Thur 2012-02-09 16:47:31: [60:170] <-- DATA
Thur 2012-02-09 16:47:31: [60:170] --> 354 Enter mail, end with .
Thur 2012-02-09 16:47:31: [60:170] --> 250 Ok, message saved
Thur 2012-02-09 16:47:31: [60:170] <-- QUIT
Thur 2012-02-09 16:47:31: [60:170] --> 221 See ya in cyberspace
Thur 2012-02-09 16:47:31: [60:170] SMTP session successful, 1453 bytes transferred.
Thur 2012-02-09 16:47:31: [60:170] Shuffling message(s) into proper queue(s)
Thur 2012-02-09 16:47:31: [60:170] Message received from business-travelupdate.com [98.158.230.106] with SMTP for [Size 1419] {j:\localq\500019.msg}

You may see fluctuations in your statistics which could be due to the rotation between IP addresses that some newsletter senders do. Where one IP address is listed and another is not, the newsletter will alternate between the spam folder and the inbox unless you have the IP address in your whitelist and/or a filter to move mis-placed emails.

98 comments:

  1. So I am posting here because it seems that you are the only one publishing/working with the current APEWS lists.
    I work in a NOC for an ISP in the northeast. We have a customer who is asking to have his Statics that we assigned him removed from the APEWS list as this is a false positive (he has not gotten any bounce backs just wants to be proactive before setting up his mail server). MXTOOLBOX and all the blocklists there show that his ranges are not listed but when going to the APEWS.org website and using the IP tool it does show these IP's. I have done some reading and it seems at least at this point the USENET groups one would have posted to are dead/archived. So the FAQ is somewhat useless at this juncture. It seems that you are the only one working with these lists to remove the false positives so would you be able to assist in removing this false positive or would there be better source that we can go to (aside from NANAE or NANBL which are defunct)?

    S. Newman
    Metrocast Cablevision

    ReplyDelete
    Replies
    1. NANAS and NANBL are defunct, NANAE has a very poor signal to noise ratio these days and contributes little to antispam in our experience. The is a group of posters who want to ridicule the use of the APEWS dataset yet our continuing tests show great results and the data is free for anyone to use. You'd have to be crazy to pay for a less functional method.

      You haven't given us an IP address above but I see that Metrocast has the 65.175.128.0/17 CIDR and that Metrocast inbound (according to DNS) email servers are listed as trusted. Whois shows 65.175.128.128/26 being announced as well as the /17. When I test your email server IP address on the APEWS website it shows as not listed. Maybe there are smaller listings within your /17 if e.g. an abusive client got your IPs listed, you need to be more specific.

      Your client could try to get his email servers listed as a trusted source as described in an earlier post here, or smart host the emails via Metrocast email servers since he would then benefit from your trust factor.

      The only way that we have seen IP addresses get delisted is by publishing an error or false positive. Perhaps your client can obtain an email header from one of his recipients showing the rejection of his email based on the APEWS listing and publish that email header here? If not, perhaps the recipient can publish it as we do here for our users.

      Delete
  2. This listing seems to be for Acceleratebiz IP space, it was the whole /20 and not without reason in our experience. The IP address used for sending the travel update newsletters has been delisted.

    ReplyDelete
  3. We are an AT&T Internet customer and we have a Class C assigned to use and registered properly in the ARIN WhoIs (show below). We are apparently on the APNEWS as part of a very large block (/17). Given that we have been delegated our block of addresses, is there any way that APNEWS will post an more specific entry for our block, 12.182.236.0/24 that will keep it from registering as a positive hit in APNEWS as part of the enormous /17 block?

    WHOIS-RWS

    Network
    NetRange 12.182.236.0 - 12.182.236.255
    CIDR 12.182.236.0/24
    Name CITY-OF-65-236
    Handle NET-12-182-236-0-1
    Parent ATT (NET-12-0-0-0-1)
    Net Type Reassigned
    Origin AS
    Organization CITY OF ST CHARLES (CSC-310)
    Registration Date 2005-04-09
    Last Updated 2005-04-09
    Comments
    RESTful Link http://whois.arin.net/rest/net/NET-12-182-236-0-1
    See Also Related organization's POC records.
    See Also Related delegations.


    Organization
    Name CITY OF ST CHARLES
    Handle CSC-310
    Street 112 N 1ST AVE
    City ST. CHARLES
    State/Province IL
    Postal Code 60174
    Country US
    Registration Date 2005-04-09
    Last Updated 2011-09-24
    Comments
    RESTful Link http://whois.arin.net/rest/org/CSC-310
    Function Point of Contact
    Admin PAN21-ARIN (PAN21-ARIN)
    Abuse PAN21-ARIN (PAN21-ARIN)
    Tech PAN21-ARIN (PAN21-ARIN)


    Point of Contact
    Name Anthoney , Paul
    Handle PAN21-ARIN
    Company CITY OF ST CHARLES
    Street 112 N First Avenue
    City St. Charles
    State/Province IL
    Postal Code 60174
    Country US
    Registration Date 2005-04-09
    Last Updated 2011-07-08
    Comments
    Phone +1-630-513-3051 (Office)
    Email panthoney@stcharlesil.gov
    RESTful Link http://whois.arin.net/rest/poc/PAN21-ARIN

    ReplyDelete
  4. Good Afternoon,

    I am hoping you folks might be able to lend me a hand with the following listing:

    64.17.0.0/19
    CASE: C-131
    Special Reason: Unallocated IP space
    Entry created 2007-07-22

    My company (Core NAP, L.P.) was assigned the following netblock back in 2008 that is part of this listing: 64.17.0.0/20

    What is the procedure for removing this /20 from the listing?

    Any help that can be provided will be appreciated.

    Thanks,

    Cliff Johnson, Data Center Manager
    Core NAP, L.P.

    ReplyDelete
    Replies
    1. Agreed with your comments, the original /19 was registered as two /20 and on checking those just now, we find both /20 to be delisted.

      Delete
  5. It seems that my tiny 97.91.121.50/28 block has been caught in the blacklisting of /20 block containing it. Case:C-1404
    Can anyone help?
    I am surprised APEWS throws out such a giant net. I would think they would want the service to be as accurate as possible to be an efficacious utility.

    ReplyDelete
    Replies
    1. Not surprising really, some years back unallocated IP space (hijacked or otherwise) was being used for spam runs. APEWS appears to have listed the whole lot therefore rendering it useless :-) Checking your IP address shows a different listing namely;
      Oooops 97.91.121.50 is currently listed in APEWS :-(
      Entry matching your Query: E-464363 97.91.0.0/16
      CASE: C-18 Spambots, zombies, contaminated CIDR, bad reputation provider
      History:
      Entry created 2011-03-13
      That would suggest that there has been a change in the data and that the listing is receiving attention. Perhaps the /20 has been delisted while they deal with the rest of the /16.

      Delete
    2. Your IP address is not listed any more.

      Delete
  6. We appear to have been thrown into a giant net as well.

    Entry matching your Query: E-441117
    209.210.0.0/18
    CASE: C-15

    That's 16382 addresses. I can't see how a list could be useful by doing such broad ranges. Might as well be 0.0.0.0/1.

    ReplyDelete
    Replies
    1. In IPv4 terms, that is actually quite small, there are admins out there who block entire /8s! Looking at the CIDR reputation e.g. in senderbase.org website, we see nothing bad with your CIDR, certainly no record of spam etc to our users and checking some random IPs within that /18, the whole CIDR appears to have been delisted. Please report back if you find smaller CIDR still listed.

      Delete
  7. Hi sir,

    Not sure why my IP is listed Please remove

    Entry matching your Query: E-496136
    50.16.0.0/13CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing tableHistory:
    Entry created 2011-10-23

    ReplyDelete
    Replies
    1. According to Whois, the 50.16.0.0/13 is more correctly made up of 50.16.0.0/14 allocated to Amazon, 50.20.0.0/16 and 50.21.0.0/17 allocated to CBeyond, a /17 of smaller CIDR and finally 50.22.0.0/15 allocated to Softlayer. Checking some random IPs in those CIDR and they seem to have been relisted in the above CIDR rather than the /13 that includes bub-allocations.

      Delete
  8. One of our customers is having problems with this blocklist. Apparantly, there's an entire /9 (!!!!) blocked. Isn't this ridiculus huge?

    Entry matching your Query: E-504060
    31.128.0.0/9CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing table

    As ISP, we're having 31.223.160.0/20 which is right in the middle of this /9.
    Why block an /9 subnet??????

    ReplyDelete
    Replies
    1. As explained to the other poster, some years back unallocated IP space was being hijacked or otherwise made available to spammers. APEWS seem to have listed all the unallocated IP space to prevent abuse. No change in the listing as yet.

      Delete
    2. Your IP addresses appear to be delisted, please post back if you find smaller CIDR within your /20 still listed.

      Delete
  9. More false positives:

    Entry matching your Query: E-438521
    85.9.48.0/21
    CASE: C-17
    Spambots, zombies, contaminated CIDR, bad reputation provider
    History:
    Entry created 2010-12-20

    --
    Entry matching your Query: E-462429
    89.149.32.0/19
    CASE: C-688
    AS12310 RO, ISP permits abuse and/or ignores criminal activity
    History:
    Entry created 2011-03-07
    --
    Entry matching your Query: E-469661
    78.97.92.0/24
    CASE: C-21
    Spammer / Scammer / Scanner / Zombie / other within this CIDR
    History:
    Entry created 2011-04-23
    --
    Entry matching your Query: E-365587
    78.97.0.0/16
    CASE: C-1403
    Dynamic IP space, generic DNS/rDNS, no PTR
    Direct connections to MX not permitted, you
    need to use your ISP servers or smarthost
    Special Reason:
    Dynamic IP, generic DNS, missing rDNS/PTR not permitted for direct email connection. You must use correctly configured [with registered working abuse contact] static IP / ISP mail servers / smarthost service
    History:
    Entry created 2008-08-12

    ReplyDelete
    Replies
    1. It looks like none of these IP addresses have been delisted but we are not surprised since our own networks have received spam or port scanners from these CIDR. Maybe somebody has an error matching a trusted sender in these CIDR? We can't find any whitelisted anywhere.

      Delete
  10. Our outgoing mailserver 80.62.243.126 matches this:

    Entry matching your Query: E-456634
    80.62.128.0/17CASE: C-79
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2011-02-05

    Please remove; /17 is a rather large block.

    ReplyDelete
    Replies
    1. There seem to be many abusive IP addresses in that /17, Kento actually announce 80.62.0.0/15. Your IP address is not listed now.

      Delete
  11. is it my imagination, or has APNEWS just re-blacklisted all the IP's in the world that have ever had a spam incident?

    ReplyDelete
    Replies
    1. Presumably you are referring to APEWS, can you be more specific? We are still getting an impressive 97.5% hit rate against spam and 0% false positives. The last FP is shown above, nothing else since Feb 9, 2012. Publish the errors that you have or are you talking about re-offenders?

      Delete
  12. Good morning. I just received notice that my ip was included in a block list on and is probably a false positive. Here is the report:
    Entry matching your Query: E-505193
    173.236.96.0/20CASE: C-17
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2012-01-09

    My ip is 173.236.98.44 and apparently is included in a large block.

    Can this be corrected?

    ReplyDelete
  13. I am hoping you folks might be able to assist with the following listing:

    Entry matching your Query: E-450794
    209.184.112.0/20CASE: C-14
    Spambots, zombies, contaminated CIDR, bad reputation provider.

    ReplyDelete
    Replies
    1. Just checked some random IP addresses in that /20 and they seem to be clear, report back if you're still having problems.

      Delete
  14. my IP is listed Please remove

    Testresults

    Oooops 190.34.152.219 is currently listed in APEWS :-(


    --------------------------------------------------------------------------------
    Entry matching your Query: E-241859
    190.34.152.0/21
    --------------------------------------------------------------------------------
    CASE: C-194
    AS11556 PA, ISP permits abuse and/or ignores criminal activity
    --------------------------------------------------------------------------------
    History:
    Entry created 2007-07-07

    ReplyDelete
    Replies
    1. This now shows as 190.32.0.0/14, looks like the ISP was listed previously. Something is happening because that CIDR doesn't come up as before. Maybe wait a while and see.

      Delete
    2. Checking some IP addresses inside that /21 and it seems to have all been delisted, please post back if you still have problems.

      Delete
  15. My IP is listed incorrectly please remove

    Oooops 78.33.247.242 is currently listed in APEWS :-(
    Entry matching your Query: E-366145
    78.33.128.0/17CASE: C-1403
    Dynamic IP space, generic DNS/rDNS, no PTR
    Direct connections to MX not permitted, you
    need to use your ISP servers or smarthostSpecial Reason:
    Dynamic IP, generic DNS, missing rDNS/PTR not permitted for direct email connection. You must use correctly configured [with registered working abuse contact] static IP / ISP mail servers / smarthost serviceHistory:
    Entry created 2008-08-18 2009-02-18: Entry changed from 78.33.0.0/16 to 78.33.128.0/17

    ReplyDelete
  16. I am the IT administrator for NLP. Our IP address 0f 64.132.182.104 is being blocked by apews. We are not spamming and should not be on this list. Can we please be removed.

    ReplyDelete
  17. Who the Hell are apews.org? And why are you blocking huge blocks of IP addresses? Something seems dodgy here!!!!!!!!!!!!!!!!

    ReplyDelete
    Replies
    1. See www.apews.org, they have written about what they do and how to use the data. You will find many private firewalls listing blocks of IP addresses for various reasons, http traffic, smtp or country based etc. We use our rules on our servers, expect you do the same.

      Delete
  18. This is certainly a false positive

    Oooops 64.132.182.104 is currently listed in APEWS :-(


    --------------------------------------------------------------------------------
    Entry matching your Query: E-488867
    64.132.128.0/18
    --------------------------------------------------------------------------------
    CASE: C-258
    Spambots, zombies, contaminated CIDR, bad reputation provider
    --------------------------------------------------------------------------------
    History:
    Entry created 2011-09-08

    ReplyDelete
  19. Looking at all of the reply's here it seems that there is a large set of bad data in the list. Entire subnets are listed. The entry listed below is an entry from 2007. This cropped back up this week.

    Oooops 74.62.167.190 is currently listed in APEWS :-(
    Entry matching your Query: E-255760
    74.62.160.0/21CASE: C-130
    One or more bots in ASN / CIDR, unprofessional / negligent ownerSpecial Reason:
    Only the ASN/CIDR owner can solve this listing by actioning FAQ 42 apews.org SHUTDOWN BOTS, ZOMBIES, NET ABUSEHistory:
    Entry created 2007-07-13

    ReplyDelete
  20. I'm very confused as to how to request a delisting. We have recently obtained 4 blocks of class C IP subnets. I just got a notice a few days ago that we were listed on this list with 199.59.152.226. When I look up the IP on APNEWS.ORG it shows the listing was created back in March of 2011. We didn't own this block then. It's possible the blocks were a part of an ISPs dynamic listing but this is no longer the case and the IP's are in use for non-SPAM purposes including legit business emails. I used MXToolbox to find us on this list and I'm assuming they weren't checking this list in the past as we have been using these blocks of IP's for about 6 months and I've never seen us on that list using MXToolbox to check. My major issue here is there are no delisting or at least formal delisting procedures. My experience is legit block-lists have formal delisting procedures which are free of charge. All others are scams, in my opnion. APNEWS needs to get a little more organized with their site and offer more information. Being a lister of such nature requires a certain type of responsible nature. The FAQ is a joke on the site. Please remove 199.59.152.0/24, 199.59.153.0/24, 199.59.154.0/24 and 199.59.155.0/24 from your list. Since you have no formal request form for removal this is my only option for requesting a delist.

    ReplyDelete
    Replies
    1. We thought that the best idea of a delisting request was to publish the email headers of the errors of using the blacklist. This we have done and anyone is invited to do the same. Others have posted here in the belief that their listing is an error and some have been delisted. We assume that bringing the relevant CIDR to the attention of the APEWS Administrators has worked where the CIDR reputation has improved since being blacklisted.
      Your IP addresses appear to have been delisted too.

      Delete
  21. Ok, the reason I did not post the IP's is that I wanted to be sure that you could help. The IP's that our customer is requesting is as follows.....

    74.214.47.180
    74.214.47.181
    74.214.47.182

    those are the mail server IP's for this customer. Thanks again

    S. Newman
    Metrocast NOC

    ReplyDelete
    Replies
    1. Those IP addresses aren't listed now, you can see your CIDR reputation at senderbase.org website which may help you with spammers on your network.

      Delete
  22. Hi there!

    Could You please check on this for me?

    Oooops 193.6.62.162 is currently listed in APEWS :-(
    Entry matching your Query: E-256684
    193.6.0.0/16
    CASE: C-376
    AS1955 HU, ISP permits abuse and/or ignores criminal activity
    Special Reason:
    ISP permits abuse and/or ignores criminal activity
    History:
    Entry created 2007-07-13

    Regards,
    pearl

    ReplyDelete
    Replies
    1. That /16 seems to have cleaned up sicne a few years back, testing your IP shows it to be delisted.

      Delete
  23. dear admin Apews.org,

    i'm network engineer on one of the ISP in malaysia. i'm really need to de-blacklist one of my customer ip. i can't see any admin email that i can report to de-blacklist the ip. i hope by using this forum/blog, i will get the response as soon as possible. below is the result appears after check the ip in lookup domain boxes:

    Oooops 202.46.112.7 is currently listed in APEWS :-(
    Entry matching your Query: E-304363
    202.46.112.0/20
    ---------------------------------
    CASE: C-1375
    Spambots/zombies within CIDR
    ---------------------------------
    Special Reason:
    Only the ASN/CIDR owner can solve this listing by actioning FAQ 42 apews.org SHUTDOWN BOTS, ZOMBIES, NET ABUSE
    ---------------------------------
    History:
    Entry created 2007-09-26

    ReplyDelete
  24. You are better off trying to make mail server operators not use APEWS, this is a joke when it lists half the internet.

    My spam listing monitor site mxtoolbox.com has stopped checking APEWS.

    ReplyDelete
    Replies
    1. Hey Leif, you posted earlier about your mail server IP and it was delisted so you should have benefited and felt better. This blog is trying to correct errors for folks but your server your rules right, not sure you look good doing that, still. Surely correcting errors in any system is a good thing. More than half the internet is made up of residencial modems, what % you reckon Zen.Spamhaus or Barracuda etc have lsited?

      Delete
  25. Our IP is found being blacklisted. We are not spammer. Please help to remove it. Our IP is 203.185.47.17

    Entry matching your Query: E-272808
    203.185.0.0/18
    --------------------------------------------------------------------------------
    CASE: C-685
    AS9269 HK, ISP permits abuse and/or ignores criminal activity
    --------------------------------------------------------------------------------
    Special Reason:
    ISP permits abuse and/or ignores criminal activity
    --------------------------------------------------------------------------------
    History:
    Entry created 2007-07-18

    ReplyDelete
  26. Good day,

    My IP address has been blacklisted. My IP doesn not spam and I take all measures to ensure that there are no occurrences of spam or spam relays through my network. Can you please remove my IP 201.238.64.222

    Entry matching your Query: E-278555
    201.238.64.0/24
    --------------------------------------------------------------------------------
    CASE: C-890
    AS5639 TT, ISP permits abuse and/or ignores criminal activity
    --------------------------------------------------------------------------------
    Special Reason:
    ISP permits abuse and/or ignores criminal activity
    --------------------------------------------------------------------------------
    History:
    Entry created 2007-07-28

    ReplyDelete
    Replies
    1. Your IP address is showing as 201.238.64.222.business.static.tstt.net.tt in Whois, what should your matching forward and reverse DNS show? Have you tried getting whitelisted? It doesn't look like an APEWS.org listing is your only problem.

      Delete
  27. We has been e-mail attacks,and the IP is found being blacklisted.
    So we can’t send mail to the each other person.
    please removal the IP.

    Our IP:211.75.45.86
    Domain name: mail.bolymin.com.tw

    Thanks !

    -----------------------------------------------------------------

    Testresults


    Oooops 211.75.45.86 is currently listed in APEWS :-(


    --------------------------------------------------------------------------------
    Entry matching your Query: E-431443
    211.75.0.0/18
    --------------------------------------------------------------------------------
    CASE: C-170
    AS3462 TW, ISP permits abuse and/or ignores criminal activity
    --------------------------------------------------------------------------------
    History:
    Entry created 2010-11-05

    ReplyDelete
    Replies
    1. Your IP address is not listed now, hope that helps with your delivery problems.

      Delete
  28. Hi, we are part of the 190.210.0.0/18 block of IPlan provider in Argentina and have the tiny block 190.210.2.192/29. We found that we are listed in APEWS with this entry:

    Entry matching your Query: E-412295
    190.210.0.0/19

    CASE: C-1375
    Spambots/zombies within CIDR

    History:
    Entry created 2010-09-11

    Could you possible fix this problem at least for our block?. We started operating on January as a travel company and need to send mails to clients that use APEWS.

    Thanks in advance and sorry for my english but it's not my native language.
    Ernesto Domato
    Hotels&Titcket Administrator

    ReplyDelete
    Replies
    1. Just checked your IP address and it now shows as the /24 from a 2008 listing. Obviously something is happening because the /19 listing has gone. It needs to check again soon and report back.

      Delete
    2. Just checked again and your IP address has been delisted

      Delete
  29. Hi
    Some IP I just acquired are listed in APEW. Is it possible to delist them ?

    37.59.165.0;37.59.165.1;37.59.165.2;37.59.165.3
    176.31.50.208;176.31.50.209;176.31.50.210;176.31.50.211
    178.33.189.200;178.33.189.201;178.33.189.202;178.33.189.203
    37.59.145.181;37.59.145.182;37.59.145.183;37.59.145.184

    Thanks for your help.

    ReplyDelete
    Replies
    1. These are all small ranges within the OVH allocations and appear to be delisted now. Please report back if you disagree.

      Delete
  30. My IP address has been blacklisted. My IP doesn not spam and I take all measures to ensure that there are no occurrences of spam or spam relays through my network. Could you please de-list my IP or provide at last some evidence for listing. Please send email to my abuse or postmaster accounts, if needed.

    Oooops 87.119.168.213 is currently listed in APEWS :-(
    Entry matching your Query: E-461426
    87.119.168.0/21CASE: C-20
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2011-03-05

    ReplyDelete
  31. Hi
    We are an Italian Retail Company called COMET S.p.A.
    Our mailserver in in L2 list :
    mail.gruppocomet.it
    195.120.224.40
    RIPE CLASS https://apps.db.ripe.net/search/query.html?searchtext=195.120.124.40#resultsAnchor

    Obviously it is not an open relay and we do not make spam

    Can you remove it from L2 ? thanks

    Thanks
    Nicola

    ReplyDelete
    Replies
    1. Just checked your IP address, it isn't listed now.

      Delete
  32. Hi,
    we are another Italian Company S.a.im.e. srl and we perform genset maintenance (and we also work with Comet S.p.A.).
    Our mailserver is:saimeservice.com
    IP is: 69.175.116.122

    The apews check says:
    Oooops 69.175.116.122 is currently listed in APEWS :-(
    Entry matching your Query: E-488810
    69.175.64.0/18CASE: C-258
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2011-09-08

    But I have purchased this reserved IP only one month ago...

    Can you help me? Thank you!

    ReplyDelete
    Replies
    1. This looks like the ISP was listed before, however checking now and we see that your IP address is in the clear. People should really check IP address listings before accepting them from an ISP, or accept a blacklisted IP address for a discounted rental price. If an ISP has a reputation for inaction agaisnt abuse, then their IP addresses could get listed again and you could then have delivery problems.

      Delete
    2. Is this where I go to get off the list? Please help. We are a business that sends out normal e-mails no spam.

      Delete
  33. Hi Admin,
    I'm From Linknet Indonesia, My IP address has been blacklisted from year 2007. My IP doesn't not spam and I take all measures to ensure that there are no occurrences of spam or spam relays through my network. Can you please remove my Following IP Address :
    202.73.96.0/22
    202.137.8.0/22
    202.137.16.0/22
    202.137.20.0/22
    202.137.24.0/22
    202.137.28.0/22

    Oooops 202.73.97.21 is currently listed in APEWS :-(
    Entry matching your Query: E-298724
    202.73.96.0/22
    CASE: C-1275
    AS23700 ID, ISP permits abuse and/or ignores criminal activity
    Special Reason:
    ISP permits abuse and/or ignores criminal activity
    History:
    Entry created 2007-09-06


    Entry matching your Query: E-258540
    202.137.8.0/22
    CASE: C-399
    AS4795 ID, ISP permits abuse and/or ignores criminal activity
    Special Reason:
    ISP permits abuse and/or ignores criminal activity
    History:
    Entry created 2007-07-14

    Entry matching your Query: E-298727
    202.137.16.0/22
    CASE: C-1275
    AS23700 ID, ISP permits abuse and/or ignores criminal activity
    Special Reason:
    ISP permits abuse and/or ignores criminal activity
    History:
    Entry created 2007-09-06

    Please delist my IP Address from Apews Blacklist.
    Thanks.

    ReplyDelete
  34. Dear APEWS!

    Remove the black list the IP address of the following:
    Joker.com.tr
    212.109.99.7
    212.109.99.5

    Your IP re-check our terms.


    Sincerely,

    FOREIGN TRADE ATM PAZ.A.Åž.

    ReplyDelete
  35. Hello APNEWS,

    Here is my false positive:

    Entry matching your Query: E-453676
    69.50.200.0/21CASE: C-813
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2011-01-28

    My site was not even hosted at 69.50.207.223 when it was put on the blacklist. I have added outgoing DKIM and SPF records and turned off recursive DNS. Please take 69.50.207.223 off the list. Thanks.

    ReplyDelete
  36. Here is my problem, it looks like a very large block was once listed from Comcast.net (75.146.48.0/20). We have an IP in that block that contains our email server, and now we are getting some bounces. I have checked all other elements, our block is clean.

    Any help to remove this old block would be appreciated.

    Chris C

    Oooops 75.146.53.61 is currently listed in APEWS :-(

    Entry matching your Query: E-330835
    75.146.48.0/20

    CASE: C-1403
    Dynamic IP space, generic DNS/rDNS, no PTR
    Direct connections to MX not permitted, you
    need to use your ISP servers or smarthost

    Special Reason:
    Dynamic IP, generic DNS, missing rDNS/PTR not permitted for direct email connection. You must use correctly configured [with registered working abuse contact] static IP / ISP mail servers / smarthost service

    History:
    Entry created 2008-04-28

    ReplyDelete
  37. Dear APEWS!

    Remove the black list the IP address of the following:
    mail2.bramont.com.br

    200.174.71.4

    Your IP re-check our terms.


    Sincerely,

    Daniel do Carmo Menezes
    MCITP - Bramont of Brazil
    daniel.menezes@bramont.com.br

    ReplyDelete
  38. Hi,
    we are again the Italian Company S.a.im.e. srl and we perform genset maintenance (and we also work with Comet S.p.A.).
    Our ISP move our site from one server to other and then changed our dedicated IP. Now is
    Our mailserver is:saimeservice.com
    IP is: 50.87.89.90

    The apews check says:
    Oooops 50.87.89.90 is currently listed in APEWS :-(
    Entry matching your Query: E-496143
    50.64.0.0/10CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing tableHistory:
    Entry created 2011-10-23

    Can you help me again? Thank you so much!

    ReplyDelete
  39. Hi my server is listed and shouldn't be as we are not sending out spam...please remove us from the blacklist.....mail.mctech360.com Ip address 74.218.116.186. Thanks.

    ReplyDelete
  40. Dear Team,

    My mail server IP address is listed and should't be as we are not sending out spam.... so please remove from the blacklist brandsystems.in ip: 202.71.153.148

    Thanks & Regards,
    Jagannath Patro

    ReplyDelete
  41. Dear Team,

    My mail server IP address is listed and should't be as we are not sending out spam. so please remove from the blacklist brandsystems.in ip:
    190.196.17.102
    186.67.42.198
    190.82.74.243

    Thanks & Regards,
    Juan Orostica

    ReplyDelete
  42. Hi Admin,

    We recently noticed that two of our IP's is listed on APEWS.org

    It seems to have been listed as far back as 2008, which was before we used it.

    The below from APEWS.org :

    Testresults
    Oooops 196.37.40.114 is currently listed in APEWS :-(
    Entry matching your Query: E-353394
    196.37.0.0/17
    CASE: C-715
    AS3741 ZA, ISP permits abuse and/or ignores criminal activityHistory:
    Entry created 2008-06-02

    From what we can see, it's a whole block, which we fall under ( If you could please get this delisted for our IP's 196.37.40.114 and 196.37.40.69 )

    Thanks,

    SYNAQ mail team.

    ReplyDelete
  43. Hi,

    Our IP address 80.177.68.98 is being incorrectly listed on apews. Can we please be removed.

    Kind regards

    Tim.

    ReplyDelete
  44. Dear sir/madam,

    Please help to remove 202.85.21.68 from your list. Thanks.

    Oooops 202.85.21.68 is currently listed in APEWS :-(


    --------------------------------------------------------------------------------
    Entry matching your Query: E-327684
    202.85.0.0/19
    --------------------------------------------------------------------------------
    CASE: C-447
    AS4515 HK, ISP permits abuse and/or ignores criminal activity
    --------------------------------------------------------------------------------
    History:
    Entry created 2008-03-17

    Best wishes,
    Peter

    ReplyDelete
  45. Another false positive at 97.76.40.54

    Entry matching your Query: E-463729
    97.76.32.0/20

    No mail servers on site. All mail sent through gmail. Just wasted a full day scanning for viruses trojans and rootkits only to find nothing.

    Remove and Thanks...pfft kinda

    ReplyDelete
  46. Hi Guys,

    Please remove the 81.223.156.151 address from your black list.
    Thanks.

    ReplyDelete
  47. Can you please removed our IP 74.142.32.66
    The entry appears to be rather old, but is still listed.
    Below is our entry....
    Entry matching your Query: E-277619
    74.142.0.0/17
    CASE: C-130
    One or more bots in ASN / CIDR, unprofessional / negligent owner
    Special Reason:
    Only the ASN/CIDR owner can solve this listing by actioning FAQ 42 apews.org SHUTDOWN BOTS, ZOMBIES, NET ABUSE
    History:
    Entry created 2007-07-25

    ReplyDelete
  48. I was just informed that my IP of 50.137.228.162 is blacklisted on apnews. Can someone tell me why and is there a way I can fix the problem to get removed from this list?

    ReplyDelete
  49. Hi. We have two IP addresses listed on APEWS (and nowhere else that we are aware of), and would like to please have both removed from the list. We are not engaged in spamming; all messages sent from these addresses are to consenting recipients only.

    Thanks in advance!
    ----------------------------------------
    Oooops 50.22.126.205 is currently listed in APEWS :-(
    Entry matching your Query: E-510706
    50.22.0.0/16
    CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing table
    History:
    Entry created 2012-02-24
    ----------------------------------------
    Oooops 50.22.126.204 is currently listed in APEWS :-(
    Entry matching your Query: E-510706
    50.22.0.0/16
    CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing table
    History:
    Entry created 2012-02-24

    ReplyDelete
  50. Hi,

    Some of our IPs are listed at your side, please clear them on urgent bases. And let me know the reason why these are listed here, as we have no info that these are being used in Spam.

    67.228.95.51
    67.228.101.72
    67.228.101.73
    67.228.101.74
    67.228.101.75
    67.228.101.76
    67.228.101.77
    67.228.101.78

    Please do it on urgent basis.

    ReplyDelete
  51. Can you please remove our IP from your list, it should not to be: domain, acbz.com.br IP 122.152.163.77

    ReplyDelete
  52. Hi,

    Our our customer is using this blacklist to filter spam and our IP 74.7.210.133 is currently listed.

    It looks like this is an old entry from 2008-07-25. This blacklist is blocking a larger segment of IP addresses, and we should not be included.

    Please remove. Thanks.

    --------------------
    Oooops 74.7.210.133 is currently listed in APEWS :-(
    Entry matching your Query: E-362517
    74.7.208.0/21
    CASE: C-1403
    Dynamic IP space, generic DNS/rDNS, no PTR
    Direct connections to MX not permitted, you
    need to use your ISP servers or smarthost
    Special Reason:
    Dynamic IP, generic DNS, missing rDNS/PTR not permitted for direct email connection. You must use correctly configured [with registered working abuse contact] static IP / ISP mail servers / smarthost service
    History:
    Entry created 2008-07-25

    ReplyDelete
  53. Please delist 190.213.85.238 this IP has no spam attached to it. It is a false positive.

    ReplyDelete
  54. Please delist 72.253.78.106 we not sending spam


    APEWS.ORG Databasetest

    Testresults
    Oooops 72.253.78.106 is currently listed in APEWS :-(
    ________________________________________
    Entry matching your Query: E-297394
    72.253.0.0/17
    ________________________________________
    CASE: C-1010
    Dynamic IP space, generic DNS/rDNS, no PTR
    Direct connections to MX not permitted, you
    need to use your ISP servers or smarthost
    ________________________________________
    Special Reason:
    Dynamic IP, generic DNS, missing rDNS/PTR not permitted for direct email connection. You must use correctly configured [with registered working abuse contact] static IP / ISP mail servers / smarthost service
    ________________________________________History:
    Entry created 2007-09-01

    ReplyDelete
  55. Can you please remove our IP 188.138.11.154 from your list?
    Testresults
    Oooops 188.138.11.154 is currently listed in APEWS :-(
    Entry matching your Query: E-644963
    188.138.11.0/24CASE: C-36
    Spammer / Scammer / Scanner / Zombie / other within this CIDRHistory:
    Entry created 2013-08-31

    ReplyDelete
  56. Can you please remove 173.160.115.185 from your list. No spanning is being done from this site.
    -------------
    Oooops 173.160.115.185 is currently listed in APEWS :-(
    Entry matching your Query: E-633819
    173.160.0.0/17
    CASE: C-22
    Dynamic IP space, generic DNS/rDNS, no PTR
    Direct connections to MX not permitted, you
    need to use your ISP servers or smarthost
    History:
    Entry created 2013-06-26

    ReplyDelete
  57. Can you please remove 74.95.41.89 from APEWS. We are being blocked from visiting some websites because of this listing. No spam is coming from this IP. Thanks.

    Oooops 74.95.41.89 is currently listed in APEWS :-(
    Entry matching your Query: E-318820
    74.95.32.0/20
    CASE: C-1403
    Dynamic IP space, generic DNS/rDNS, no PTR
    Direct connections to MX not permitted, you
    need to use your ISP servers or smarthost
    Special Reason:
    Dynamic IP, generic DNS, missing rDNS/PTR not permitted for direct email connection. You must use correctly configured [with registered working abuse contact] static IP / ISP mail servers / smarthost service
    History:
    Entry created 2008-01-12

    ReplyDelete
  58. Please remove 72.11.244.192/27, we are seeing the error for a larger block we are a part of.

    Entry matching your Query: E-638542
    72.11.224.0/19CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing table

    ReplyDelete
  59. Hello APEWS

    Please remove 186.1.47.165 from L2.APEWS
    We are no able to visit some websites because of this listing.
    This IP is a web Browser IP, It isn't from a mail server, in other words, no spam
    is coming from this IP.

    Thanks in advance.

    ReplyDelete
  60. Hello.
    My IP 217.25.228.223 on your blacklist. I recently received a static IP from the ISP and not a spammer or a violator of this IP address planning to use for several years. I ask you to remove my IP 217.25.228.223 from your blacklist.
    Thank you for your help and best wishes in your address.

    ReplyDelete
  61. I promise I will not talk smack on the internet ever again if you remove me please. I understand that gossip is not a good thing even if you are just joking around. Please help me get out of the black hole that has me . Thank you
    74.32.186.128

    ReplyDelete