August 28, 2013

L2.APEWS.ORG False Positive #23

Another reported false positive, few and far between as you have seen. This is the full header munged where appropriate;

Wed 2013-08-28 01:14:38: [6404:8081] Accepting SMTP connection from [98.130.1.134]
Wed 2013-08-28 01:14:38: [6404:8081] Looking up PTR record for 98.130.1.134 (134.1.130.98.IN-ADDR.ARPA)
Wed 2013-08-28 01:14:39: [6404:8081] D=134.1.130.98.IN-ADDR.ARPA TTL=(1440) PTR=[mail404.opentransfer.com]
Wed 2013-08-28 01:14:39: [6404:8081] Gathering A-records for PTR hosts
Wed 2013-08-28 01:14:39: [6404:8081] D=mail404.opentransfer.com TTL=(1440) A=[98.130.1.134]
Wed 2013-08-28 01:14:39: [6404:8081] --> 220 xxx.xxx.xxx ESMTP MDaemon 6.7.8; Wed, 28 Aug 2013 01:14:39 -0400
Wed 2013-08-28 01:14:39: [6404:8081] <-- HELO mail404.opentransfer.com
Wed 2013-08-28 01:14:39: [6404:8081] Performing reverse lookup on mail404.opentransfer.com (looking for 98.130.1.134)
Wed 2013-08-28 01:14:39: [6404:8081] D=mail404.opentransfer.com TTL=(1439) A=[98.130.1.134]
Wed 2013-08-28 01:14:39: [6404:8081] --> 250 xxx.xxx.xxx Hello mail404.opentransfer.com, pleased to meet you
Wed 2013-08-28 01:14:39: [6404:8081] <-- MAIL FROM:<xxx@xxx.xxx>
Wed 2013-08-28 01:14:39: [6404:8081] Performing reverse lookup on xxx.xxx (looking for 98.130.1.134)
Wed 2013-08-28 01:14:40: [6404:8081] D=xxx.xxx TTL=(360) A=[98.130.139.194]
Wed 2013-08-28 01:14:40: [6404:8081] P=010 D=xxx.xxx TTL=(359) MX=[mail404.ixwebhosting.com] {76.162.254.110}
Wed 2013-08-28 01:14:40: [6404:8081] Spam Blocker A-record resolution of [134.1.130.98.L2.APEWS.ORG] in progress (DNS Server: 192.168.1.2)...
Wed 2013-08-28 01:14:40: [6404:8081] Spam Blocker D=134.1.130.98.L2.APEWS.ORG TTL=(35) A=[127.0.0.2]
Wed 2013-08-28 01:14:40: [6404:8081] L2.APEWS.ORG LISTED
Wed 2013-08-28 01:14:40: [6404:8081] Message will be accepted and X-RBL-Warning: header will be inserted.
Wed 2013-08-28 01:14:40: [6404:8081] --> 250 <xxx@xxx.xxx>, Sender ok
Wed 2013-08-28 01:14:40: [6404:8081] <-- RCPT TO:<xxx@xxx.xxx>
Wed 2013-08-28 01:14:40: [6404:8081] --> 250 <xxx@xxx.xxx>, Recipient ok
Wed 2013-08-28 01:14:40: [6404:8081] <-- DATA
Wed 2013-08-28 01:14:40: [6404:8081] --> 354 Enter mail, end with <CRLF>.<CRLF>
Wed 2013-08-28 01:14:41: [6404:8081] --> 250 Ok, message saved <Message-ID: !&!AAzWLFEsxmkTAAA==@xxx.xxx>
Wed 2013-08-28 01:14:41: [6404:8081] <-- QUIT
Wed 2013-08-28 01:14:41: [6404:8081] --> 221 See ya in cyberspace
Wed 2013-08-28 01:14:41: [6404:8081] SMTP session successful, 1273 bytes transferred.
Wed 2013-08-28 01:14:41: [6404:8081] Shuffling message(s) into proper queue(s)
Wed 2013-08-28 01:14:41: [6404:8081] Message received from mail404.opentransfer.com [98.130.1.134] <xxx@xxx.xxx> with SMTP for <xxx@xxx.xxx> [Size 1260] {j:\localq\000330.msg}

31 comments:

  1. Nosso IP esta listado em sua lista como um spamer, poderia fazer a gentileza de retira-lo (189.111.122.163) pois temos a necessidade de envio diario de vários e-mails para nossos fornecedores, informando os dados se sua propriedade que somos responsáveis, peço com muita urgência, pois estamos sendo bloqueados por alguns servidores! Grato Rodrigo R. Zambini - Condomínio Agrícola - Guararapes-SP Brasil

    ReplyDelete
  2. Dear Admins,

    please remove my IP 190.82.65.74 APEWS record number is E-397988

    Reply

    ReplyDelete
  3. Dear Admins,

    please remove my IP 186.42.162.3 APEWS record number is E-413608

    ReplyDelete
  4. Please Remove 176.221.40.0/21. The APEWS record number is E-631959. But the network "176.221.40.0/11" doesn't belong to us. We administrate only the network 176.221.40.0/21.

    ReplyDelete
  5. Hi,

    I have found that one of our domains "mailkit.eu" is listed since 2007 with a description of "Vendaregroup, Sterlingmedia, Agoramarketing not confirmed opt-in, very aggressive smtp servers for re-try, ignore 550 commands, Special Reason:
    Sell email address databases".

    We own the domain since late 2006 and our company is running a reputable service for opt-in email marketing and we are strongly against any spamming. all campaigns of our customers are subject to manual approval to make sure no spam or phishing is sent from our systems. we do not own any email databases nor we ever had owned any before. on top of that the mailkit.eu domain is only being used for the web interface and the dns records of our servers (yet none of our IPs are listed in APEWS).

    I'd very much like to see what evidence was this record based on as I'm confident this is a false positive.

    Jakub

    Entry matching your Query: E-144626
    mailkit.eu
    CASE: C-94
    Vendaregroup, Sterlingmedia, Agoramarketing not confirmed opt-in, very aggressive smtp servers for re-try, ignore 550 commands
    Special Reason:
    Sell email address databases
    History:
    Entry created 2007-03-08

    ReplyDelete
  6. Hello,please remove from the blocklist l2.apews.org subnet 78.36.52.48/28. This is a static ip address Rostelecom used for a major client. We do not have APEWS record number. Check here: http://whatismyipaddress.com/blacklist-check.
    Please resolve the issue quickly.

    ReplyDelete
  7. Hi,

    I currenly rent a dedicated server, IP address 88.191.159.115. The server has been totally reformatted and reinstalled since 2013 and the postfix daemon locked down, but the corresponding IP is blocked due to bad practices reported in 28/12/2008.

    Is there a possibility of reviewing this block?

    Cheers,
    Daniel

    ReplyDelete
  8. please remove our ip block:
    213.180.32.0/19

    Entry matching your Query: E-278225
    CASE: C-874

    this record was created long time ago (2007-07-28) and is no more valid.
    thanks

    ReplyDelete
  9. Dear Admins :

    Please Remove E-331084 ( 61.218.0.0/15 ) ,

    History : Entry created 2008-05-06 !?

    thx

    ReplyDelete
  10. Dear Admins :

    Please Remove E-520154 ( 177.128.0.0/9 ) ,

    History : Entry created 2012-04-10

    thx

    ReplyDelete
  11. Please Remove E-366162 217.19.144.0/20

    History: Entry created 2008-08-18

    Thx

    ReplyDelete
  12. Please, remove this IP from the list.

    Thanks.
    Guido Ricci


    Oooops 2.228.121.198 is currently listed in APEWS :-(


    --------------------------------------------------------------------------------
    Entry matching your Query: E-575977
    2.228.0.0/16
    --------------------------------------------------------------------------------
    CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing table
    --------------------------------------------------------------------------------
    History:
    Entry created 2012-06-19

    ReplyDelete
  13. Oooops 76.76.103.210 is currently listed in APEWS :-(
    Entry matching your Query: E-455746
    76.76.100.0/22CASE: C-79
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2011-02-03

    Please remove. Our company has this IP assigned to our servers since last April, we don't know where this IP was before but you are the only list blocking us.

    Thanks!

    ReplyDelete
  14. please remove our IP 184.107.141.114 APEWS record number is E-520192, our hosting company assign to us this ip on september 5 2013 and we are not responsible for this ip before that date. thanks for your help.

    Oooops 184.107.141.114 is currently listed in APEWS :-(
    Entry matching your Query: E-520192
    184.107.128.0/17
    CASE: C-131
    Unallocated CIDR, no traffic until allocated,
    or allocated to bad reputation provider
    or allocated but dynamic / generically named IPs,
    or bogons, see www.cidr-report.org,
    or orphaned IP / CIDR in routing table
    History: Entry created 2012-04-10

    ReplyDelete
  15. Oooops 210.184.172.199 is currently listed in APEWS :-(
    Entry matching your Query: E-470463
    210.184.128.0/17CASE: C-258
    Spambots, zombies, contaminated CIDR, bad reputation providerHistory:
    Entry created 2011-04-26

    Please remove our ip, Our company has this IP assigned to our servers since 2013-07

    ReplyDelete
  16. Dear Admins :

    Please Remove 80.26.155.113 E-473542

    Thanks!

    ReplyDelete
  17. Please Remove 186.237.64.0/19. The APEWS record number is E-433315. But the network "186.224.0.0/11" doesn't belong. We administrate only the network 186.237.64.0/19.

    Entry matching your Query: E-433315
    186.224.0.0/11
    CASE: C-41
    Spambots / zombies / spammers / scanners within CIDR
    History:
    Entry created 2010-11-25

    ReplyDelete
  18. Hi APEWS Admins, please remove my IP address from your blacklist : 187.163.97.86

    Thanks!

    ReplyDelete
  19. Dear Admin

    Please remove our IP address 2.115.79.114. The APEWS record number is E-413496:

    Entry matching your Query: E-413496
    2.112.0.0/12
    CASE: C-41
    Spambots / zombies / spammers / scanners within CIDR
    History:
    Entry created 2010-09-19

    Thanks

    ReplyDelete
  20. Greetings APEWS Admins,

    Please remove my IP address from your blacklist: 70.165.62.226

    Entry created 9/16/2013

    Thank you

    ReplyDelete
  21. Hi APEWS Admins,

    Could you please remove my IP address from your blacklist:

    Oooops 176.58.88.24 is currently listed in APEWS :-(
    Entry matching your Query: E-609819
    176.58.88.0/24
    CASE: C-46
    Spammer / Scammer / Scanner / Zombie / other within this CIDR
    History:
    Entry created 2012-11-01

    Thank you in advance,

    ReplyDelete
  22. Daer Admin APEWS

    Could you please remove my IP address from your blacklist:
    Oooops 36.75.163.7 is currently listed in APEWS
    Entry matching your Query: E-179987
    36.0.0.0/8
    CASE: C-1404
    IP allocations to providers with a bad reputation
    Special Reason:
    No traffic until allocated
    History:
    Entry created 2007-05-28

    Thank you

    ReplyDelete
  23. Hello,

    I'm not sure if this is where we can request a de-list (can't seem to find much info on the process). Everyone else is requesting here so I'll give it a try.

    The host 72.52.214.133 has been added to your blacklist. This is a closed private server for high end corporate web hosting (no spam). We know every client personally. Sometimes sites or email addresses may become exploited if clients leak passwords. We have added many safeguards to prevent this and to our knowledge the server is clean at present.

    We could like to request a de-list of 72.52.214.133

    Sincerely.

    ReplyDelete
  24. Please remove 217.18.226.149 is a private adrees and they are clean

    Thanks

    Ruth

    ReplyDelete
  25. Please remove my ip 186.251.184.0/22 ​​block the spam list
    my server is 186.251.184.11 IP ns1.vipnetsul.com.br AS263003, already solved the problem of spam with a User of our network thanks

    ReplyDelete
  26. Please remove my ip 189.114.0.0/16 block the spam list
    my server is 189.114.223.23 IP link01.farbe.com.br already resolve to the problem of spam with a user of our network.

    ReplyDelete
  27. hi
    kindly remove our IP: 178.63.169.123. from your black-list.
    We recently got it.
    regs
    jamshid

    ReplyDelete
  28. Hi,

    Kindly assist on removing IP Address 196.45.145.164 which is currently listed in APEWS :-(
    Entry matching your Query: E-259539
    196.45.128.0/19

    ReplyDelete



  29. node808February 19, 2015 at 9:11 PM

    Remove 204.153.52.2
    We are a State Gov. agency. Your records show that we were blacklisted in July 2014 while none of the real blacklist sites had us listed. I believe someone maliciously added us to your list...probably due to its obscurity. Remove our IP ASAP!
    ReplyDelete

    ReplyDelete
  30. Hello,

    Can you remove the ip 177.159.144.68 from blacklist. We are a IT security enterprise in Brazil. I believe someone maliciously added us to your list...probably due to its obscurity.

    ReplyDelete
  31. Hello,
    Could you remove the IP 177.139.203.146
    E-520154
    177.128.0.0/9
    History: 2012-04-10

    ReplyDelete