Subject: [Asrg] who is blockremovals.com

From: Markus Stumpf <[email-masked]>
Date: Tue, 10 May 2005 17:47:43 +0200

Today I came across
    blockremovals.com

Who are they?
Which "third party blocklists" do they handle removal requests for?
whois doesn't say much about them either, besides that they seem rather
new:
    Creation date: 12 Apr 2005 19:46:47

The message that was rejected was to  [email-masked]  and
looked like spam:
    May 10 09:08:07
      client-65-182-182-80.no-defined-ptr-record.siteshack.net:65.182.182.80
      allowed: <[email-masked]> to <[email-masked]>
and a lot of others of this type.

Some new trick/strategy of a spammer?

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matthew Elvey <[email-masked]>
Date: Tue, 10 May 2005 10:50:40 -0700

>Who are they?
Their whois contact info makes it clear that this question is unlikely 
to ever be answered, at least not without a court order.
   (all refer to Whois Privacy Protection Service, 
Inc/whoisprivacyprotect.com)

Nothing informative in google/google groups yet.

>Which "third party blocklists" do they handle removal requests for?
What MX bounced mail referring to blockremovals.com?  Looks like 
something its admins are trying to run.
Odd. I poked around a bit and I'm going out on a limb, but think it's 
some sort of C/R (Challenge/Response) system run by some not real 
clued-in folks.

Same 220 at both systems I checked:

>
> 220-We do not authorize the use of this system to transport unsolicited,
> 220 and/or bulk e-mail.
>
> 550-rejected because your email address sending from 66.98.148.43 is
> 550-blacklisted! Please visit 
> http://blockremovals.com/?ip=66.98.148.43 to be
> 550 removed.

DNSRBLs normally list IPs, and occasionally list domains.  If this one 
lists IP-email address pairs, it's the first, AFAIK (but reminds me of 
greylisting).
And yet the remove page is for removal of an IP.  Not a sign that this 
is going to be a wonderful new BL for folks to use.  Then again, the 550 
message comes from the refuser, not the BL.

---

From: John Levine <[email-masked]>
Date: 10 May 2005 18:20:34 -0000

>some sort of C/R (Challenge/Response) system run by some not real 

Looks that way.  No great loss.

220-resellercp.midwestwebhost.com ESMTP Exim 4.50 #1 Tue, 10 May 2005 13:17:00 -0500 
220-We do not authorize the use of this system to transport unsolicited, 
220 and/or bulk e-mail.
ehlo xuxa.iecc.com
250-resellercp.midwestwebhost.com Hello xuxa.iecc.com [208.31.42.42]
250-SIZE 52428800
250-PIPELINING
250-AUTH PLAIN LOGIN
250-STARTTLS
250 HELP
mail from:<[email-masked]>
250 OK
rcpt to:<[email-masked]>
550-"The recipient cannot be verified.  Please check all recipients of this
550 message to verify they are valid."
rcpt to:<[email-masked]>
550 Congratulations you just got your IP Permanently BLACKLISTED
Connection closed by foreign host.

(next try)

220-resellercp.midwestwebhost.com ESMTP Exim 4.50 #1 Tue, 10 May 2005 13:17:53 -0500 
220-We do not authorize the use of this system to transport unsolicited, 
220 and/or bulk e-mail.
ehlo xuxa.iecc.com
250-resellercp.midwestwebhost.com Hello xuxa.iecc.com [208.31.42.42]
250-SIZE 52428800
250-PIPELINING
250-AUTH PLAIN LOGIN
250-STARTTLS
250 HELP
mail from:<[email-masked]>
250 OK
rcpt to:<[email-masked]>
550 Your IP is BLACKLISTED because of your dictionary attack attempt
Connection closed by foreign host.