Spambag and webmail

[Toreador]

Recently (in the last week or so) any email that I send by Webmail is picked up by spambag - a friend I regularly email has all spambag mails tagged at work rather than blocked. Emails I send via SMTP are fine.
Any ideas what I can do about this?

AFAIK Spambag works by having a blacklist of IP's which it tags or blocks. I assume the IP of NTL's webmail server has 'made it' onto the blacklist. All you can do is see if your friend can either arrange for it to be removed, or explicitly whitelist the webmail servers IP.

[Toreador]

How can I find out the IP address of the webmail server to see if this is the case?
My friend can't change anything, it's a work system. I'm more concerned that my emails might be getting blocked elsewhere that I don't know about.

Originally Posted by Toreador

How can I find out the IP address of the webmail server to see if this is the case?
My friend can't change anything, it's a work system. I'm more concerned that my emails might be getting blocked elsewhere that I don't know about.

I'll try & look into this a bit more when I get home from work, unless anyone else can offer any advice, in the meantime

[Toreador]

Cheers!

ok, back home

I sent myself an email from webmail & the IP displayed in the header was as follows

Return-Path: <*@ntlworld.com>
Received: from [10.137.100.64] by mta05-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20041026170232.HVFF28128.mta05-svc.ntlworld.com@[10.137.100.64]>
for <*@ntlworld.com>; Tue, 26 Oct 2004 18:02:32 +0100
X-Originating-IP: [62.254.0.*]
From: <*@ntlworld.com>
To: *@ntlworld.com
Subject: webmail
Date: Tue, 26 Oct 2004 17:06:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Message-Id: <20041026170232.HVFF28128.mta05-svc.ntlworld.com@[10.137.100.64]>

so you could maybe check that your friend is showing the same 10.137.100.64 - although that looks like a 'private' IP to me - I'm hovering just above 'out of my depth' here

[danielf]

Originally Posted by homealone

ok, back home

I sent myself an email from webmail & the IP displayed in the header was as follows

Return-Path: <*@ntlworld.com>
Received: from [10.137.100.64] by mta05-svc.ntlworld.com
(InterMail vM.4.01.03.37 201-229-121-137-20020806) with SMTP
id <20041026170232.HVFF28128.mta05-svc.ntlworld.com@[10.137.100.64]>
for <*@ntlworld.com>; Tue, 26 Oct 2004 18:02:32 +0100
X-Originating-IP: [62.254.0.*]
From: <*@ntlworld.com>
To: *@ntlworld.com
Subject: webmail
Date: Tue, 26 Oct 2004 17:06:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Message-Id: <20041026170232.HVFF28128.mta05-svc.ntlworld.com@[10.137.100.64]>

so you could maybe check that your friend is showing the same 10.137.100.64 - although that looks like a 'private' IP to me - I'm hovering just above 'out of my depth' here

I had a look at spambag.org, and that IP address is not blacklisted (they have a checker). One thing which occurred to me, could spambag not like the tag-line that is added to webmail (but not to smtp-mail)?

[Toreador]

OK I've been sent further info. Apparently the headers are:
...
X-BlackHole-Relay: 62.253.162.45
X-BlackHole-Match: RBL
X-BlackHole-Info: (level 3) blacklist.spambag.org

and 62.253.162.45 is listed on spambag as "backscatter2".

I have no idea what any of this means though :-(

aha

62.253.162.45 resolves to mta05-svc.ntlworld.com, which is the same as the 'received from' addy in the header for the message I sent myself.

As this is on the spambag blacklist, it looks like that is the problem.

- It may be that NTL will have to request removal of this IP from the blacklist

[Toreador]

Originally Posted by homealone

- It may be that NTL will have to request removal of this IP from the blacklist

I won't hold my breath then