Reply
Contributor
Posts: 17
Registered: ‎07-27-2003

Comcast IP's Blacklisted for Spam and DOS Attacks?

First, I apologize if this is not the correct forum for this issue.

I was surfing for information about a utility that I use with a game. Clicking on a link sent me to a page with the following message displayed:


Your user name or IP address has been blocked by SORBS DNSBL.

The reason given is this:
Your IP address is listed as an open proxy in the SORBS (http://www.sorbs.net) DNSBL.
You may contact SORBS DNSBL or one of the other administrators to discuss the block. Note that you may not use the "email this user" feature unless you have a valid email address registered in your user preferences. Your IP address is 68.83.xx.xx. Please include this address in any queries you make.



I went to the SORBS page and followed the link to the SORBS Support System. Eventually I got to a page that confirmed the blacklisting. It also showed that the IP range was listed with SPEWS as well:

http://www.spews.org/html/S2963.html

So, what can be done about this? I dont want my access to the web blocked because of idiots with zombie PC's.
Message was edited by: Anon18838
Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Is this your IP?
and it really belongs in the email, or possibly security forum..
TANSTAAFL!!



Email Expert
Posts: 18,241
Registered: ‎04-27-2004

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

They're not blocking that specific IP. If you look in the address list at the SPEWS page, you'll see that they're pretty much blocking ALL Comcast customer addresses, because there are so many spam zombies on Comcast.

This shouldn't be an issue unless you run a mailserver on your home computer. As long as you send your mail through Comcast's outgoing SMTP server, your IP doesn't connect directly to any site that makes use of this blacklist.
Contributor
Posts: 17
Registered: ‎07-27-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Yes, that was my IP, I've edited it out.

So far, I've found one website that blovks me from content because of this.
Contributor
Posts: 17
Registered: ‎07-27-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

I reposted this in the Security Forum.
Recognized Contributor
Laurie
Posts: 293
Registered: ‎07-10-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

my daughter had same problem she uses a site called xmbgarage for coding on her domain and she logged in one day to find out her ip was blocked and was sent to the spews site. i tried to change the ip but couldn't, couple of days later she was allowed back on.
Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Spews, as an antispam org... well it spews.. and Should never be used to block anything..

Now if I were being blocked a SpamHaus

(and I'm not)
24.0.xx.xx is not listed in the SBL

24.0.xx.xx is not listed in the XBL

I would be concerned..

But there is a problem, there appears to be several zombies in my IP block... Now in checking further it appears comcast has done something about this.. in the last 24 hours, all of them seem to have stopped..

Hopefully that is true for you folks as well. and thing should get better soon..
TANSTAAFL!!



Contributor
Posts: 17
Registered: ‎07-27-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Cajun,

How did you check for Zombies and know when something was done?
Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

http://www.senderbase.org can give you this information.

You can look at your IP and then in the block below you can find other similar IP's for example my IP is in the 24.x block, other IP's close to mine will be displayed there these will be the IP's with the highest send rate over the past month.. It also gives the last 24 hours.. The hint here is this.. One IP had increased over 900% for the last month.. But had send 0 mail for the last 24 hours.. (Usually a big hint that the Zombie has been stopped..)
TANSTAAFL!!



Networking Expert
kevj
Posts: 4,817
Registered: ‎10-03-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

So, CT, I'm guessing this might be bad.....

Senderbase Search

As in someone just got infected??

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I don't work for Comcast...


Help us to help you!!
- respond to requests for info
- post back if your issue is resolved
- mark appropriate posts as solutions


Send feedback to Comcast using the 'feedback' link on this page:
http://www.comcast.com/Corporate/Customers/CustomerGuarantee.html?SCRedirect=true

Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Oh yeah... that's not good.. But note there is about 70% of those that have been shut down.. See the last 24 hours..

and unfortunately that's several someones.. domino theory maybe..
Message was edited by: CajunTek
TANSTAAFL!!



Contributor
Posts: 17
Registered: ‎07-27-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Thanks Cajun
Networking Expert
kevj
Posts: 4,817
Registered: ‎10-03-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Looks like output over the last 24hrs for that address has increased wrt the last month...I guess it should be checked again in 24 hrs to see if it has been shut down?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I don't work for Comcast...


Help us to help you!!
- respond to requests for info
- post back if your issue is resolved
- mark appropriate posts as solutions


Send feedback to Comcast using the 'feedback' link on this page:
http://www.comcast.com/Corporate/Customers/CustomerGuarantee.html?SCRedirect=true

Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

It looks like, (from the, fortunately, much smaller numbers in my IP block) that these were shutdown day before yesterday as the 0 per day began for them yesterday and the average is decreasing

This one for example:

Volume Statistics for this IP
Magnitude Vol Change vs. Average
Last day 0.0 -100%
Last 30 days 4.1 742%
Average 3.2
TANSTAAFL!!



Networking Expert
kevj
Posts: 4,817
Registered: ‎10-03-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

One has to wonder....

a) do Comcast look at this (I'd have to guess at Yes to that)

b) What is involved in the process for taking one of these down. I would think it is a fairly long process of contact, repeated warnings, etc, before they can just axe someone's connection based on this info...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I don't work for Comcast...


Help us to help you!!
- respond to requests for info
- post back if your issue is resolved
- mark appropriate posts as solutions


Send feedback to Comcast using the 'feedback' link on this page:
http://www.comcast.com/Corporate/Customers/CustomerGuarantee.html?SCRedirect=true

Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Not really, I think they can put a port 25 block on an IP in about a second, (and not necessarily block the rest of their access...)
TANSTAAFL!!



Networking Expert
kevj
Posts: 4,817
Registered: ‎10-03-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

Sure, the actual config change takes a second...just wondering about the politics involved....

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I don't work for Comcast...


Help us to help you!!
- respond to requests for info
- post back if your issue is resolved
- mark appropriate posts as solutions


Send feedback to Comcast using the 'feedback' link on this page:
http://www.comcast.com/Corporate/Customers/CustomerGuarantee.html?SCRedirect=true

Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

With some of the complaints I've seen recently in the email forum about comcast's infamous port 25 block I think that comcast has been flipping the switch with regularity and without a second thought.. (as it absolutely.. must be!!)
TANSTAAFL!!



Contributor
Posts: 17
Registered: ‎07-27-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

I've e-mailed Comcast about this. So far I've received two form letter responses, neither actually addresses the issue.

I have to wonder what it takes to get someone to look into the blacklisting.
Security Expert
CajunTek
Posts: 20,976
Registered: ‎10-07-2003

Re: Comcast IP's Blacklisted for Spam and DOS Attacks?

The problem here is that they won't be able to get them unblocked until they get almost all of the spammers in those IP block cleaned up.. It's a bummer but many of these sites block by block of IP's not singe IPS
TANSTAAFL!!