Spamhaus blocks me sometimes

[nullplan]

Hi all,

recently, I have been getting trouble posting replies, because my IP address is blocked by spamhaus. Funnily enough just retrying a few times has so far worked every time. They do list an IPv4 address as being blocked, and I wonder if sending on IPv6 (which my ISP thankfully also carries) remedies it.

Anyway, this is clearly a false positive. Can anyone do anything about it?

Ciao,
Markus

[iansjack]

If you are talking about posts here, it appears that you already access the site via an IPv6 address. The only people who can get Spamhaus blocks removed are the owners of the IP address or domain being blocked; ordinary mortals like you or I can't do it.

Blocks can be applied to whole domains, or IP ranges if a significant amount of spam is being sent from addresses in those ranges, not just a particular address. Unfortunately, the facts of life are that many domains in Eastern European countries, and Russia are used for spam (I don't know if this covers your situation). You can only contact your ISP to see if they can do anything. I'm assuming that you are not using a VPN - addresses associated with VPNs are often covered by the various blacklists. It's rare for Spamhaus to generate false positives within the parameters listed. If your address is in a banned block I appreciate that it's a false positive to you but Spamhaus is just, normally accurately, saying that because of general misuse you can't trust any address in this whole range of addresses.

I guess this site must use Spamhaus to filter out potential spammers. I'm more used to using it on mail servers, but I'm a long time out of active participation in the industry.

[nullplan]

If you are talking about posts here,

I am only now realizing that I never specified that, and somebody who never got a Spamhaus block message wouldn't know it. But yes, I am talking about replies on this site. Just before sending this OP, I had some trouble replying to the other topic I was in.

it appears that you already access the site via an IPv6 address.

Dual stack, as I said. Which one gets used is up to the whims of Firefox, or more likely, whatever address getaddrinfo() returns first.

Unfortunately, the facts of life are that many domains in Eastern European countries, and Russia are used for spam (I don't know if this covers your situation).

IP based geolocation services reliably place me in my native Germany. An IPv4 based one was uncomfortably close to home, but an IPv6 based one placed me in Gaildorf, which is an hour's train ride away. Mind you, I do not own the IPv4 address, and it is conceivable a company as big as Vodafone (my ISP) had a bad actor in their network.

It's rare for Spamhaus to generate false positives within the parameters listed.

In the age of DHCP, address based block lists are only as up to date as the address assignments.

I just got the message again, and it contains a link to more info. It seems someone using the IP address a couple of hours ago was infected with a spam-sending worm.

[iansjack]

Interesting. All of your entries in the moderator log seem to show an IPv6 address.

In the age of DHCP, address based block lists are only as up to date as the address assignments.

That’s why Spamhaus will lock ranges of addresses - they know there are sufficient bad actors in the range, enough to justify a block, but can’t rely on the addresses in that range staying the same. Spammers will use DHCP to try to avoid being blocked.