Spamhaus blacklist on 92.48.82.0/25

[OneApplications]

Hi all,

I noticed yesterday that a large number of emails I was sending were being returned with a Spamhaus SBL error. As it turns out, my IP (92.48.82.30) has been blacklisted. However looking at the listing on the Spamhaus site, the actual IP address is shown as 92.48.82.0/25. Does this mean that ALL IPs in the 92.48.82 range are blacklisted??

I've actually tried typing in a few IP addresses in that range into the Spamhaus site and all of them show the same blacklist listing!? How can a whole address range be blacklisted at once?

I have submitted a support ticket with eUK on this and they have sent a delist request but I'm a bit confused as to why the whole block of addresses appears to have been blacklisted.

Any help greatly appreciated.

Chris.

[OneApplications]

Just to follow on from that... I have tried a few other addresses in that range and it's not all addresses as previously thought but there are quite a few that are listed against SBL70971 for some reason??

[WelshTom]

Only addresses in the /25 notation are listed (Subnet mask: 255.255.255.128). I'll get the technicians to look into it.

[WelshTom]

Senior administrators are looking into the issue and will resolve it as soon as possible.

[JasonS]

Just to follow on from that... I have tried a few other addresses in that range and it's not all addresses as previously thought but there are quite a few that are listed against SBL70971 for some reason??

Hello Chris,

/25 is half the subnet i.e. 128 hosts, so any IP above 92.48.82.127 is not listed at SpamHaus. BTW, we have replied your ticket after further investigation. Please check the ticket and reply back if you would like us to proceed with the solution.

[OneApplications]

Thanks Jason. I have just replied to your email.

[eUKhost.com]

92.48.82.128/25 has been delisted by Spamhaus.

[jc8654]

Any idea what caused it to be listed in the first place?

[AlexP]

One customer from same subnet was sending spam emails which caused the 92.48.82.0/25 (/25 is half the subnet i.e. 128 hosts) subnet listed at SpamHaus. We have terminated server of that customer and request was sent to Spamhaus for removal of the subnet from their black list.

[jc8654]

Makes sense. I wasn't aware SpamHaus would block half of a subnet like that though. I thought it only did specific IPs.

[eUKhost.com]

Makes sense. I wasn't aware SpamHaus would block half of a subnet like that though. I thought it only did specific IPs.

Spamhaus can block whole subnet and if needed they can blacklist all subnets of a hosting company or ISP. One big colo provider from Canada had to shutdown his Business due to Spamhaus.

One should never ignore Spamhaus notifications as they can take any level of action to shutdown Spam Business.

[OneApplications]

Hi all,

Thanks for your help on this. The eUK support guys were very quick to sort this out for me so many thanks for that!!

I too didn't think that a blacklist could be applied to a whole IP block like that. I doesn't really make sense to me that if spam is being sent from xx.xx.xx.60 that you'd blacklist all addresses in the first half of that block!

Anyway, like has previously been mentioned, the blacklist record has now been removed so we're back in business... for now!!

[eUKhost.com]

Hi all,

Thanks for your help on this. The eUK support guys were very quick to sort this out for me so many thanks for that!!

I too didn't think that a blacklist could be applied to a whole IP block like that. I doesn't really make sense to me that if spam is being sent from xx.xx.xx.60 that you'd blacklist all addresses in the first half of that block!

Anyway, like has previously been mentioned, the blacklist record has now been removed so we're back in business... for now!!

Spamhaus will blacklist multiple IPs or subnet if they see more than 1 IP involved in Forgery or Spamming from that particular subnet. If you send same spam from xx.xx.xx.60, xx.xx.xx.90 and xx.xx.xx.120 then whole xx.xx.xx.0/128 will get blacklisted.