Blacklisted IP ranges by UCEPROTECTL3
... / Blacklisted IP ranges by ...
< Previous question   -   Next question >
BMPCreated with Sketch.BMPZIPCreated with Sketch.ZIPXLSCreated with Sketch.XLSTXTCreated with Sketch.TXTPPTCreated with Sketch.PPTPNGCreated with Sketch.PNGPDFCreated with Sketch.PDFJPGCreated with Sketch.JPGGIFCreated with Sketch.GIFDOCCreated with Sketch.DOC Error Created with Sketch.
Question

Blacklisted IP ranges by UCEPROTECTL3

AL
by
Andy L1
Created on 2021-02-23 09:08:28 (edited on 2024-11-19 16:01:55) in Dedicated Servers

I have been facing issues with my email servers on OVH dedicated machines in both Canada and France.
It seems that there is a Swiss blacklist that is utilised by the likes of Microsoft (outlook, Hotmail, live etc etc) that is listing hoards of OVH's IP ranges.
This has a direct negative impact on individual IPs on dedicated servers, and others I would imagine.
OVH informs me (by ticket return) that we have two options; 1) use IPv6 for outgoing SMTP or 2) ask the email service providers (to whom our emails can no longer be sent) to desist their use of the UCEPROTECT blacklist.
According to UCE OVH is one of the ASNs that are not configured correctly to avoid spam throughput via their servers/network.

**Does anyone know how to set the SMTP out IP to work with IPv6? Because the second option is obviously pointless and it look like OVH is not going to buy their way out or alter their network accordingly!**

Here is an extract from their lookup page (http://www.uceprotect.net/en/rblcheck.php)


> What does it mean to be listed at the UCEPROTECT-Level 3?
> UCEPROTECT Network operates three levels of blacklisting, so our users can make the decision how strong they want to filter.
> While UCEPROTECT-Level 1 lists single IP's only, UCEPROTECT Level-2 escalates and lists dirty allocations.
> UCEPROTECT-Level 3 is the highest possible escalaion, complete Autonomus Systems (AS) get listed at Level 3 if there were too many Impacts from IP's listed in Level 1 originating from said AS counted within the last 7 days.
> If the provider harbours too many abusers and only has one ASN (Autonomus System Number) that logically means:
> All IP's of said provider get listed at Level 3 then.
> Click here to see the Policy for UCEPROTECT-Level 3
> While in fact UCEPROTECT-Level 3 is nothing than pure mathematics based on the Impacts from Level 1, one could best describe UCEPROTECT-Level 3 as a boycottlist.
>
> As you should know now: It is not you, it is your complete provider which got UCEPROTECT-Level 3 listed.
> Your IP 142.44.xxx.xx was NOT part of abusive action, but you are the one that has freely chosen your provider.
> By tolerating or ignoring that your provider doesn't care about abusers you are indirectly also supporting the global spam with your money.
> Seen from this point of view, you really shouldn't wonder about the consequences.
>
> Therefore we recommend:
> Please send a complaint to your provider and request they fix this problem immediatly.
> Think about this: You pay them so that you can use the Internet without problems;
>
> If they are ignoring your complaint or claiming they can't do anything, you should consider changing your provider.
> There are currently about 105,000 providers worldwide, but only a few hundred make it to get listed into UCEPROTECT-Level 3.
>
> According to the statistics measured against the mailflow of several national authorities in Germany, Austria and Switzerland, those few providers which often end up in our Level 3 are responsible for 50 - 75% of all global spam, while almost no real mail came from their networks and ranges.
>
> See: Inaccuracy and accuracy of UCEPROTECT-Level 3 during the last 4 weeks
>
> We often get to hear the argument:
> My provider is so hugh, and they have so many home users, it is almost impossible that they can create effective measures to prevent spam.
> This statement is simply wrong and an excellent good example for a large but clean provider is DTAG (ASN 3320):
>
> DTAG has about 34 million IP's and the majority of their customers are likely to be home users.
> In spite of this size you can nowadays see almost no spam from the DTAG address space.
> Let's see DTAG (ASN 3320) here.
>
> An even more stunning example for a large but clean provider is Microsoft (ASN 8075):
>
> Microsoft has about 37 million IP's and they are likely running Windows, which is a primary target for cybercriminals, due to its high distribution.
> In spite of this facts you can nowadays see almost no spam from the Microsoft address space.
> Let's see Microsoft (ASN 8075) here.
>
> The question must be: If big providers like DTAG and Microsoft can so effectively prevent that their customers are sending spam, why can your provider not also do so?
>
> The simple answer is: The Abuse Departements of providers NOT listed in our Level 3 are doing an excellent job, while those listed do not.
>
> If your provider really wants to stop the excessive abuse coming from their ranges they would simply install some preventive measures.
>
> This 4 little steps would make the difference - and could be done in less than one hour.
>
> Can't you make an exception for me?
> We never make exceptions. Requests are futile. Only your provider can fix this problem.
> Anyway our system respects IP's which are registered at ips.whitelisted.org, these are excluded from Level 3.
>
> How can my providers total IP-space be removed from UCEPROTECT-Level 3?
> After your provider has fixed those excessive problems, UCEPROTECT-Level 3 listing will be removed automatically and free of charge as soon as the causal Level 1 listings and with them their Impacts will expire and decrease below Level 3 escalation limit.
> Every IP temporary listed at Level 1 expires 7 days after we have seen the last abusive action originating from there.
> Automatic expiration is free of charge, because it does not require manual work.
> If your provider don't want to wait for free expiration, they can optionally order expedited express delisting, which is charged a total of for all IP's and ranges under their ASN.
> Orders for expedited express delisting are processed by external service providers, therfore it cannot be offered for free.
> Please note that payment is not a solution, but limiting abuse is.
> Therfore it is important that those excessive problems which have caused the listing at Level 3 are fixed in first place, otherwise your providers complete IP-space might end up in Level 3 again within a short timeframe.
Upvotes (2)
8643 Views
5 Replies ( Latest reply on 2024-12-02 08:16:59 by
junior femi
)
AL

Well, I don't know about you but I can't see why OVH cannot comply with the suggestions, would it affect a range of their customers? If so, are not those customers behaving in ways that are not acceptable to the standards outlined by UCEPROTECT?
I don't understand the view "we refuse to adjust our policies" when it seems that those policies clearly allow abusive behaviour on their network. Surely we all want a spam free world do we not? I am looking at moving away from OVH if they continue to drag me into their refusal to comply.
Helpful (0)
O

Update my side, attempted to spin up EC2 just as a mail-relay for outbound SMTP. However, they wouldn't lift the outbound TCP/25 restriction for my use case. Personal Email / Micro-Business email.
Helpful (0)

Same for me. For VPS and Dedicated IPs.
Helpful (0)
A

Same here. We need a solution for that.
Helpful (0)
AL

Its not you or your IP necessarily, its the entire block of IPs assigned to OVH, because OVH allows abuse of IPs within that block.
Helpful (0)
O

Hello EricR1.
Unfortunately paying for ips.whitelisted.org does not help the situation. My IP's on OVH are perfectly clean barring that L3 block. I've since paid for one month renewal on ips.whitelisted.org (just to test the waters) and it certainly makes it report back clean on mxtoolbox. However, Microsoft still outright block my connections from that IP address still, so I would advise - don't expect to pay for whitelisted.org and expect to be able to email Microsoft-based users.
I've since reached out to another company (Vultr.com) and expressed my issues with this block. They ban TCP/25 outbound by default but allowed me to open a support ticket with them, explained my situation and they allowed me to spin up a cheap VPS there for a mail relay.
So until OVH sort their stuff out - I guess I'll be a happy customer of Vultr just for relaying emails through a clean IP Address.

Amazon AWS outright declines requests to open TCP/25 outbound for anything other than large enterprises - and they also advise the use of AmazonSES first.
Azure do similar to above.

Hope this helps.
This is something OVH need to sort and I'd advise (if there is an OVH employee), incorporate a policy on outbound TCP/25 similar to Vultr. Get users to open a support ticket to open said port and explain their use case. Heck, even get some ID evidence or something to make them accountable to any spam they send!
Helpful (0)
M

I cannot seem to understand who is the vilan here and how us, customers can do about it.

Is it UCE who is trying to get delist payments or is OVH properly not taking care of their network?

I really need to take action because mail delivery issues hurts any business.

Moving away from OVH will result in triple the costs for the same VPS so it's not an easy decision.
Helpful (0)
L

I just came across this thread and how unfortunate this is. I was going to move my small DirectAdmin server to OVH but with UCE blacklisting OVH's ASN it's pretty much out of the question.

As I understand it, even paying to have a single IP address whitelisted won't fully workaround the issue with some large providers like Microsoft still blocking the incoming email, otherwise I would've done that. I see earlier on in this thread someone mentions replying to Microsoft's initial "not possible to mitigate" email, but I guess this isn't a guarantee that every genuine person will be able to get this resolved.

EDIT: Apparently not many places even use the UCE 3 blacklist as it's rather draconian (hope that's true), and Microsoft (for example) is a separate matter but again contacting them doesn't guarantee they will agree to remove you from their own blacklist - if you're on it.
Helpful (0)
A

We are facing the same problem. I have informed OVH but they simply don't seem to care if we go or not. Their last response is that nobody uses UCEPROTECT but all our clients are complaining and we are now standing the risk of losing clients.

Lewis, I would strongly suggest you don't make the move to OVH. You think Microsoft and Google don't but I think they do. Many of our emails to Microsoft and Google are being affected. Clients are constantly complaining with the threat of leaving and this has been a problem for nearly three months now.

We have now started looking at moving to other servers. We may not count as 1 client, but if together we inform OVH that we are leaving then they might get their act together.

I really do hope that they fix the issue soon.
Helpful (0)
A

are you still affected¿ please read my last message on this post. i want to create a group and take the matter up legally with OVH and UCEPROTECT. We are being ignored by both.
Helpful (0)
L

My IPv4 address range is still considered blacklisted by UCEPROTECTL3. I've not tried sending an email from my IPv4 address range yet though. I will soon.
Helpful (0)
J

I don't think OVH can do very much about it. The L3 blacklisting is really ridiculous IMHO. And of course never pay for this. What I do suggest is to write to Misrosoft support who I found was the only ones actually blocking based on these lists with some of their products (live.com, hotmail, ...). Make sure you do everything right on your end first of course (DNS, rDNS, SPF, DKIM, DMARC, etc.) and open a case with them typically via https://support.microsoft.com/supportrequestform/8ad563e3-288e-2a61-8122-3ba03d6b8d75 . You'll soon get an automatic reply that your IP address is NOT qualified for mitigation. Then reply to that mail and you should get a human in their support where you re-explain the same thing and kindly urge them to delist your /32 since it is clean and used for legit purposes. That usually does the trick. I know of no other mail service declining mail based on L3 entries...

Joris.
Helpful (0)
J

Hi AliP. I have left you a mail on the address indicated in the footer of your page.

Kind regards,

Joris.
Helpful (0)
M

Track and locate your parcel https://startracktracking.com/ live by tracking.
Helpful (0)
M

You can track and locate your parcel by 1https://tolltracking.com/https://tolltracking.com/ way to track.
Helpful (0)
K

OVH have been delisted, however I wouldn't be surprised if they will be listed once again.

Almost week ago, I reported client/bot who has VPS and several IP addresses from specific OVH subnet and uses them only for spam purposes.

OVH reaction? I don't see any.

At least abuser's mail server is still fine and continues to do damage and slowly ruins reputation of the entire subnet.

If OVH is unable to terminate one parasite and his VPS, I am afraid to think if they are able to do anything if there are more such people.
Helpful (0)
K

Let's face it, an L3 blacklist, especially at incidents level equal 0.05% of the number of IP addresses assigned to an ASN, is just as ridiculous as it sounds.

However, if OVH receives abuse reports describing obvious spammer that affects me and other customers at the L2 level and after a week the spammer is still fine, then something is really wrong.

When I was purchasing IP addresses, I accepted the terms and conditions, just like other customers, in which I commited to take care about addresses, and OVH commited to provide addresses that are not affected by blacklists.

I don't know, maybe it is time to change this agreement if OVH is unable to meet its terms.
Helpful (0)
K

L3, unfortunately, also applies to me and all clients :)
However, I did not check what is the real impact on the delivery of e-mails caused by L3 UCEPROTECT yet, but considering how many e-mail servers are configured by such experts that these servers allow obvious email spoofing despite SPF with hardfail, DKIM and DMARC with reject policy, I would not be surprised if there is some impact.

Do you have any experience with email delivery problems caused by this L3 blacklist?
Helpful (0)
L

So far I've only been going by what some people have said here. I've not tried it myself yet. I should know in the coming weeks whether it affects my personal email and some of my hosted customers though (fingers crossed there will be virtually no noticeable problems with deliverability). My current IP, not from OVH, in all the time I've had it has never been on the L3 blacklist.
Helpful (0)
K

Thank you very much for the advice about register in Microsoft's SNDS and Junk Mail Reporting Program.
However, when I added my IPs to the MS programs, I noticed that the status of all IPs is "Blocked due to user complaints or other evidence of spamming".
I found advise that I should request Microsoft to remove the addresses from the blacklist via form.

Is this advice correct or not? Is there anything else you could recommend that can help with email deliverability and IP reputation?

So far I preferred to keep my and my clients email mailboxes on external providers servers because I know the problems associated with maintaining the mail server, even though it cost more than dedicated server.
Unfortunately, clients are growing and no one wants to offer an email service anymore, so I was finally forced to move everything to dedicated server.
Helpful (0)
K

Yeah, I know about all the tips you mentioned.
That's why I bought entire IP block, not single IP - to be able to set my organization and abuse email, and so to be able to react quickly to any problem caused by my IPs.
Helpful (0)
W

Thank you for sharing this information with us also 1https://theapkhunter.com/gta-apk/https://theapkhunter.com/gta-apk/ GTA Apk
Helpful (0)
S

This information is appreciated; thank you for sharing it with us Regard: https://besttenniscompanion.com/best-tennis-racquet/ best tennis racquet
Helpful (0)
K

Nice.
Subnet 146.59.0.0/17 is on the L2 blacklists again and so one of my IP blocks.
Only one spammer with 9 IPs from this subnet managed to do this.
OVH completely ignored my 3 abuse reports describing this client, first sent 10 days ago, so the whole situation could've been prevented.

This time, subnet 51.83.0.0/16 hangs in the balance and the IP addresses I have from this subnet.
Similarly, abuse report from 5 days ago pass unnoticed and the spammer's server is still functioning.
In this case, only one IP was able to create such a mess for entire /16 block.

I remember that in the past I had practically only positive feelings about OVH services and now I don't know what happened to them, that level of their negligence so high.
Helpful (0)
L

Ouch!

The one I'm on, 198.244.128.0/17, has had 3 of 66 in the last 7 days at the moment. Usually it's 0 so that's a recent development somewhere in the last week.

That's the thing about OVH, generally they provide excellent servers and a good network, but when it comes to customer support you can often feel like you're on your own.
Helpful (0)
K

I personally wouldn't call abuse reporting "support" per se, as abuse reports can be sent by anyone, including those who are not OVH customers.
About customer support, I agree that basic level in OVH is insufficient even for a person who is able to handle the server on his own, because sometimes it takes a long time to get a reply to a ticket, but I accepted these conditions.

Abuse reports, on the other hand, should be handled with the highest priority as well as hardware or network failures.
Apparently something went wrong at OVH and they decided to stop maintaining the reputation they had earned.

Now I just feel awful that I was recommending OVH to people who asked where to buy a dedicated server ¯\\\_(ツ)_/¯

Not to mention that keeping a server whose main task is mail service/webhosting in a company that does not respond to abuse reports does not make any sense and it is just waste of money and time.

That's the biggest problem with the whole situation.
It's not spammers, it's not absurd blacklist limits or L2/L3 blacklists existence, but the OVH itself generate serious issues for me and other customers by not reacting to obvious, reported incidents.
Helpful (0)
L

Yeah I agree, abuse reports should be handled with great attention and care. If I ever received one or noticed an issue on one or more of my servers then I would act as soon as possible to remedy the situation. Besides, the one or two I've very rarely received from a different server provider a long time ago usually say something like "you have 24 hours to act or your server will be taken offline".
Helpful (0)
L

Ugh, that sucks.

Yeah I saw the L3 listing is back. I'm almost ready to migrate all my DirectAdmin sites to the IP address with OVH so that'll be interesting to see if I start getting complaints about emails not being sent due to being blocked, or perhaps instead marked as spam automatically.

The IP block I'm on still appears to be fine on L2 with no apparent further increases, so hopefully it'll go back to 0 shortly.

Although it's not particularly helpful I imagine, I will update this thread with my experience regarding DirectAdmin migration and emailing.
Helpful (0)
K

It's good to know, thanks for your effort :)
However, I still wonder, how to workaround my problem, because I don't want to deal with OVH incompetence and check every day if any IP has fallen into the L2 blacklist.

I would prefer some kind of smtp relay, but the price is based on the email volume.
The second option is some cheap VPS where I can set RevDNS and where outgoing port 25 is unlocked.

Do you know any proven solution to that?
Type of service, not specific company.
Helpful (0)
L

Understandable.

Unfortunately I've never worked with any SMTP relay service before so can't give any recommendations there. All I can suggest is to perhaps look around or ask on forums like WHT or LET, or alternatively perhaps if you find some services then see if there's been any feedback left by people on places like Trustpilot.

As for service, perhaps finding a cheap VPS provider who's not listed will work. Make sure you have the ability to change the RDNS of course, like you've mentioned already. Beyond that I don't have additional suggestions sadly.
Helpful (0)
O

If it helps, I went with Vultr.com.
I will remove this if someone says this isn't allowed, but if you do want to go through a referral code https://www.vultr.com/?ref=8814121-6G click here.

When I started having issues with OVH mail deliverability, I looked into Azure and AWS - but neither would allow the use of TCP/25 outbound unless you're a large corporate basically.

I opened an account with Vultr.com, span up the cheapest VPS they do and installed Postfix (actually ProxMox Mail Gateway, but it's all Postfix really). Then I opened a support ticket with Vultr and explained my reasoning for moving to them, explained the OVH L3 block and the type of email I wanted to relay. They then allowed TCP/25 outbound from my VPS after a quick reboot.

It's been working great ever since Mar 22 as per my older post on this forum.

So I would personally recommend Vultr for mail relay, and keep other things hosted at OVH for cost (such as websites, etc). That's what I've done anyway.

Oliver
Helpful (0)
J

You can search the name of your favorite game and download easily now. https://pswapk.com/tom-and-jerry blackmart pro apk
Helpful (0)
M

hey how can https://www.olansichina.com I unblock website that is hosted at OVH..?
Helpful (0)
L

Sigh, so I see.

Well I've not had any complaints about email deliverability issues yet, but if I do then I may have to consider swapping to Voxility. At least their IP ranges remain fine on level 3. I'd rather not though as I'd pay a moderate yearly charge for an IP range from them, compared to OVH which is currently a one-time charge.
Helpful (0)
S

Hello !
i think it happens again ?
UCEPROTECT-Level3
Reputation of ASN 16276 | OVH, FR
AS Status Spamscore Provider has
total IP's Level 1 listed abusers
within the last 7 days Impacts from Level 1 Level 3 Escalation limit by Impacts
Optional express delisting
WARNING!
PROBLEM MUST BE FIXED FIRST
TO PREVENT NEW LISTINGS
16276 LISTED
57.8

4008704

596

2316


2004
Helpful (0)
M

Sorry guys, I ask for a clarification.
I have a VPS on OVH.
I send emails via AWS SES and all emails on Yahoo and Outlook go into spam.

Can it always be a UCEPROTECTL3 issue?
Helpful (0)
C

Hello MarikaF yes it is UCEPROTECTL3 issue, OVH ASN (AS16276) is listed there, we have around 60 dedicated IP's in our dedicated server and we are also facing that problems. I've checked ovh.pt and ovh.com IP's and nboth of them are also blocked. Here is the link that OVH sent us in reply to our ticked with the information that they do not pay to be unlisted and that we have to wait http://www.uceprotect.net/en/l3charts.php http://stats.uceprotect.net/?page=su
Helpful (0)
W

UCEPROTECTL3 is a scam. It blacklists ranges and ranges of IP Addresses to get paid to (temporarily) unlist you.
Professional should not use UCEPROTECTL3 for spam filtering. It's not serious.
https://www.inmotionhosting.com/support/news/uceprotect-rbl-scam/
Helpful (0)
N

Whatever. Problem still here. I cannot even send email verification email to clients when they register on my VPS self-hosted website application, that it doesn't reach and ends up in spam folder. Of course clients complaint and I lose leads & revenue.

Very very bad. Put together this with the servers-on-fire without disaster-recovery and backups in the same building (and a delightful refund voucher of €20 for 1 month downtime), and the fact that here no one of them appears (cannot understand what's this forum for)... I fear that after many years this troublesome partnership might come to an end.
Helpful (0)
P

There on the List again I've just migrated to OVH.
Im really not happy.
Thinking of moving straight back after reading all of this.
Helpful (0)
J

Any help with this?

Hi, I have a brand-new IP from my service provider HOSTWINDS, unfortunately, this brand-new IP number appears to be blacklisted by OVH (adr@adr-productions.fr: said: 550 5.7.1
Hostwinds range blocked for spam (YOUMAOVH) (in reply to end of DATA
command)
and unlike any other delisting request, I find no way to submit delisting request, and my service provider, Hostwinds, is in the same boat. For the purposes of clarity, let me repeat, I AM NOT AN OVH USER - but my emails (so far about 50) are being systematically bounced by OVH. How and where do I or Hostwinds submit delisting request? Thanks. Jonathan
Helpful (0)
L

UCEPROTECTL3 is a well-known blacklist that monitors and lists IP addresses associated with email servers. If an IP address or a range of IP addresses is flagged by UCEPROTECTL3, it indicates that the IP has been identified as a source of spam or other malicious activities, typically because it's part of a larger network (an Autonomous System or AS) with a poor reputation.
Helpful (0)
JF

 

UCEPROTECTL3 is a widely used blacklist that identifies IP ranges associated with high levels of spam or malicious activity. When an IP range is blacklisted by UCEPROTECTL3, emails originating from that range are likely to be flagged as spam or blocked by receiving mail servers. Today Kfc Menu with prices
Helpful (0)

Join discussion