What is rot.blackhole.cantv.net?
rot.blackhole.cantv.net is a list maintained by Cantv.net, that contains IP addresses from which our anti-virus have detected contaminated payloads in the recent past, or addresses in which we've detected vulnerabilities that might allow exploitation from a third party, which could endanger our own messaging platform.
The rest of this page answers questions that we frequently get. Please review the corresponding sections for additional information.
My mail bounces with a mention to rot.blackhole.cantv.net... Is there a problem?
- How did my IP address or my server's into rot.blackhole.cantv.net?
Can you provide some evidence showing the reason for listing?
My mail bounces with a mention to rot.blackhole.cantv.net... Is there a problem?
The computer that has connected to Cantv.net's mail servers to deliver your messages, has recently delivered other messages contaminated with viruses or worms to our network. Alternatively, your computer might be infected with a virus or worm that propagates itself through email.
Cantv.net has included your IP address in the list, because it recently originated a contaminated message that had to be neutralized by our anti-virus, which makes us incurr in processing and storage costs that our users prefer not to be burdened with.
If you're not the administrator of the computer that appears in our list, please ask him or her to get in touch with us in order to solve the problem.
We are not saying that you send spam or unwanted email. We are simply expressing our preference to not receiving email from IP addresses that have been recently associated with viral problem or security threats. This helps us employ less computational resources to fight against spam and virus.
If you're an end user and observe your mail bouncing, with a message referring you to this page, it is a good idea to notify your network administrator or your ISP about this, as usually this is one instance that can help you take actions to correct the problem.
Is my IP address listed in rot.blackhole.cantv.net?
It is very likely if you were referred to this page. To be sure, write the name or IP address of the host or mail server that you want to verify in all of our lists, in the space below.
Entries into this list, include a timestamp as well as the name of the virus or worm that we were able to identify in the message that originated the inclussion.
How did my IP address or that of my mail server, get into rot.blackhole.cantv.net?
Each time our anti-viral software catches a virus or worm in the mail sent to our networks, the source IP address from that message is automatically added to rot.blackhole.cantv.net. This avoids the repeated review of the messages that infected machines typically send, saving us processing resources.
Each half hour, we generate the list of machines that have sent virus or worms. This information if produced from the activity logs of the last four hours.
To improve the effectiveness of this process and saving further computational resources in our anti-viral platform, we also import similar lists that are maintained by other providers. Currently, we import information from the following public lists:
http://virbl.bit.nl/ is a list maintained by dutch ISPs, of virus and worms detected in a sample of their email.
Such a large ISP won't contact Cantv.net
The size of an ISP has no relation with its level of responsibility or the quality of its customer service. Cantv.net has received communications from ISPs with more and less users. Cantv.net also has served smaller ISPs, both with sending and receiving complaints.
The argument that "a large ISP won't talk to a smaller one" is self-imposed most of the time. When this is the effective answer from a customer service center, it is worth questioning wether the "big" ISP doesn't want to involve in the matter because it does not have the necessary controls or resources in place.
How do I get out of rot.blackhole.cantv.net?
Depending on the reason why you entered in rot.blackhole.cantv.net in the first place, you only need to let a reasonable time pass. This time rarely exceeds 24 hours after the last delivery of infected viruses. When the lookup response says so, the administrator in charge of the listed IP space must get in touch with us. We cannot make exceptions to this rule. For no reason.
Due to the way in which this list operates, it is imposible for us to manually delist an IP address faster. The administrator of your computers or mail servers must make sure that no virus or worms are hosted at your network, and then wait for the automatic delisting. Searching this list has a precission of less than 15 minutes tipically, and includes the name and exact time of the virus or worm found.
Even when we cannot delist you manually, we can make further arrangements to avoid you getting into the list again, Provided that you agree to all the following guidelines and policies
Your server provides service to end users, as in an ISP or a community service.
The IP address includes a IN PTR resource record or inverse, which makes it evidente to our only judgement, that this device is part of your mail server or you're willing to execute small changes that are recommended to the existing names, as requested by Cantv.net.
Your operations satisfies all of our terms of use of our services.
The interaction for the request of this consideration, happens through your postmaster@ address.
These conditions are subject at any time, without warning. Please understand that the real cause of the problem is not our listing, but the sending of virus, worms or other threats from the listed IP address.
Can you provide some evidence of the reason for listing?
All of the entries into our rot.blackhole.cantv.net that have been added by us, are backed by our activity logs.
Since the listings accessible through our lookup page contain the name of the virus and a very accurate timestamp, we believe this is the only information you should need to identify the source of the virus. Please investigate your own logs thoroughly before requesting evidence from us. Technically, we reject messages at the DATA phase or earlier, so we do not keep copies of the offending email or its headers.
If your IP address is found in rot.blackhole.cantv.net because of the inclussion of another list, you must direct yourself to that list for removal or information.
Can I use your list in my servers?
Cantv.net does not publish its lists or allow third parties to use them at this time.
