MoonPoint Support Logo

 


Shop Amazon Warehouse Deals - Deep Discounts on Open-box and Used ProductsAmazon Warehouse Deals



Advanced Search
April
Sun Mon Tue Wed Thu Fri Sat
22 23 24 25 26 27 28
29 30          
2018
Months
AprMay Jun
Jul Aug Sep
Oct Nov Dec


Fri, Mar 30, 2018 10:23 pm

Cloudmark CSI IP Reputation Remediation

I manage an email server that uses an Atlantic Broadband SMTP server as a smart host. I maintain a mailing list on the server that currently has about 1,300 email addresses. Each month someone sends a monthly newsletter to the email addresses in that list; the people associated with those addresses are all members of a retirees organization and have all indicated they wish to receive that organization's newsletter. Usually, the newsletter is transmitted without problems, but occasionally I will find that email transmitted from the server is silently discarded with no bounced emai indicating why that is occurring. Though that doesn't occur often, when it occurs, it usually occurs when the newsletter is sent. When the problem occurs, as it did yesterday, I have to request that the IP address of my server be unblocked. Initially, I would call the ISP's phone support number, i.e, an Atlantic Broadband support number, but they would in turn have to contact their email service provider, since the email service they provide is outsourced to Echo Labs as I found from examining email headers - see Email sent via an Atlantic Broadband SMTP server not being delivered. But I found that I could get the block removed more quickly if I submitted a request through Cloudmark, an anti-spam company co-founded by Vipul Ved Prakash and Napster's co-founder Jordan Ritter, which provides an anti-spam service used by Echo Labs.

[ More Info ]

[/network/email/spam/blocklists] permanent link

Fri, Jun 03, 2016 10:41 pm

Email sent via an Atlantic Broadband SMTP server not being delivered

I received a report from a couple of users that email they were sending wasn't being delivered to recipients, though they weren't receiving any bounced messages or any indication that their email was not being delivered. Their email clients were sending email to smtp.atlanticbb.net. When I sent email from the same IP address to that Atlantic Broadband Simple Mail Transfer Protocol (SMTP) server addressed to several email accounts I maintain for email troubleshooting on a number of free email services, such as Gmail, none of them reached their destinations, even though as far as the email client was concered, they were successfully delivered to the Atlantic Broadband SMTP server.

Examining the message headers from an email sent from a tech support person at Atlantic Broadband, whom I contacted on June 1 regarding the problem, to my Gmail account (see Viewing message headers in Gmail), I learned that Atlantic Broadband uses Echo Labs to handle their email. I saw the following in the message headers:

Received: from cluster1.echolabs.net (mail.atlanticbb.net. [38.111.141.32])
        by mx.google.com with ESMTP id l144si10145927ybf.89.2016.06.01.19.40.53

[ More Info ]

[/network/email/spam/blocklists] permanent link

Wed, Apr 08, 2009 10:48 pm

Swinog DNSRBL

I added the Swinog DNSRBL to the list of DNS Blacklists (DNSBLs) that I have sendmail check on my email server. To do so, I added FEATURE(`dnsbl',`dnsrbl.swinog.ch',`550 Spam Block: mail from $&{client_addr} refused - see http://antispam.imp.ch/spamikaze/remove.php')dnl to /etc/mail/sendmail.mc. I now have the following DNSBLs listed in that file:
FEATURE(`blacklist_recipients')dnl
FEATURE(`dnsbl', `bl.csma.biz', `550 Spam Block: mail from $&{client_addr} refused - See http://bl.csma.biz/')dnl
FEATURE(`dnsbl', `sbl.spamhaus.org', `550 Spam Block: mail from $&{client_addr} refused - See http://www.spamhaus.org/sbl/')dnl
FEATURE(`dnsbl', `psbl.surriel.com', `550 Spam Block: mail from $&{client_addr} refused - see http://psbl.surriel.com/')dnl
FEATURE(`dnsbl',`dnsbl.sorbs.net',`550 Spam Block: mail from $&{client_addr} refused - see http://dnsbl.sorbs.net/')dnl
FEATURE(`dnsbl',`dnsrbl.swinog.ch',`550 Spam Block: mail from $&{client_addr} refused - see http://antispam.imp.ch/spamikaze/remove.php')dnl

After adding the entry for the Swinog RBL, I generated a sendmail.cf file from sendmail.mc and restarted sendmail.

# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
# /etc/init.d/sendmail restart

I checked /var/log/maillog just moments after adding that blacklist and found it had blocked spam:

# grep 'antispam.imp.ch' /var/log/maillog
Apr  8 21:16:57 frostdragon sendmail[15676]: n391GuGi015676: ruleset=check_rcpt,
 arg1=<broderbundxxxxxx@moonpoint.com>, relay=65-75-229-245.dsl.ctcn.net [65.75.
229.245] (may be forged), reject=550 5.7.1 <broderbundxxxxxx@moonpoint.com>... S
pam Block:mail from 65.75.229.245 refused - see http://antispam.imp.ch/spamikaze
/remove.php

The Swinog DNSBL blocked email to an email address that I used on December 8, 2004 when I registered software with Brøderbund Software. I never used the email for any other purpose. Usually, when I'm providing an email address to any company, I don't use my primary email address, but instead create an alias for that address that points to my primary email address. So, if I start getting a lot of spam addressed to the alias, I can just invalidate the alias. And, since the aliases I create are not ones a spammer would use if the spammer was employing a name dictionary attack, i.e. guessing likekly names, I know that the company has provided the email address I gave them to a spammer. So I know the spammer got the address above, which I've changed for any spam spiders that may crawl across this page, from Brøderbund Software or one of the companies that subsequently owned Brøderbund Software.

The Wikipedia article on the company at Brøderbund lists the following history of corporate ownership for Brøderbund.

Brøderbund was purchased by The Learning Company in 1998 for about USD$420 million in stock. Ironically, Brøderbund had initially attempted to purchase the original The Learning Company in 1995, but was outbid by Softkey, who purchased The Learning Company for $606 million in cash and then adopted its name. In a move to rationalize costs, The Learning Company promptly terminated 500 employees at Brøderbund the same year, representing 42% of the company's workforce. Then in 1999 the combined company was bought by Mattel for $3.6 billion. Mattel reeled from the financial impact of this transaction, and Jill Barad, the CEO, ended up being forced out in a climate of investor outrage. Mattel then gave away The Learning Company in September 2000 to Gores Technology Group, a private acquisitions firm, for a share of whatever Gores could obtain by selling the company. In 2001, Gores sold The Learning Company's entertainment holdings to Ubisoft, and most of the other holdings, including the Brøderbund name, to Irish company Riverdeep. Currently, all of Brøderbund's games, such as the Myst series, are published by Ubisoft.

I suspect that it wasn't just my email address that was sold to spammers. Probably Brøderbund's entire mailing list was sold by either Brøderbund or one of the companies that acquired it, though, of course there is a possibility it could just have been an employee of one of the companies trying to make some easy cash or one who was losing a job as his or her company was acquired by another company, who could have been looking to compensate for lost wages.

The address is still being used by spammers over four years later, even though the address has probably not been valid for over a year. Unfortunately, I don't remember when I first started getting spam addressed to that email address.

After having a hernia operation recently, I noticed I've been getting spam on a fairly regular basis suggesting I might want to use the legal services mentioned in the spam if I wanted to sue for any problems related to the patch used in the surgery. I don't remember seeing any of this type of message previously, though it's possible that I might have received such messages, but they never registered in my consciousness then as I deleted spam. But I'm wondering now if someone at the office of the doctor who performed the surgery sold my email address. I believe I did put my primary email address on a form I filled out at the doctor's office. If I had used an alias, I would know for certain, if that was the case.

[/network/email/spam/blocklists] permanent link

Sun, Jun 10, 2007 9:27 pm

Email From 166.102.165.166 and 65.54.246.172 Rejected

A family member reported that someone who had tried to send email to her received a bounced message indicating the email was blocked because of antispam provisions. I checked all email from the sender's email address using the find-recipients Perl script I created for such purposes. I saw that one message she sent was rejected and one accepted.

# ./find-recipients.pl wendyvi21@alltel.net /var/log/maillog
Found 2 messages from wendyvi21@alltel.net in /var/log/maillog

Message recipients

Time            Message ID     Status        Recipient
----------------------------------------------------------------
Jun 10 07:58:02 l5ABupmb001042 Rejected      kittycat321@moonpoint.com
Jun 10 08:05:03 l5AC3omb001081 Sent          kittycat321@moonpoint.com

When I checked the /var/log/maillog file for those two message IDs, I found that the first message had been blocked by the Spam and Open-Relay Blocking System (SORBS) blocklist. SORBS is a DNS Blacklist (DNSBL).

The message that was rejected was from ispmxmta05-srv.windstream.net [166.102.165.166], while the one that was accepted was from ispmxmta09-srv.windstream.net [166.102.165.170].

When I checked the SORBS list, it appeared that the 166.102.165.166 had been there for at least a week due to SORBS detecting spam orginating from the email server at that address.

Database of servers sending to spamtrap addresses
Address:166.102.165.166
Record Created:Tue Apr 17 01:00:04 2007 GMT
Record Updated:Mon Jun 4 01:00:03 2007 GMT
Additional Information: [ Updated via: Spam 'o Matic ] Received: from ispmxmta05-srv.windstream.net (ispmxmta05-srv.windstream.net [166.102.165.166]) by desperado.sorbs.net (Postfix) with ESMTP id EE4311144D for <[email]>; Mon[email] 04 Jun 2007 10:40:27 +1000 (EST)
Currently active and flagged to be published in DNS

But when I looked up the other IP address, 166.102.165.170, it appeared it was also in the SORBS blocklist.

Database of servers sending to spamtrap addresses
Address:166.102.165.170
Record Created:Tue Oct 4 13:04:20 2005 GMT
Record Updated:Thu Apr 26 04:41:17 2007 GMT
Additional Information: Received: from ispmxmta09-srv.windstream.net (ispmxmta09-srv.windstream.net [166.102.165.170]) by desperado.sorbs.net (Postfix) with ESMTP id 69DC21143A for <[email]>; Sat[email] 10 Feb 2007 13:52:40 +1000 (EST)
Currently active and flagged to be published in DNS

When I queried the SORBS database through the SORBS Database Lookup webpage, it appeared both addresses were present in the SORBS blocklist, yet when I used blq to query the SORBS blocklist, I found only the first .166 address listed and not the .170 address, which was consistent with Sendmail's rejection of the first message, but not the second one.

# ./blq sorbs 166.102.165.166
166.102.165.166 ispmxmta05-srv.windstream.net : dnsbl.sorbs.net : BLOCKED
# ./blq sorbs 166.102.165.170
166.102.165.170 ispmxmta09-srv.windstream.net : dnsbl.sorbs.net : ok

I received another report from a Hotmail sender that she was finding email rejected as well. I went through the same process as above. Again the SORBS website database query seemed to indicate that both addresses would be blocked, but using blq showed only one was blocked, which matched the entries I found in today's maillog file with the first message from the sender being rejected and the second accepted. The first was from bay0-omc2-s36.bay0.hotmail.com [65.54.246.172] and the second from bay0-omc2-s37.bay0.hotmail.com [65.54.246.173].

When performing a database check via the website, I saw the following for the IP address from which a message was rejected:

Database of servers sending to spamtrap addresses
Address:65.54.246.172
Record Created:Thu Aug 3 02:30:03 2006 GMT
Record Updated:Sat Jun 9 09:00:04 2007 GMT
Additional Information: [ Updated via: Spam 'o Matic ] Received: from bay0-omc2-s36.bay0.hotmail.com (bay0-omc2-s36.bay0.hotmail.com [65.54.246.172]) by desperado.sorbs.net (Postfix) with ESMTP id 7EE241147D for <[email]>; Sat, 09 Jun 2007 18:33:28 +1000 (EST)
Currently active and flagged to be published in DNS

But I also saw the following for the IP address of the server from which a message was accepted:

Database of servers sending to spamtrap addresses
Address:65.54.246.173
Record Created:Fri Aug 4 13:53:11 2006 GMT
Record Updated:Sat Mar 3 08:00:34 2007 GMT
Additional Information: [ Updated via: Spam 'o Matic ] Received: from bay0-omc2-s37.bay0.hotmail.com (bay0-omc2-s37.bay0.hotmail.com [65.54.246.173]) by desperado.sorbs.net (Postfix) with ESMTP id 8E17F114AE for <[email]>; Wed, 28 Feb 2007 21:44:25 +1000 (EST)
Currently active and flagged to be published in DNS

Again, the information returned didn't seem to be consisttent with what a blq query returned:

# ./blq sorbs 65.54.246.172
65.54.246.172 bay0-omc2-s36.bay0.hotmail.com : dnsbl.sorbs.net : BLOCKED
# ./blq sorbs 65.54.246.173
65.54.246.173 bay0-omc2-s37.bay0.hotmail.com : dnsbl.sorbs.net : ok

So the results I obtained through the website query don't seem to accurately reflect what will be blocked, if I interpret seeing "Currently active and flagged to be published in DNS" appearing in a red block as an indication the address is in the blocklist as one to be blocked.

[/network/email/spam/blocklists] permanent link

Sat, Feb 18, 2006 10:12 am

Spam from 211.32.91.234

Looking through email logs for this week, I noticed someone attempted to send email from IP address 211.32.91.234 to an email list on the system that I invalidated over a month ago. The email was coming from an IP address that appears to belong to a South Korean Internet Service Provider (ISP), which was suspicious, sine the address was only supposed to be known by 4 to 5 people in an office of an organization in the U.S. The office was closed down at the end of last year.

The email was blocked because the sending IP address was on a blacklist that I use to curtail spam coming into the email server. When I checked the IP address against other blacklists, I found it was present on several lists. The system may be running an open SOCKS proxy service.

[ More Info ]

[/network/email/spam/blocklists] permanent link

Sat, Feb 11, 2006 12:36 pm

Passive Spam Block List (PSBL) Added

I added the Passive Spam Block List (PSBL) to the spam blacklists I employ on my email server. I now am using six different blacklists on the system to combat spam. The ones I'm now using are as follows:

Blitzed Open Proxy Monitor List
Open Relay Database
Composite Block List (CBL)
McFadden Associates E-Mail Blacklist
Spam and Open Relay Blocking System (SORBS)
Passive Spam Block List (PSBL)

To add the PSBL to the blacklists queried by sendmail, I added the following line to /etc/mail/sendmail.mc.

FEATURE(`dnsbl', `psbl.surriel.com', `"550 Mail from " $`'&{client_addr} " refused - see http://psbl.surriel.com/"')dnl

I then regenerated the sendmail.cf file from the sendmail.mc file and restarted sendmail with the commands below.

m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
/etc/init.d/sendmail restart

[/network/email/spam/blocklists] permanent link

Thu, Feb 09, 2006 11:24 pm

Why Is Email From a Hotmail.Com or MSN.Com Account Rejected?

I have received reports from three users recently that email addressed to the users from either a hotmail.com or msn.com email address is not getting through. The reason is that the hotmail.com servers, which handle email from hotmail.com and msn.com accounts, are currently on the SORBS blacklist.

[ More Info ]

[/network/email/spam/blocklists] permanent link

Tue, Feb 07, 2006 10:05 pm

Lists of Blacklists

One way to combat spam at the email server level is to use blacklists, aka blocklists, which are lists of IP addresses of systems known to regularly transmit spam or at least to have recently transmitted spam. Various organizations and companies throughout the Internet create their own lists and then, frequently, to help other email server administrators combat spam, will provide access to those lists to others on a real-time basis.

To find out whether your IP address is on such a list or to see what lists you might use for your own email server, I've created a list of sites that provide links to multiple blocklists from one webpage and also my own list of sites.

[/network/email/spam/blocklists] permanent link

Mon, Feb 06, 2006 6:31 pm

SORBS Blocking Hotmail.Com and MSN.Com Email

I had reports from two users who were informed by inviduals using hotmail.com and msn.com addresses that mail was being rejected when sent to the users. The senders were not able to provide me with the reason for the email being rejected. When I used my own hotmail.com test account, I discovered that was because Hotmail hides that informaton from the Hotmail account holder by default, but Hotmail's settings can be changed to reveal the reason a message is rejected.

When I used my own test account, I found that email from hotmail.com and msn.com accounts was being rejected because the hotmail.com email servers are on a SORBS blocklist.

I resolved the problem by adding the relevant hotmail.com and msn.com email addresses to sendmail's /etc/mail/access file.

[ More Info ]

[/network/email/spam/blocklists] permanent link

Once You Know, You Newegg AliExpress by Alibaba.com

Shop Amazon Local - Subscribe to Deals in Your Neighborhood

Valid HTML 4.01 Transitional

Privacy Policy   Contact

Blosxom logo