cvdmaten Posted August 17, 2004 Share Posted August 17, 2004 Our company's IP:193.67.3.99 has been listed on your Blacklist, but our business has been closed during the holidays. What can i do about it? or can we be removed from your listings? The problem occured while trying to send an email to en XS4All mailserver. While sending mails to other servers, there arent any problems... kind regards, C. van der Maten Link to comment Share on other sites More sharing options...
StevenUnderwood Posted August 17, 2004 Share Posted August 17, 2004 According to the web page lookup: http://www.spamcop.net/w3m?action=checkblock&ip=193.67.3.99 Causes of listing System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop) According to senderbase: http://www.senderbase.org/?searchBy=ipaddr...ing=193.67.3.99 Volume Statistics for this IP Magnitude Vol Change vs. Average Last day 3.7 3199% Last 30 days 3.2 1060% Average 2.2 You are currently sending large amounts of data from that machine. Any reports from people would be sent to: abuse<at>nl.uu.net so you may want to check with them. Since the web page reports that only spamtrap reports have caused the listing, you should email deputies<at>spamcop.net with a request for more information about your IP address. can we be removed from your listings? Listing and unlisting is automatic, but can be overridden by the deputies if needed. While sending mails to other servers, there arent any problems You will have problems sending messages to any server that utilizes the spamcop DNSBL. That seems to be the only major BL you are currently listed in, but that can change if the problem is not fixed quickly. Good luck and keep up informed as to your progress. We like to see spam stopped in all the various forms. Link to comment Share on other sites More sharing options...
Mikey Posted August 17, 2004 Share Posted August 17, 2004 Its listed on Passive spam Block List too. You can see some of the actual messages here: http://psbl.surriel.com/evidence?ip=193.67...=Check+evidence Link to comment Share on other sites More sharing options...
Chris Parker Posted August 17, 2004 Share Posted August 17, 2004 Our company's IP:193.67.3.99 has been listed on your Blacklist, but our business has been closed during the holidays. What can i do about it? Looks like an SMTP AUTH Hack to your Exchange server. You'll need to change the password for *every* account to something that is non-trivial. Disable any unused (ie guest) accounts. Disable SMTP AUTH if you do not have any employees that access their mail from outside your network. See the section under For people who are operating servers in the posted FAQ - Why Am I Blocked? FAQ, Please read before posting Link to comment Share on other sites More sharing options...
GraemeL Posted August 17, 2004 Share Posted August 17, 2004 Looks like an SMTP AUTH Hack to your Exchange server. You'll need to change the password for *every* account to something that is non-trivial. Disable any unused (ie guest) accounts. Disable SMTP AUTH if you do not have any employees that access their mail from outside your network. Also disable the info account. I got your server to relay for me using that ID. Link to comment Share on other sites More sharing options...
Ellen Posted August 17, 2004 Share Posted August 17, 2004 Our company's IP:193.67.3.99 has been listed on your Blacklist, but our business has been closed during the holidays. What can i do about it? or can we be removed from your listings? The problem occured while trying to send an email to en XS4All mailserver. While sending mails to other servers, there arent any problems... kind regards, C. van der Maten 15319[/snapback] Your exchange server is being exploited by spammers using the SMTP/AUTH exploit: http://news.spamcop.net/cgi-bin/fom?file=372 http://www.winnetmag.com/article/articleid/40507/40507.html http://www.winnetmag.com/article/articleid/42406/42406.html Received: from sbsdc01.gs.local ([193.67.3.99]) by killdeer (EarthLink SMTP Server) with ESMTP id 1bWXNG4KT3NZFlr0 for <x>; Mon, 16 Aug 2004 23:50:28 -0700 (PDT) Received: from exerting ([222.183.18.132]) by sbsdc01.gs.local with Microsoft SMTPSVC(5.0.2195.5329); Tue, 17 Aug 2004 08:47:41 +0200 Subject: D0ES SIZE REA||1Y MATTER ? Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.