Jump to content

[Resolved] Spam traps help


br53
 Share

Recommended Posts

Hi,

Our server is listed due to spam traps: http://www.spamcop.net/bl.shtml?210.9.130.146

I've since made changes so that we don't accept messages and then bounce back delivery failures. But this morning when we were due to be automatically delisted, it's back to 23 hours.

I've used the form to contact Spamcop already, but it's becoming quite urgent so I'm posting here too.

Any help is appreciated.

Thanks

Josh

Link to comment
Share on other sites

Sender base shows an unusual increase in trafic recently:

Report on IP address: 210.9.130.146

Volume Statistics for this IP

Magnitude Vol Change vs. Average

Last day 4.0 404%

Last 30 days 2.9 -64%

Average 3.3

I, however, cannot find any reported history that would shed some light on this. If you already wrote to the deputies, patience is golden, and I am sure you'll be able to resolve your issue. Please let us know.

Link to comment
Share on other sites

If the volume is up, that can mean a compromised machine that does not use the normal port 25 to send the spew. Check your firewall logs for unusual traffic.

and the PSBL evidence shows real fresh spam rather than bounces, which also suggests either a trojanned machine or an SMPT-AUTH hack, rather than the problem being simply auto-replies.

There is also now one human report to add to the spamtrap hits:

Submitted: 08 September 2006 08:11:27 +0100:

Fwd:

* 1912415028 ( 210.9.130.146 ) To: abuse[at]connect.com.au

(which will have reset the delist clock)

looks like the reports are going to your upstream, you might discuss with them getting copies of the reports or registering your own abuse address. It seems you have a real 'live' problem to deal with here, things seem to be going from bad to worse.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...