<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
I understand Lewis.
<br />
<br />I woke up to a customer complaining this morning about his domain customers not able to send e-mail. The server appears to be on a number of blacklists.
<br />
<br />A quick check of the server shows hundreds of messages in the mail queue, with 95% from one address. That was a easy clue. Flushed the queue (good and bad) and changed the password on the account. SPAM stopped.
<br />
<br />Then a search of the logs for "authid=<i>username</i>" - I found they were originating from two IP addresses, one in Poland and one here in US. Blocked both networks with IPTables - so scumbag can't start guessing passwords again.
<br />
<br />Now, the not so fun part - getting the server off the blacklists. And the question.... Spend the whole day tracking down which blacklists its on, and one at a time - submitting for removal? Or simply avoid that by changing the IP address of the server itself?? A lot quicker that way, but still a couple hours of work to get all the changes made in server, DNS, routers, etc... Hummmm.....
<br />
<br />
<br />Chuck
<br /><font size="2">
<br />
<br /><b>---------- Original Message
-----------</b>
<br />
From: Lewis Gardner <lewisg@iglou.com>
<br />
To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />
Sent: Thu, 28 Sep 2017 08:56:30 -0400
<br />
Subject: [BlueOnyx:21429] Re: localhost sending 14K emails in a month?
<br />
<br />>
Chuck,
<br />>
<br />>
Thanks for the quick reply!
<br />>
<br />>
I'm not sure about the exact mechanism that causes "backscatter" but
<br />>
that server's IP address has been blacklisted by Barracuda. After seeing
<br />>
this high a count I figured investigation was in order.
<br />>
<br />>
Need to get to the bottom of this and get off the blacklist.
<br />>
<br />>
Chuck Tetlow wrote:
<br />>
> Probably "backscatter".
<br />>
>
<br />>
> Someone sends a message to a random address on your server, and the
<br />>
> server send back a error reply if that username/e-mail address doesn't
<br />>
> exist. The addresses are compiled by using the book of names for
<br />>
> babies, and other lists - all trying to guess valid e-mail address
<br />>
> names. If it fails or bounces - no big deal to them. If it
works, then
<br />>
> they have a valid e-mail address they can sell for a few pennies.
<br />>
>
<br />>
> Unfortunately, in the meantime - your server is kept busy sending out
<br />>
> ridiculous numbers of error messages. And sometimes, can even get
<br />>
> blacklisted for all those error messages.
<br />>
>
<br />>
>
<br />>
> Chuck
<br />>
>
<br />>
>
<br />>
> *---------- Original Message -----------*
<br />>
> From: Lewis Gardner <lewisg@iglou.com>
<br />>
> To: BlueOnyx General Mailing List <blueonyx@mail.blueonyx.it>
<br />>
> Sent: Thu, 28 Sep 2017 00:01:17 -0400
<br />>
> Subject: [BlueOnyx:21425] localhost sending 14K emails in a month?
<br />>
>
<br />>
> > According to Usage Information, Email, Senders localhost on one
of my
<br />>
> > 5209R servers has sent 13,990 emails this month. Mostly during
one week
<br />>
> > and one other day.
<br />>
> >
<br />>
> > Is there any reasonable explanation for this behavior?
<br />>
> >
<br />>
> > What to do?
<br />>
> > _______________________________________________
<br />>
> > Blueonyx mailing list
<br />>
> > Blueonyx@mail.blueonyx.it
<br />>
> > <a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br />>
> *------- End of Original Message -------*
<br />>
>
<br />>
>
<br />>
> ------------------------------------------------------------------------
<br />>
>
<br />>
> _______________________________________________
<br />>
> Blueonyx mailing list
<br />>
> Blueonyx@mail.blueonyx.it
<br />>
> <a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@mail.blueonyx.it
<br />>
<a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx" target="_blank">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>