[SOLVED] Spam

[fsoares]

Recently my server was listed in some Blacklists. I've requested them to delist it. But there are many companies blocking us yet and I don´t know how to find their blacklist system. I've searched spamhaus.org, proofpoint.com, mxtoolbox.com, spamcop.net, and many others.

The messages I receive are the following:

Aug 25 10:37:50 webmail2 postfix/smtp[6139]: 19406C538876: host mix.company.com[IP ADRESS HERE] refused to talk to me: 554-hou150mix1.company.com 554 200.189.106.129 rejected based on reputation.

Aug 25 17:28:41 webmail2 postfix/smtp[6610]: E63AEC538830: to=<Email@email.com.>, relay=mail4.company.com.br[IP ADDRESS HERE]:25, delay=0.62, delays=0.03/0/0.58/0, dsn=4.0.0, status=deferred (host mail4.company.com.br[IP ADRESS HERE] refused to talk to me: 554 mail.company.com.br)

5.7.1 Recipient not authorized, your IP has been found on a block list (in
reply to RCPT TO command)


Does anyone knows how to discover these RBLs?
Thank you!

[phoenix]

You'll have to ask the administrators of those mail server which RBLs they're using and why you've been blacklisted, there's no way to determine that from outside their server. Obviously you'll have to mail them from a non-blacklisted IP (or via a mail relay).

[ewilen]

You might try searching for your outbound SMTP IP address in

Cisco IronPort SenderBase Security Network
http://www.senderscore.org/
rbls.org
drbcheck: dr. Jrgen Mash's DNS database list checker
DECLUDE (Note: appears to be paid service; trials might be available.)
Email Blacklist Check - See if your server is blacklisted
RBL/DNSBL Lookup (Blacklist Lookup) for Mailserver
BLACKLISTALERT.ORG - Test if your IP or DOMAIN is listed in a spamdatabase
rbls.org

But you really can't know for sure unless the admins of the site tell you.

[fsoares]

Thank you all for the reply.

My server is under SPAM attack. Do you have some tips to find which account is infected? I trying to find something in /var/log/zimbra.log |grep smtpd

I've found something strange here, please see:
Aug 27 17:13:48 webmail2 postfix/smtpd[24140]: connect from unknown[190.193.230.222]


Do I have to block this IP address?
Thank you!

[ewilen]

I've seen some threads about looking for infected/compromised accounts. Try doing a search on the keywords spammer account.

[fsoares]

Gentlemen,

In the beggining I tried to change my firewall's IP, it worked for a while, then I requested the administrators to remove my IP from blacklists. Problem solved. thank you all!!