Nairn blacklisted.

[Drew]

Nairn was mail blacklisted the other day after the IP was reported for spamming an external mail source. After further investigation we found that the mail from Narin had been forwarded to the external email source via a catchall from one single account. That account was hit with a load of emails and then forwarded over 2000 high scoring spam emails to another free email account.

The terms and conditions clearly state.....

"Anyone caught using a catchall and then forwarding the results from that catchall to an external email account such as yahoomail,gmail,hotmail etc will have there account termintaed without warning."

This account in question has now been deleted. Not suspended nor just given a warning. We can only appologise to eveyone on Nairn who has had bounced 554 error emails the last few days because of this.

[hobwebs]

Are you not able to disable the Catchall feature?

[tam]

Are you not able to disable the Catchall feature?

some people use it

[hobwebs]

I used to use mine a lot till the first set of problems at Ariotek with the catchalls. It was a pain but I have managed to get along without it for a while now.

[kevlong]

Thanks for the update Drew. It's good to know what caused the problem. Can I assume that the receiving ISP's, issuing the following message,:

Your access to this mail system has been rejected due to the sending
MTA's poor reputation

Will once again accept emails from Nairn?

Thanks,

Kevlong

[Colin]

All mail systems should update in the next 24 hours I have notified all concerned that the outbreak has been stopped.

[dab]

Not sure if this is the fallout from the above problem or something new, but mail that was sending ok earlier on this evening is now being bounced.

Spamhaus says the Nairn IP is listed on CBL which in turn says

IP Address 78.129.134.15 is currently listed in the CBL.

It was detected at 2009-07-23 18:00 GMT (+/- 30 minutes), approximately 5 hours ago.

It has been relisted following a previous removal at 2009-07-22 09:30 GMT

ATTENTION: At the time of detection, this IP was infected with, or NATting for a computer infected with a high volume spam sending trojan - it is participating or facilitating a botnet sending spam or spreading virus/spam trojans.

ATTENTION: If you simply repeatedly remove this IP address from the CBL without correcting the problem, the CBL WILL eventually stop letting you delist it and you will have to contact us directly.


This detection is of the DarkMailer/YellSOFT DirectMailer Trojan.

[piersg]

Currently http://cbl.abuseat.org/lookup.cgi?ip=78.129.134.15 is showing the problem. If it's been resolved I've got a PDF of the current page available from the link below.

Interesting writeup about this. The first recommendation is harsh, blocking the direct upload of websites via FTP. I can appreciate the blocking of port 25 to all but the system mail process. I hope this can be stopped soon; whilst I'm not on Nairn, who knows which servers might be next?

http://www.bendystraw.co.uk/CBLLookupfor78.129.134.pdf (will be removed in a week or so)

[Drew]

Removed again, still fallout from the first block

[Ian]

Do you know roughly how long it may take before the situation is resolved, I have an outbox full of emails that keep getting rejected and I don't have another way of getting them through unfortunately.