Spam emails , SMTP got blacklisted why ?

zillah

Distinguished
Dec 24, 2005
212
1
18,680
Dear Experts

I have got a client who has a domain called : forum.com.nz (made it up) that is hosted by : APX Company (i.e. not his ISP provider).
Website designed by JDK Company not his hosting not his ISP provider.

Client internet provide is a nationalISP.

Client is using an outlook to retrieve mails for his domain (i.e. forum.com.nz)

POP3 : mail.forum.com.nz
SMTP : smtp.nationalips.com

Before the problem happened I realised there are a lot of spams flooding to his outlook.

All of a sudden the client called me that outgoing email stopped and when I tested his outlook there was an error message for the outgoing messages (not incoming), forgot what was that error.
Checked his public ip against mxtoolbox.com ,,,,,realized that it was blacklisted ,,,it took up to 73 hours to be relisted.

I want to understand the concept behind the problem; the reason for that before the problem of the spam hosting provider (APX company) told website designer company (JDK Company) that their security system caught suspicious codes.

My question if the spam emails are flooding via the hosting provider’s server (APX company) to the client email (my case is outlook),,,, why the outgoing SMTP (public ip address) for the ISP provider got blacklisted ? Is that because that ip address was used for incoming and outgoing emails ? If this is the case why outlook testing showing okay for incoming but not for outgoing ?

Regards
 
Solution
You can watch trends/email volume using this http://www.senderbase.org/home
I used DNSstuff.com, SenderBase and MXtoolbox everyday at the ISP I was responsible. The number one issue for complaints was getting black listed and then the blame game ensued. Using what I gave you I could ping point the issue in less than a couple of minutes... Remember the name SORBS and their shakedown method...you will learn a new meaning to the word hate if you get tagged by them. I had a mac user send out millions of emails over the weekend from a compromised machine....That was a bloodbath...and who said macs don't get viruses?

zillah

Distinguished
Dec 24, 2005
212
1
18,680

Thanks Hawkeye
Yes in 19.5.13 his computer got infected with virus and Trojan, and his outgoing email got blacklisted as well, and that makes since computer is sending spam, outgoing address would be blocked.

What I did , a fresh windows installation , installed a purchased internet security suite and I had asked for his ip to be delisted,,,,,and since then was working fine ,,,,,till the problem happened again on 26.6.13

Now when I checked the computer and scanned with different utilities for sure his computer is clean,,,,don't why this happened ?
 
I'd check to see if he somehow got on a blacklist again. Being on a blacklist doesn't prevent you from receiving email, only sending it. Also, any computer on your clients network can be infected and cause you to get blacklisted since every computer/device on thier network is probably NAT'd so the internet only sees one public IP address.
 

zillah

Distinguished
Dec 24, 2005
212
1
18,680

Not now.
But don't know it happened after I did a fresh installation for both PC, don't why !!!


Yes you are right , and it makes sense.


He has only 2 PCs and both of them are clean with purchased internet security (Yes I am aware it can't protect 100%)


Regards

 

Beachnative

Honorable
Jan 25, 2013
545
0
11,060
The problem could be is the mailserver can host multiple domains all from the same IP address and is a dumb way of setting up an ISP. If any one of the domains has one email account sending SPAM, all domans are tagged as sending spam due to only one IP address being used....been there fixed that.
 

zillah

Distinguished
Dec 24, 2005
212
1
18,680

Thanks Bachnative for your input
The ISP for the client is the first national ISP ,,,,,means if there are for instance 10 domains sharing the same ip address ,,,I would expect every few months the client's SMTP would be blacklisted
 

Beachnative

Honorable
Jan 25, 2013
545
0
11,060
You can watch trends/email volume using this http://www.senderbase.org/home
I used DNSstuff.com, SenderBase and MXtoolbox everyday at the ISP I was responsible. The number one issue for complaints was getting black listed and then the blame game ensued. Using what I gave you I could ping point the issue in less than a couple of minutes... Remember the name SORBS and their shakedown method...you will learn a new meaning to the word hate if you get tagged by them. I had a mac user send out millions of emails over the weekend from a compromised machine....That was a bloodbath...and who said macs don't get viruses?
 
Solution

Beachnative

Honorable
Jan 25, 2013
545
0
11,060
I would use MX toolbox's free monitoring service for a small operation. Contact the email hosting company and have them send a copy of all emails sent to one administrative account. Then look for the who is sending the most emails and to whom.