CBL Blacklisting

[benArrayx]

I've been dealing with EUK support for over a week now regarding the EUK email server being blacklisted by CBL
(http:// cbl.abuseat.org/lookup.cgi?ip=87.117.201.122)

Every time the admins remove the server from the blacklist, it comes back on again a few hours later. This is bad enough when I just have my email on the server, but when I move my clients to this server (which is my plan), it will be a nightmare.

Has anyone else had these problems? I was quite surprised not to see any posts on it here...

Cheers, Ben

[foxuk1]

Yes... I have had this problem.

I have not started to use the email fully (still moving everything over from my old email) but I did send an email to my wife (via webmail) who works at edinburgh uni.

My email came back to me saying somthing about being blacklisted!!!

Regards

paul

[eUKhost.com]

There's no outbound spamming going through this server but reason for its blacklisting is unjustified as we trust only spamcop.net listing and spamcop gives justification along with the headers of spams but other RBL's give no justification which makes it difficult for us to sort any problem with mailenable email server on windows.

Linux servers keep logs of all incoming and outgoing emails and we have custom scripts to keep our servers 100% spam free ( inbound and outbound ) but windows has got limitations and without any headers or justification from various RBL's besides spamcop makes things difficult for us.

We will stop filling tucano.eukhost.com in next 2 days as we are waiting for new servers which have been shipped from Dell last night.

[RichB]

Could you just swap the ip the mail server uses to send from?

I like the fact that can have windows hosting with php, makes things all in one place, but i feel that i might have to swap to a linux plan...

[eUKhost.com]

If you don't need MSSQL, MS ACCESS & ASP.NET then Linux Cpanel is the best option.

Swapping IP address of the mailserver wont be possible as we will need to change main IP address of the server. I will have a word with our Windows System Admins and figure out some solution for this problem but if there is any spammer on the server then he will be weeded out in next 2 days.

[RichB]

Humm.

I am a .net dev and do not really know php side of things, but currently do not need asp MSSQL Server at the moment, chose it in case i needed it in the future.

How easy would it be to swap to a linux plan and does it support payment features for ecommerce shops like zen cart?

Cheers

Rich

[Ryan]

Hi Rich,

You can switch to a linux shared plan from your existing windows shared plan. Please place a ticket/email at billing[@]eukhost.com with your account details and switch request.

Our linux hosting plans do support payment features for zen cart. Zen cart software is included in Fantastico.

[benArrayx]

hmm, I read the delisting instructions on CBL - they talk about the server being listed because it is a source of a virus or trojan etc - not because of spam. Have you checked this avenue?

Cheers, Ben

[eUKhost.com]

Hmmm.

I'll have someone to run antivirus software on the server. Not sure how they will do it but something should be worked out by tomorrow.

I'll keep you updated if we face any problem in cleaning virus attachments from the server.

[benArrayx]

Hi there - is there any update on this? The server still looks like it's getting blacklisted every day...

Cheers, Ben

PS. Here's a couple of snippets from the removals page:

"The CBL only lists IP addresses that are demonstrably infected by a mass mailing virus, or some sort of spam sending compromise (open proxy, trojan, spambot, insecure AnalogX/wingate etc).

The CBL does not detect or list open mail relays.

the CBL does not list an IP simply because it sends a lot of email, marketing or otherwise.

The CBL is strongly committed to detecting only compromised machines in a ethical, professional and responsible manner, and assisting in whatever way necessary to eradicate these compromises as quickly as possible."

"Virtually every CBL listing that causes legitimate email to be affected has something to do with a mass mailing virus, especially the Netsky, MyDoom/NOVARG, or Bagel/Beagle virus "families".

If you're reading this page, the cause is PROBABLY a virus, no matter how good your anti-virus tools are.

The second most likely reason for a CBL listing affecting legitimate email is an open proxy or spam sending trojan (or "bot"). "

There's also links to specific info on removing possible infections - please can you tell me your sysadmins are reading and implementing the guidance given here, rather than just requesting removal every day?

[eUKhost.com]

Hello David,

Right now the server is not listed in any of the RBL's

Please check www. dnsstuff.com/tools/ip4r.ch?ip=87.117.201.122

It has list of many RBL's and the server is not listed anywhere.

[eUKhost.com]

Forgot to mention that the problem was due to a virus on the server. We managed to get that removed and we've figure out how it came though we have active virus protection on the server.

Nothing to worry now as the server has got delisted from RBLs where it was previously listed.

[benArrayx]

Hi Mark, any updates on this? I noticing that the server is still having to be removed from the CBL list every day - for example if you look now, the last removal was at 2007-02-08 00:57 GMT (ie. yesterday).

I am very nervous of moving new customers to this server, as I'm not using my account on there much to send emails, but I know they will be, and even a few hours disruption because of a listing is going to cause problems - especially when it happens every day...

Cheers, Ben

[eUKhost.com]

Check this www. dnsstuff.com/tools/ip4r.ch?ip=87.117.201.122

This server is not listed anywhere and it never got blocked anywhere in last 5 days. We have completely sorted virus problem that was responsible for sending spams from server.

[Morledge]

Hi,

I tried to send an email and got "The IP Address of the sender (87.117.201.122) was found in a DNS blacklist database and was therefore refused".

Looks like this is still happening, could you have another virus???

Have a look on www. dnsstuff.com/tools/ip4r.ch?ip=87.117.201.122

I have gone through the process of removing it for now, but might be something worth looking into.

Cheers
Chris