3

I help manage 178.32.51.182 and noticed we were getting bounced emails because of several blacklists those are:

  • CBL
  • FABELSOURCES
  • Spamhaus ZEN

so I checked the first blacklist here:

http://cbl.abuseat.org/lookup.cgi?ip=178.32.51.182

and it says "It shows signs of being infected with a spam sending trojan, malicious link or some other form of botnet."

I've run mailq to try and see if we are sending out bad emails on mass but I can't see anything spammy or infected in the queue just some emails that weren't sent because they are being blocked, what can I do to further investigate this?

  • Are you by any chance doing port forwarding to that mail server? My suspicion is that an infected machine sharing that external IP is to blame, not your mail server. – Katherine Villyard Jul 21 '15 at 0:51
  • the IP is dedicated and points to a container on our main server, it shouldn't be shared with anything else – arcanine Jul 21 '15 at 8:04
0

Our problem was caused by this script: https://github.com/hbattat/verifyEmail

edit for context:

I added the above script to our server to try and validate emails since we had so many bouncing emails, this script will go to the remote host check for mx records then try and interface with the email server and find out whether the specified email address exists

The script as it is, is poorly written and will trigger blacklists in particular CBL, this is one of many scripts I've seen that are trying this approach if you have this problem maybe your code base has something like this

  • 1
    Is this supposed to be an edit to your question, providing clarification or are you posting this as the solution? Either way some context around links is welcome! – HBruijn Aug 3 '15 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.