0

My server is getting the following warning when sending email

SMTP error from remote mail server after initial connection: 554 p3plibsmtp01-04.prod.phx3.secureserver.net bizsmtp IB103. Connection refused. 162.144.132.### has a poor reputation on Cloudmark Sender Intelligence (CSI). Please visit http:/

I emailed them to find out why it was listed and this is what they sent me:

  Return-path: <[email protected]>
    Received: from server.mydomain.com ([162.144.132.###])
     by redacted
     (Oracle Communications Messaging Server 7.0.5.34.0 64bit (built Oct 14 2014))

     with SMTP id <[email protected]> for
     redacted; Sat, 29 Aug 2015 09:52:10 -0500 (CDT)
    Date: Sat, 29 Aug 2015 14:52:09 +0000
    From: WhatsAppService <[email protected]>
    Subject: Incoming voicemessage - 2:52PM
    X-Originating-IP: [162.144.132.###]
    Message-id: <[email protected]>
    Boners-Felony: quixotism
    X-CNFS-Processed-At: Sat, 29 Aug 2015 08:09:15 -0700

when I check my exim mail logs I see no evidence of this outgoing spam?

is it possible it did not come from my server if the received: from ip matches my server?

if not they must be deleting it from the EXIM logs because there is no evidence of this outgoing spam there.

is there a way to figure this out

** I also find it ODD that http://mxtoolbox.com/blacklists.aspx is not showing it on any blacklist only Cloudmark **

Anytime in the past that my servers sent spam it would show on 1 or more blacklist using mxtoolbox also.

3
  • 1
    How long have you had this IP address ?
    – user9517
    Sep 3, 2015 at 21:40
  • 4
    Mail is hard. Cloudmark is shady. This wasn't necessary a result of an actual issue with YOUR system.
    – ewwhite
    Sep 3, 2015 at 21:44
  • I believe the IP is about 6 months old. they are claiming the spam was sent over the weekend as you can see above. but there is no evidence on my end that this mail came from my server. I changed the IP that mail is sent on for now and shall see what happens. no other blacklist are showing any issues
    – Paul Mall
    Sep 4, 2015 at 1:38

1 Answer 1

3

They dont have to use your exim server - they could be sending mail directly.

This could be a sign that your server has been hacked or someone is exploiting poorly written php forms to send spam.

Don't focus on just the exim logs - check all the logs for suspicious activity.

5
  • if it was an exploted PHP form it should certainly be showing up in the EXIM logs? wouldn't it have to be another service all together? and how could I isolate which services are sending mail if not EXIM
    – Paul Mall
    Sep 3, 2015 at 21:39
  • Traffic capture with tcpdump, look for anything sending to port 25.
    – Grant
    Sep 3, 2015 at 21:44
  • 2
    And PHP can use a local mail server, but it doesn't have to.
    – Grant
    Sep 3, 2015 at 21:45
  • Can I block all icoming traffic on 25? I only need to have outgoing. all domains have email on remote servers I only need EXIM to be able to send mail but block all other mail. is that possible?
    – Paul Mall
    Sep 3, 2015 at 22:25
  • @PaulMall Why do you want to block incoming traffic? Sending mails IS outgoing.
    – sebix
    Sep 4, 2015 at 18:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .