Subject: [Asrg] blacklists

From: James Muir <[email-masked]>
Date: Tue, 29 Jan 2008 13:55:01 -0400

[I hope this question is not off-topic.  I am looking for help and am 
having a hard time finding an appropriate forum in which to ask for help.]

I wondered if anyone on the list has had experience in getting an IP 
address removed from a blacklist.  I am having a very difficult time 
accomplishing this.

Our department's server was blacklisted on Friday (our reputation is 
currently listed as "poor") and it is causing a few headaches for us:

http://www.barracudacentral.com/index.cgi?p=lookups&r=1&ip=140.184.76.9

e.g. we can't send email to other machines within the university because 
they reject messages using the blacklist :-)   We think the reason we 
were blacklisted is because mailman was sending out reject messages in 
response to spam sent to one of our mailing lists.

According to the web page above, once you request removal, then your IP 
is supposed to be temporarily removed while your request is considered. 
  But, so far (four days later) this hasn't happened.

Has anyone dealt with this before?  Any suggestions on a way to resolve 
this more quickly?

-James

-- 
http://cs.smu.ca/~jamuir

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 29 Jan 2008 14:02:02 -0500

> having a hard time finding an appropriate forum in which to ask for help.]

Actually, it is offtopic, but a short answer should be okay ;-)

Better venues might be news.admin.net-abuse.email or spam-l.

> http://www.barracudacentral.com/index.cgi?p=lookups&r=1&ip=140.184.76.9

Barracuda is infamous for appropriating public blacklists, and utilizing
them as their own.  So, the first thing to do is check 
http://www.dnsstuff.com (or some other multi-DNSBL tester), which shows 
that your IP isn't listed anywhere in any of the 3rd party lists it 
knows about.  If you find it listed (especially one of the dozen or so 
useful ones), fixing that should solve your problem within a few hours 
or less.

So, this is not an imported entry, it's Barracuda itself, and contacting 
them is the only way.

If their web interface isn't generating a response, it may be broken, 
and you need to report that.  Barracuda itself is at 
[email-masked], and you could try phoning them.  I think your 
email means you're a customer, so they should be obligated to assist.

An alternative would be, since this appears to be mostly within campus, 
contacting the email admins and getting them to whitelist
this IP within their Barracudas - since this is your admins blocking 
you, they really should be able to assist.  But this doesn't help if 
you're emailing off-campus.

In the mean time: it says that the last "suspicious event" from this IP
was at 01/29/08 10:52:20 PST.  Check your mail server logs for something
at that time.

Secondly, if this IP is a NAT fronting for end-user desktops, it would 
probably be a very good thing to secure the NAT so that end-user 
desktops can't get to the Internet on port 25.  Or, split the mail 
server from the NAT.  Or something like that.

> response to spam sent to one of our mailing lists.

It could be any number of things.  If this IP is a NAT, it probably is 
infected machines spewing.

>  But, so far (four days later) this hasn't happened.

Sounds like the web page is busted.  Contact their support.

---

From: SM <[email-masked]>
Date: Tue, 29 Jan 2008 11:04:48 -0800

>address removed from a blacklist.  I am having a very difficult time 

It's usually difficult to get off these blacklists.

>http://www.barracudacentral.com/index.cgi?p=lookups&r=1&ip=140.184.76.9

It's a reputation system run by Barracuda Networks.  You'll have to 
contact that about that listing.

>e.g. we can't send email to other machines within the university 
>because they reject messages using the blacklist :-)   We think the 
>reason we were blacklisted is because mailman was sending out reject 
>messages in response to spam sent to one of our mailing lists.

You really have a problem if blacklists used within your university 
block your emails and you cannot fix that internally. :-)

>Has anyone dealt with this before?  Any suggestions on a way to 
>resolve this more quickly?

Contact the company running that blacklist.

Regards,
-sm

---

From: James Muir <[email-masked]>
Date: Wed, 30 Jan 2008 16:46:15 -0400

> Contact the company running that blacklist.

Thanks Chris and sm for your good advice.  Contacting tech support was 
the first thing I should have thought to do.

Our server is now off the blacklist.  It turns out that the university's 
barracuda appliance was responsible for putting us on there in the first 
place; its settings have been changed so that it doesn't report us in 
the future.  Now we just have to track down the source of the traffic 
that caused our server to be flagged.

Thank-you for tolerating this off-topic intrusion :-)

-James

--
http://cs.smu.ca

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 30 Jan 2008 22:20:05 +0100

> Thank-you for tolerating this off-topic intrusion :-)

Blacklists are very *on* topic here, the only active
ASRG draft is about DNSBLs.   Admittedly it won't help
you in a fight with barracudas and other creatures. ;->