Bad reputation due to snow shoe spamming, but not compromised

July 13, 2017, 12:44 am

≫ Next: Symmantec Cloud Blacklist Removal

I need a solution

I'm maintaining a personal (Zimbra based) mailserver that serves a couple of domains for me and some friends. The server is part of a VM infrastructure that has 4 ip addresses to share among some VM's. All of these IP's have been blacklisted by symantec because of suspected snow shoeing spam, while only 2 of these IP's send out mails (the other is a Sympa based mailinglist server, rarely used). I've looked at the mail logs of both servers and can't for the life of me find any abnormal mails? I've checked RBL listing on mxtoolbox and none of my IP's are listed on any RBL? SPF records are all correct for these servers.

I requested delisting once and was delisted (but only after having spent some time typing a personal message instead of just clicking the 2 checkboxes that I've done my homework). Now, I'm back on the list and me and my friends can't send mails to the mailservers of KPN (mailin.kpnmail.nl).

host mailin.kpnmail.nl[213.75.3.30] refused to talk to me: 421 5.5.0 Your IP has been blacklisted. Please contact abuse@kpn.com for more information.

Yesterday I started the delisting procedure again, but have yet to see the result. I'm completely at a loss what to do next? It's frustrating to maintain a simple (well maintained!) mailserver these days having to battle these false positives all the time.

Involved ip range: 94.103.150.236-239

↧

Symmantec Cloud Blacklist Removal

July 13, 2017, 10:58 pm

≫ Next: server...messagelabs.com returned an error > 553 (emails rejected)

≪ Previous: Bad reputation due to snow shoe spamming, but not compromised

I need a solution

Hi There,

I am posting on behalf of our client with the domain name of coldxpress.com.au. as they are receiving bounceback messages from every single organisation that is currently using Symmantec cloud email filtering.

If needed I can provide bounceback messages and error logs.

The domain is currently running from office 365. We have checked everything on our domain as well as many public blacklists which are all normal.

If this domain could be taken off of the blacklist as soon as possible we would appreciate it as the staff cannot send email to many business which are running your system.

↧

server...messagelabs.com returned an error > 553 (emails rejected)

July 13, 2017, 9:14 pm

≫ Next: Moved server to new IP; emails are now being marked as spam by Email Security .Cloud (formerly MessageLabs)

≪ Previous: Symmantec Cloud Blacklist Removal

I need a solution

I need help. I have a new laptop with new subscriptions to Office 365 and to Norton Internet Security. And, now I have a new problem, but only when I send an email to one person's business email.

About half of my emails to him are rejected. Some have attachments, and some don't. I've never had this problem before, and neither has the email receipient. This is the message:

It says: "server-16.tower-131.messagelabs.com error-> 553 you are trying to use me as a relay, but I have not been configured to let you" [then there is a string of numbers followed by] "outbound.protection.outlook.com do this. Please visit www.symanteccloud.com/troubleshooting for more details about this error message and instructions to resolce this issue. (#5.7.1)" I have seen similar errors on the website, but not this exact problem.

The recipient says the problem is on my end. I don't know how to fix it. Can you help me?

↧

Moved server to new IP; emails are now being marked as spam by Email Security .Cloud (formerly MessageLabs)

July 14, 2017, 9:30 am

≫ Next: Email being blocked - 553 Message filtered

≪ Previous: server...messagelabs.com returned an error > 553 (emails rejected)

I need a solution

We recently moved our mail server to a new IP (5.39.25.177) and it seems that email from our new IP to Email Security Cloud is now being marked as spam.

We've checked the IP with http://ipremoval.sms.symantec.com/lookup/ and was initially listed (not anymore), but mail seems to continue being marked as spam.

↧

Email being blocked - 553 Message filtered

July 14, 2017, 2:09 pm

≫ Next: Messages marked as spam. Reason : tests=ipchecker

≪ Previous: Moved server to new IP; emails are now being marked as spam by Email Security .Cloud (formerly MessageLabs)

I need a solution

Email from our domain (knightstone.co.uk) sent via our Office365 email service to exchange online users who are unable to send out email.

Error Details

Reported error:	550 5.0.350 Remote server returned an error -> 553 you are trying to use me [server-15.tower-180.messagelab;s.com] as a relay, but I have not been configured to;let you [213.199.154.113, mail-am5eur03lp0113.outbound.p;rotection.outlook.com] do this. Please visit;www.symanteccloud.com/troubleshooting for more details;about this error message and instructions to resolve;this issue. (#5.7.1)
DSN generated by:	AM5PR0902MB2065.eurprd09.prod.outlook.com
Remote server:	server-15.tower-180.messagelabs.com

We have enabled Static route on MessageLabs with confirmation that test email worked.

Please can we get the block lifted??

Thanks!

↧

Messages marked as spam. Reason : tests=ipchecker

July 16, 2017, 10:32 am

≫ Next: Connection rejected by policy [7.7] 14310

≪ Previous: Email being blocked - 553 Message filtered

I need a solution

Hello,

We have an uncompromised mailserver with four IPs:
- 212.129.48.30
- 212.129.48.31
- 212.129.48.32
- 212.129.48.33
Our IPs are not listed on any blacklists (very good reputation on SenderScore), and the server have been scanned thoroughly and is clean.

Our messages are marked as spam by Email Security.Cloud with the following reason : "X-SpamReason: Yes, hits=50.0 required=7.0 tests=ipchecker: aGl0YW5kcnVuX2JpdF92ZWN0b3I=".

Here is an example :

X-Msg-Ref	server-11.tower-179.messagelabs.com!1500221569!93926717!1
X-OriginalArrivalTime	16 Jul 2017 16:12:49.0209 (UTC) FILETIME=[5E6A3A90:01D2FE4E]
X-Originating-IP	[212.129.48.33]
X-Spam-Flag	YES
X-SpamInfo	spam detected heuristically
X-SpamReason	Yes, hits=50.0 required=7.0 tests=ipchecker: aGl0YW5kcnVuX2JpdF92ZWN0b3I=
X-StarScan-Received
X-StarScan-Version	9.4.25; banners=-,-,-

What can we do to resolve this issue ?

Regards,

↧

Connection rejected by policy [7.7] 14310

July 16, 2017, 6:22 pm

≫ Next: Our whole subnet has a negative reputation due to snow shoe spamming techniques

≪ Previous: Messages marked as spam. Reason : tests=ipchecker

I need a solution

Request for Delisting for our IP address - 192.99.173.244

BFFC79BA0294 450920 Thu Jul 13 14:08:23
(host cluster9.us.messagelabs.com[216.82.251.41] refused to talk to me: 501 Connection rejected by policy [7.7] 14310, please visit www.messagelabs.com/support for more details about this error message.)
cris_isirani@cathaypacific.com
jojo_veneracion@cathaypacific.com

Regards

↧

Our whole subnet has a negative reputation due to snow shoe spamming techniques

July 17, 2017, 9:56 am

≫ Next: Problems with Emails going through messagelab servers

≪ Previous: Connection rejected by policy [7.7] 14310

I need a solution

Hi,
a lot of customers are complaining that they can't sed email to specific domains.
These domains are using your appliance as anti-spam

My MX servers are perfectly clean on every RBL or health check (mxtoolbox and dnsstuff.com).

I made a lot of queries of our subnet and i found that all of my IP address have a negative reputation!

"The host has been observed sending spam in a format that is similar . to snow shoe spamming techniques."

How's that possible? 90% of them are not even in use. The ip that we are talking is: 185.132.68.51.

I would like to resolve this problem ASAP because as a Service
Provider we are receiving a lots of complaints from multiple
customers.

↧

Problems with Emails going through messagelab servers

July 17, 2017, 8:14 pm

≫ Next: Email being blocked wrongly - 501 Connection rejected by policy [7.7]

≪ Previous: Our whole subnet has a negative reputation due to snow shoe spamming techniques

I need a solution

Hi,

My customer's email server ( 119.73.162.37 ) when connect to the messagelabs servers will have the following errors

Jul 18 10:54:17 XXXXX postfix/smtp[6955]: 4BA6E8000BC59: to=<XXX@jXXX.com>, relay=cluster1.us.messagelabs.com[216.82.249.179]:25, delay=912, delays=711/0/201/0, dsn=4.4.2, status=deferred (lost connection with cluster1.us.messagelabs.com[216.82.249.179] while receiving the initial server greeting)

This has been happening since 15 July 2017. I have checked that the email server 119.73.162.37 does not have any bad reputation on http://ipremoval.sms.symantec.com/lookup/

The IP address you submitted, 119.73.162.37, does not have a negative reputation and therefore cannot be submitted for investigation.

Please help .

thks

Jimmy

↧

Email being blocked wrongly - 501 Connection rejected by policy [7.7]

July 18, 2017, 2:08 am

≫ Next: IP Repeatedly being listed as 'bad' by reputation service.

≪ Previous: Problems with Emails going through messagelab servers

I need a solution

Hi, I have posted several times in other threads but they seem to be being missed.

We too have the 501 Connection rejected by policy [7.7] problem, and as with everyone else, our server is not blacklisted anywhere else and your own IP Reputation Investigation page at http://ipremoval.sms.symantec.com/lookup/ says "The IP address you submitted, 109.123.121.23, does not have a negative reputation and therefore cannot be submitted for investigation.".

The blocked emails return...

 host cluster3.eu.messagelabs.com [85.158.136.35]
 SMTP error from remote mail server after initial connection:
 501 Connection rejected by policy [7.7] 12503, please visit www.messagelabs.com/support for more details about this error message.
Reporting-MTA: dns; host1.miconcepts.co.uk

Action: failed
Final-Recipient: rfc822;************
Status: 5.0.0
Remote-MTA: dns; cluster3.eu.messagelabs.com
Diagnostic-Code: smtp; 501 Connection rejected by policy [7.7] 12503, please visit www.messagelabs.com/support for more details about this error message.

This seems to be a serious problem with Symantec.

Can you please fix this for our server - 109.123.121.23

Thank you.

↧

IP Repeatedly being listed as 'bad' by reputation service.

July 20, 2017, 12:21 am

≫ Next: connect to cluster8.eu.messagelabs.com[85.158.137.99]:25: Connection timed out

≪ Previous: Email being blocked wrongly - 501 Connection rejected by policy [7.7]

I need a solution

Hi,

I’m hoping finally this may get some results. We started providing a new email service for our clients a few weeks ago, yet for some reason, your reputation system seems to be the only listing our IP as having a bad reputation. The IP in question is 31.24.228.83 and doesn’t appear in any other lists we have checked, only yours.

I have already requested an investigation via the web (4 times) where you removed it for about 12 hours then it was re-added again. I have no idea why you keep listing the address as bad and would welcome your reasons as to why and what evidence you have to back this up.

This is causing issues with our clients being able to email one of their key suppliers, who sadly for us at the moment, uses your reputation service.

I look forward to your response.

Many thanks

Will

↧

connect to cluster8.eu.messagelabs.com[85.158.137.99]:25: Connection timed out

July 20, 2017, 3:22 am

≫ Next: 501 Connection rejected by policy [7.7] 14005

≪ Previous: IP Repeatedly being listed as 'bad' by reputation service.

I need a solution

Hello,

I'm having a Shared Linux Virtual Server.
Whenever sending a mail to domains using cluster8.eu.messagelabs.com , we are getting this error message.

connect to cluster8.eu.messagelabs.com[85.158.137.19]:25: Connection timed out
connect to cluster8.eu.messagelabs.com[85.158.137.3]:25: Connection timed out etc..

The server is not in any RBL / blacklists. Please cehck this.

Server's IP: 5.2.88.79

Thank you.
Tech support
Intensas

↧

501 Connection rejected by policy [7.7] 14005

July 21, 2017, 7:31 am

≫ Next: 501 Connection rejected by policy [7.7] 5507

≪ Previous: connect to cluster8.eu.messagelabs.com[85.158.137.99]:25: Connection timed out

I need a solution

I have this error but I don't understand the reason

R=lookuphost T=remote_smtp H=cluster3vk.eu.messagelabs.com [85.158.137.83]: SMTP error from remote mail server after initial connection: 501 Connection rejected by policy [7.7] 14005, please visit www.messagelabs.com/support for more details about this error message.

IP Investigation Query

The IP address you submitted, 162.252.172.34, does not have a negative reputation and therefore cannot be submitted for investigation.

Help please.

↧

501 Connection rejected by policy [7.7] 5507

July 24, 2017, 10:24 am

≫ Next: connect to cluster3.eu.messagelabs.com[194.106.220.51]:25: Connection timed out

≪ Previous: 501 Connection rejected by policy [7.7] 14005

I do not need a solution (just sharing information)

Hello
We are trying to send mails to a certain domain but we receive the next message

xxxx.xxxx@StandardAero.com
host cluster4.us.messagelabs.com [216.82.242.33]
SMTP error from remote mail server after initial connection:
501 Connection rejected by policy [7.7] 5507, please visit
www.messagelabs.com/support for more details about this error message.

The IP's we are using:

198.49.76.56 / 29

Can you please check and remove us from the blacklist? I have checked and doesnt appear to be blacklisted. Thanks

↧

connect to cluster3.eu.messagelabs.com[194.106.220.51]:25: Connection timed out

July 26, 2017, 12:16 am

≫ Next: Bounced by destination server with response: 5.3.0

≪ Previous: 501 Connection rejected by policy [7.7] 5507

I need a solution

Hello

we can not send email to your servers

connect to cluster3.eu.messagelabs.com[194.106.220.51]:25: Connection timed out

If we check "IP Investigation Query" result is "The IP address you submitted, 217.16.185.104, does not have a negative reputation and therefore cannot be submitted for investigation."

Can you check, why is our email server blocked?

Our IP:
217.16.185.104
78.24.9.48
78.24.9.49
78.24.9.50

Thk

↧

Bounced by destination server with response: 5.3.0

July 26, 2017, 5:15 am

≫ Next: 553 Message Filtered Bouncebacks

≪ Previous: connect to cluster3.eu.messagelabs.com[194.106.220.51]:25: Connection timed out

I need a solution

Hello,

the last few days all our mail to Symantec customers returns bounced.

Other mail system problem ('553', ['Message filtered. Refer to the Troubleshooting page at', 'http://www.symanteccloud.com/troubleshooting for more', 'information. (#5.7.1)']

I've checked our IP addresses (134.221.1.26 and 134.221.1.27) against many blacklists, and they are OK.

When testing using telnet it seems messages with Received: headers are rejected

250 ok 1500986338 qp 11317 server-6.tower-184.messagelabs.com!1500986119!124095661!4
MAIL FROM:
250 OK
RCPT TO:
250 OK
Data
354 go ahead
Received: from exc-cashub01.tsn.tno.nl (HELO mail.tno.nl) ([134.221.225.220]) by mailhost1a.tno.nl with ESMTP; 25 Jul 2017 10:59:11 +0200
Received: from EXC-MBX02.tsn.tno.nl ([fe80::5836:4645:c512:f964]) by EXC-CASHUB01.tsn.tno.nl ([fe80::b855:be6:1aa8:4d0f%13]) with mapi id 14.03.0319.002; Tue, 25 Jul 2017 10:59:12 +0200
Subject:test
test
.
553-Message filtered. Refer to the Troubleshooting page at
553-http://www.symanteccloud.com/troubleshooting for more
553 information. (#5.7.1)

Same message without the Received headers is accepted.

Can somebody please explain how to fix this

Thanks,
Jacco

↧

553 Message Filtered Bouncebacks

July 26, 2017, 6:13 am

≫ Next: 553 Message Filtered - Happened Again

≪ Previous: Bounced by destination server with response: 5.3.0

I need a solution

Hi,

Some of our outbound email is being blocked by Symantec -

Remote host said: 553-Message filtered. Refer to the Troubleshooting page at
553-http://www.symanteccloud.com/troubleshooting for more
553 information. (#5.7.1)

the nature of our business means that we email reference requests to a variety of employers and getting them all to whitelist us is impractical / impossible.

I've submitted examples to CLOUDfeedback@feedback-87.brightmail.com on Friday but the block is still in place.

I've gone through all the troubleshooting tips on https://support.symantec.com/en_US/cloud/troublesh... but we are still being blocked.

Can someone at Symantec help and let me know why we are being blocked ??

Thanks,

Ian

↧

553 Message Filtered - Happened Again

July 26, 2017, 6:28 am

≫ Next: Email Security.cloud how to get last 30 days emails hits to our message labs

≪ Previous: 553 Message Filtered Bouncebacks

I need a solution

3 weeks ago Symantec started blocking our outbound emails

Remote host said: 553-Message filtered. Refer to the Troubleshooting page at
553-http://www.symanteccloud.com/troubleshooting for more
553 information. (#5.7.1)

I submitted some examples to CLOUDfeedback AT feedback-87.brightmail.com and the block was lifted a day or so afterward.

However we are now being blocked again - I re-submitted some examples on Friday but the block is still in place.

I've followed all the troubleshooting tips but to no avail.

Can someone from Symantec help and let me know what we can do to get the block lifted, or why we are being blocked at all ?

Thanks

↧

Email Security.cloud how to get last 30 days emails hits to our message labs

July 27, 2017, 1:19 am

≫ Next: 501 Connection rejected by policy [7.7] 5507

≪ Previous: 553 Message Filtered - Happened Again

I need a solution

We want to get the list of all sender email adress those are email rejected by Antispam with Security Scan

Anti-Spam Service

Action:Blocked

Reason:Sorry, your email address has been blacklisted.

Is it possible to get all sender lists with above details. last 30 days report

↧

501 Connection rejected by policy [7.7] 5507

July 26, 2017, 8:00 pm

≫ Next: Blacklisted IP from messagelabs.com

≪ Previous: Email Security.cloud how to get last 30 days emails hits to our message labs

I need a solution

Hello,

We have been having a ton of issues with your RBL listing. We had an issue on IP 198.20.66.50 - dklfinance.com.au over two years ago and it has been resolved for ages and yet you still have us listed in the RBL, we even moved our mail server over to IP 67.215.1.226 and it is STILL being blocked from any email off our server 1nethosting.com. We need this resolved ASAP as it is killing our business. Here is the bounce back email. Please advise ASAP on this.

-----Original Message-----
From: Mail Delivery System [mailto:Mailer-Daemon@svr.1nethosting.com]
Sent: Thursday, July 27, 2017 12:17 PM
To: XXXXX
Subject: Mail delivery failed: returning message to sender

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

DD@anz.com
    host cluster3vk.eu.messagelabs.com [85.158.136.35]
    SMTP error from remote mail server after initial connection:
    501 Connection rejected by policy [7.7] 12516, please visit www.messagelabs.com/support for more details about this error message.

Thank you for your cooperation.

Jeff B
It Services

↧

IP Investigation Query

Latest Images