Why are we getting this blacklist msg (see mesage)?

[gomobile]

You do not have permission to send to this recipient. For assistance, contact your system administrator.
<mainserver.xxxxxx.local #5.7.1 smtp;554 5.7.1

Your server wsip-xx-xx-xxx-xxx.oc.oc.cox.net [xx.xx.xxx.xxx] is listed by the blacklist bl.spamcop.net. Please contact your Dial-Up/DSL/Network ISP Provider

We are using SBS 2000 \ Exchange 2000. Is this the ISA server or is this the actual ISP provider.

Note: They are using a cablemodem to get out to Internet.

thxs

 

[mzenzer]

Take your Cox public IP and put it here:

http://www.spamcop.net/bl.shtml

If you are blacklisted it will show up. I'm not too sure, but I do believe that spamcop is a service which a company can purchase and it will block spam based on a blacklist. This includes servers which the system has identified as having open relays and spammers are using it to send spam.

 

[gomobile]

Well this is what I got when I put in the IP address>

In the past week, this system has:
Been detected sending mail to spam traps
Been witnessed sending mail about 280 times
A sample sent sometime during the 24 hours beginning Thursday, February 05, 2004 4:00:00 PM -0800:
Received: from [xx.xx.xxx.xxx] (-.-.-)-
by -.-.net with - (Exim -.-)-
id -
for -@-.com- Fri, - Feb 2004 - -
Subject: tamar -
From: ta.. at ..om.cn

PS: What do I need to fix this any suggestions would be appreciated..

jess

 

[mzenzer]

Well, hopefully, it's as simple as disabling the ability to relay on your machine. I don't have the link to the article on how to do it right now, but I'll try to get it tomorrow. If you want to look for it sooner, just do a google search or search Microsoft's sight directly. It's pretty simple to do. There probably is a thread here as well.

However, it could be another problem, such as a trojan. There was a thread here a while back that I found when one of my servers was being hit by a spammer which used emails in various forms, but all containing at least bluestellxx@xxx.com. For example, bluestellaa@msn.com.

It was real nasty and coming from an ISP in China. The fix was to monitor certain events in Exchange and find the offending account, then rename the account and change the password. I don't remember if anyone actually discovered how this these people were doing it. This particular server (Exchange 5.5) was relay secure, and the still got in.

 

[zoeythecat]

Check out this article:

http://support.microsoft.com/?id=310380