About to be blacklisted for sending spam! Need suggestions please.

Forums › Spark New Zealand (including Skinny and BigPipe) › About to be blacklisted for sending spam! Need suggestions please.

angelsig76

4 posts

Wannabe Geek

#103549 10-Jun-2012 17:30

Over the past three days, I have had numerous phone discussions (totalling around 8 hours) with both Level 2/3 Support and the Security Team at Telecom.

It started with a CSR calling and telling my wife that "your broadband account is about to be disabled as you are sending 7000 email per hour, and that is spam!".

When I called back to ensure that this wasn't a scam, I spoke to a less than knowledgable 'expert' who again told me that my "xtra account has been sending 'like' 7000 emails per hour". When I asked how, they were unable to tell my, except that their software had flagged my IP address.

Not getting any further information, I requested to speak to someone higher up, which resulted in more deflection of the issue, and more of them telling me that they were right, but they had nothing to show me.

Eventually, after running scans on all my devices connected to my wireless LAN and coming up empty handed, I again spoke to an 'expert' at Telecom who told me that it was not possible at all to get copies of the e-mail headers aledgedly being sent by me. At this point i ranted and raved and requested to be put through to the security team, but alas these specialists are e-mail based and don't have phone lines! (or so I was told).

More yelling (by me) and eventually, low and behold, I was e-mailed a .txt file containing headers which make no sense to me at all. Some of which I have included here: (There are thousands)

222.152.0.207 =============

o Date: 2012-06-06 11:51:53 o From: <proverbialstrengthen@xtra.co.nz> o Message Size: 5857 o To: - <mrbigg@adelphia.net> - <hmaguire@adelphia.net> - <lpmeb@adelphia.net> ---------------------------------------------------------------------------------------------------- o Date: 2012-06-06 11:51:55 o From: <skullcapames@xtra.co.nz> o Message Size: 5921 o To: - <johnmbrophy@aim.com> - <iguy369@aim.com> - <jimmyv2k20@aim.com> - <goldenglove3612@aim.com> ---------------------------------------------------------------------------------------------------- o Date: 2012-06-06 11:51:58 o From: <idiomradcliffe@xtra.co.nz> o Message Size: 5876 o To: - <freshprince143@aol.com> - <mwnudge@aol.com> - <dool1998@aol.com> - <jacaynon@aol.com> - <jarrodant@aol.com> ---------------------------------------------------------------------------------------------------- o Date: 2012-06-06 11:52:03 o From: <twofoldregistrant@xtra.co.nz> o Message Size: 5791 o To: - <kkjelly291@aol.com> - <lokum2@aol.com> - <fpwcklm1@aol.com> - <doyleopt@aol.com> - <fadi0416@aol.com>

Basically I am still none the wiser as to what is going on, and Telecom are 'unable' to provide any more information, except that "If it continues, we will disable your service, as we are protecting over 600,000 customers who hate getting spam e-mails". I agree, I'm one of those customers!!!

I told all the persons I spoke to that I was as aghast as they were if this was happening from my line, and if they could help me with more information, then I was also doing everyting in my power to investigate this issue from my end. I also asked if there was any possibility that the issue was at all related to the Sorbs issue from a couple of weeks ago, and was told emphatically "Thats not something that we would investigate, our software is never wrong".

Has anyone got any suggestions, except for (as one 'help-desk specailist' told me) to get a new computer!

I reguarly (every 4-6 weeks), change the password for the router, and have Symantec running through all the devices attached.

HELP PLEASE!!!

1 | 2

19282 posts

Uber Geek
Inactive user

#638532 10-Jun-2012 17:33

Scan all the windows machines with Malwarebytes

mattwnz

20141 posts

Uber Geek

#638533 10-Jun-2012 17:36

If you don't find any malware or viruses, turn your modem and router off for 24 hours and then contact them after that time to see if it is still sending spam. If it has been then it won't be going through your internet connection. But it sounds like you are infected with something. Do you have a dedicated IP address or does it change each time you restart your modem?

angelsig76

4 posts

Wannabe Geek

#638535 10-Jun-2012 17:40

Apparently it I have a dynamic IP address, but they were unable to tell me what it was. They also said it has been happening for around a month.

freitasm

BDFL - Memuneh
79250 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#638536 10-Jun-2012 17:41

Turn your modem/router off and see if it still sends out.

Is your WiFi password protected? Changed the password for it.

angelsig76

4 posts

Wannabe Geek

#638537 10-Jun-2012 17:43

Wifi is password protected and I change it every 4-6 weeks.

cokemaster

Exited
4927 posts

Uber Geek

Retired Mod

Trusted

Lifetime subscriber

#638570 10-Jun-2012 18:41

I'm posting from my mobile, forgive me if the formatting isn't the best.

I wrote some of the tracking programs that were used to process spam complaints. I can't get into specfics but as a result, I know the process quite well.

Basically isps and owners of smtp servers get notifications when spam has been flagged from their ip range or servers. Typically its caused by virus infections that trigger computers to send out spam either directly to other mail providers or via the isps smtp server. Depending where that spam ends up, there is either some time to deal with it or no grace period (particularly of the isp has been blacklisted before)... Nevertheless the isp is expected to plug the source of spam or face blocking or blacklisting.

Whether you have a subscriber assigned, static ip, or dynamic ip - the isp is able to look up what connection held that ip at that time.... However they don't know what's running on the other side of that modem. It could be insecure wireless, an exploited smtp server, an infection on one of the computers.

How the isp responds depends on what setup they have and the severity. Some isps may block ips from their smtp server, others might have wall gardens, others might just block mail like traffic, but one method is to lock the Internet connection. That can be done several ways - it could be done at the dsl layer or at the authentication stage... The effects are fairly similar.
Failure to stop the spam could get the isp in a bit of bother if they get blocked or blacklisted.

From your side, I suggest changing your wireless password and also refrain from using wep.... Try and use wpa2 where possible. Scan your computers with a main brand of activities, I'd you don't have one.. Look at Microsoft antivirus product, it's free and lightweight. If you have a firewall with app based permissions, I suggest you only allows apps that you use to access the Internet.

The isp should be able to provide examples of the spam as well... The header information will contain time stamps, use that to figure out what computer was turned on.

Although I no longer develop apps for this area, I have a few contacts in this area, if you're still having issues.. Flick me a pm.

webhosting

Loose lips may sink ships - Be smart - Don't post internal/commercially sensitive or confidential information!

mattwnz

20141 posts

Uber Geek

#638574 10-Jun-2012 18:46

angelsig76: Apparently it I have a dynamic IP address, but they were unable to tell me what it was. They also said it has been happening for around a month.

That is becuase it will change each time you connect to the ISP, but they will have records of who is using the IP at the time it was sent.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

numfarr

329 posts

Ultimate Geek

#638582 10-Jun-2012 19:15

You could use network tools like your router's connection list, and netstat or resource monitor on pcs, to look for lots of outgoing connections to mail servers.

johnr

19282 posts

Uber Geek
Inactive user

#638585 10-Jun-2012 19:33

Wireshark may also help you

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#638793 11-Jun-2012 10:44

johnr: Wireshark may also help you

I can safely say from experience that on secured wireless networks, Wireshark is... less than helpful. Probably the best thing there is to get a router that you can flash with DD-WRT or Tomato, and that way you can SSH to it and run tools like nettop. Not for the faint of heart though.

keewee01

1737 posts

Uber Geek

Trusted

#638926 11-Jun-2012 13:34

I can totally understand why Telecom are threatening to cut you off. Because in their eyes your (unintentional) actions as the owner to the problem equipment are risking their entire broadband email business.

If everyone using your connection are careful, then it is very easy to end up with an infected machine - and you might never know it! Sounds similar to a work situation a couple of years ago where someone, without thinking, click on a button in one of those browser pop up windows.

I noticed by the mail logs that we had a issue somewhere and traced it to this particular machine. The owner admitted they'd click on something a few days earlier. After a number of hours and using various utilities (including ComboFix) I'd managed to get to the root kit cause the issue and have it removed.

I dumped using Symantec products years ago ago I saw quite a number of issues with it and a number of my users who were running their products had infections on their home computers (all were completely up to date at the time). Every since, I will not touch their products. Probably unfair, but that is my position.

I now used Microsoft Security Essentials. It certainly seems to do the trick and it is free.

drajk

202 posts

Master Geek

Trusted

#638932 11-Jun-2012 13:52

Being disconnected for 24hours will likely just add to the frustration as it may be days later before your ISP receives spam reports re the connection.

Spam can go out over multiple ports but most likely 25.

Suggest use Gmail for sending (uses a different port) and block port 25 in/out both modem and (if separate) in your router.

Then see if the problem disappears.

mattwnz

20141 posts

Uber Geek

#638954 11-Jun-2012 14:18

drajk: Being disconnected for 24hours will likely just add to the frustration as it may be days later before your ISP receives spam reports re the connection.

Spam can go out over multiple ports but most likely 25.

Suggest use Gmail for sending (uses a different port) and block port 25 in/out both modem and (if separate) in your router.

Then see if the problem disappears.

Although the ISP shouldn't be relying on spam complaints, their systems should be able to detect if there are a high number of emails being sent through it as they happen.

angelsig76

4 posts

Wannabe Geek

#639803 12-Jun-2012 17:30

Thank you for all your replies and suggesstions. I have done as much as I am technically able to with these suggestions, and everything comes up clear.

I came home tonight to find that our connection had been disabled by Telecom without warning. This after a Security Team/Complex INternet Issues Manager had added a note to my file for this not to occur and that someone would be calling me to further help investigate.

When I spoke to them (another hour on the phone) the CSO said "Sorry, my colleuge missed that note".

Im at the end of my rope with this and am wondering if anyone thinks it could be related to the Sorbis software issue that they had a few weeks ago.

Thanks again for all your input, it is most appreciated.

johnr

19282 posts

Uber Geek
Inactive user

#639814 12-Jun-2012 17:38

Telecom did warn you

1 | 2