Blacklisted for spam

Question

Level 1

104 points

Blacklisted for spam

My cable IP address (dynamic with Comcast.net) has been blacklisted and I can no longer send email (work-related, not Comcast) directly to my work email server as I used to. I have to get off the blacklist so am trying to fix any possible holes (I'm not a spammer).

I've scanned the PC laptop that is also connected to my home LAN and it's clean. I've encrypted the wireless at 128-bit but it used to be open - I thought the signal was weak and I have no close neighbors so I thought there'd be no problems! Recently I saw some odd MAC addresses on the wireless so shut it down.

The only thing left that I can think of is my mac. Are there any viruses, spyware, etc. that could be a problem, and if so, how can I check and get rid of them? I've always assumed there aren't any problem viruses or spyware for macs, but maybe I'm wrong...

Thanks,
Carl

Powerbook Pismo (G3 400), Mac OS X (10.3.9)

Posted on Jan 6, 2006 2:52 PM

Reply

Answer 1

Jan 6, 2006 6:29 PM in response to CHP

Do you have the same problem with sending work email using your PC laptop?

If not, you can change your PB IP address through your router or by disconnecting your PB, depending on how your router assigns/shares IP addresses.

If you have the same problem with your PC and any other computers on your LAN, you can try turning off your cable modem for a few hours to see if that gets it assigned a new IP, but you'll probably need to ask your ISP to change your dynamic internet IP address for you.

Asking at the comcast forums will probably get you more useful info.

Hope this helps.

Ti G4 Mac OS X (10.3.9) 867 1GB ram

Reply

Answer 2

CHP Author

Level 1

104 points

Jan 6, 2006 6:49 PM in response to Anthony Chui

Thank you. The problem is that I use my PC on my home network to connect, and it's the IP address of the router that is being rejected. I can't send from my work PC laptop or any machine connected via the router b/c that's the blacklisted address. (Oddly, I can send email to Comcast's mail server through my home email account, but I can't send email to different ISPs that use Spamcop and other blacklists to filter rouge IP addresses. My LAN addresses, of course, aren't seen on the internet.

I know I can re-set my router's MAC address (it's currently using my PB's ethernet MAC address, cloned) and re-boot to get a new and likely different IP address, but if I don't fix the holes, the same problem will likely re-cur.

So, I've been working on a forum on Spamcop to get some technical info and have closed down and eliminated all problems (I think) with the open wireless system and cleared the PC of any problems (none found with a variety of checks - I'm generally pretty careful).

What I haven't yet found, and need to figure out, is how to scan my Powerbook for viruses, spyware, etc. Any help with that? I don't want to request de-listing or change my IP address until I know I've fixed all the likely problems. While I know the Mac isn't likely the source of the problem, I just want to know if/how I can scan it too. Symantec says they have a web-based virus check for Macs, but I haven't been able to get it to work.

Thanks again,
Carl

Reply

Answer 3

Jan 6, 2006 7:07 PM in response to CHP

Haven't used it myself but saw it recommended elsewhere here:

http://www.intego.com/demo/

Reply

Answer 4

TildeBee

Level 7

31,923 points

Jan 6, 2006 7:16 PM in response to CHP

CHP --

The chances of your Powerbook having viruses, spyware, etc. are miniscule.
If you've been using Norton on your Mac,
this could very well have seriously messed you up.
Personally, I wouldn't try using Symantec on my Mac for any amount of money. There are others who feel NAV is fine. Myself, I would never use it.

I have heard of problems for Macs when connected to a PC network.
I am not a networking expert here,
but I'm concerned about your statement here:

Recently I saw some odd MAC addresses on the wireless so shut it down.

There may be someone using your wireless network
illegally . . . I would definitely look into those address,
and if you don't have a router, I would get one, ASAP.

Reply

Answer 5

CHP Author

Level 1

104 points

Jan 6, 2006 7:46 PM in response to TildeBee

I do have a router with firewall, and had it quite shut down from the internet. But I left the wireless open as it SEEMED I wouldn't have a problem given my neighborhood, weak signal even within the house, etc. But it seems pretty clear someone was using my connection b/c my two computers on my home network don't have the MAC address I saw. Having seen the odd MAC addresses, how can I check them? I wrote down one and may have seen another before turning on WEP encryption.

As for Symantec, I used to use it (back under OS 7.5.3 or so) but don't anymore on the Mac.

Carl

Reply

Answer 6

Jan 6, 2006 8:35 PM in response to CHP

Carl--

Have you talked to the IT people where you work? Perhaps they tightened up the rules for relaying through their server. Many companies now block IP addresses from whole ISP domains where they know they're dynamically assigned.

That used to be the case where I worked. While we could get our email from the mail server, if we needed to reply, we had to use a different email account because we couldn't relay through the company mail server.

On the other hand, if your wireless network was open, it's certainly possible that someone used it to send out lots of spam. So it's definitely a good idea to make sure it's secure.

charlie

Reply

Answer 7

TildeBee

Level 7

31,923 points

Jan 6, 2006 8:37 PM in response to CHP

CHP --
I will ask around for recommendations as to what you should do.
Hang in there, OK?

If anyone else reading this knows what to do,
please don't hesitate to post.

Reply

Answer 8

Jan 6, 2006 8:55 PM in response to CHP

Carl--

Having seen the
odd MAC addresses, how can I check them? I wrote
down one and may have seen another before turning on
WEP encryption.

It seems kind of unlikely that you'll actually ever figure out who it was. But one thing you might be able to do is to make sure only your computers can connect to your wireless network.

I have an Apple graphite base station and it has a section called "Access Control", where I can put in the MAC address (also known as "AirPort ID") of computers I'll allow to connect to the network. I put only trusted addresses there.

Just double check and make sure it's correct when you enter it, since you may have trouble getting connected back to your wireless network if you enter a wrong digit.

charlie

BTW, just so it's clear, the MAC address is a hexadecimal (i.e., numbers 0-9 and letters a-f) of six pairs separated by a colon. For example: 00:14:85:7F:A1:E4 is a MAC address (though it's totally made up, by the way).

Reply

Answer 9

Jan 6, 2006 9:50 PM in response to CHP

You can test your address at several open-relay sites to see if you are in fact blacklisted. First go to http://www.showmyip.com/ to get your public IP address, then go to http://ordb.org/lookup/ for instance to see if your address is listed. If it is and you don't have a staticly assigned IP from your provider (which would be unusual with Comcast) then power-cycle your router and check your public IP again - it should be different and thus not blacklisted.

It sounds more like Comcast is blocking your outgoing traffic on port 25 so that you can not send email out through any smtp server other than theirs. That is standard practice for many large ISPs. You might try calling them and asking if they are blocking smtp / port 25 traffic from leaving their domain to other mail servers.

Reply

Answer 10

Jan 6, 2006 10:35 PM in response to JulieJulieJulie

JulieJulieJulie--

power-cycle your router and check your public IP
again - it should be different and thus not
blacklisted.

In my experience with Comcast, unless you change the MAC address presented to Comcast's equipment, you're actually almost certain to get the same IP address. It's only been in very rare instances that I've gotten a different address, and usually when I know they've been working on the system.

That said, it's also a bad idea to change the MAC address of the router to some arbitrary new address just to get a different IP address. If you somehow picked the same MAC address as another device on the Comcast network, you could cause some serious disruptions. Only do this if you have a MAC address of a device in your hands, like an old computer or router.

It sounds more like Comcast is blocking your outgoing
traffic on port 25 so that you can not send email out
through any smtp server other than theirs. That is
standard practice for many large ISPs.

If Comcast is blocking port 25, it's not universal across all their customers. I have no problem connecting to port 25 outbound. It's easy to test: just telnet to a mail server on port 25 (using the Terminal application):

telnet mail.domain.com 25

You'll get back something like this:

Trying NN.NN.NN.NN...
Connected to mail.domain.com.
Escape character is '^]'.
220 mail.domain.com ESMTP

If you get a "connected" message followed by a line starting with "220", you're in. Otherwise, you'll either time out or get an error message.

For example, AOL refuses mail from residential Comcast addresses. If I try the telnet test with their mail server, I get this in return:

Trying 64.12.137.249...
telnet: connect to address 64.12.137.249: Connection refused
Trying 205.188.156.185...
Connected to mailin-01.mx.aol.com.
Escape character is '^]'.
554- (RTR:BB) http://postmaster.info.aol.com/errors/554rtrbb.html
554- AOL does not accept e-mail transactions from dynamic or residential
554- IP addresses.
554 Connecting IP: NN.NN.NN.NN
Connection closed by foreign host.

If you do get connected, just type the control-"]" combination to escape, then you'll be dropped back to a telnet prompt, where you just type "quit" and hit the enter key.

charlie

Reply

Answer 11

CHP Author

Level 1

104 points

Jan 6, 2006 10:45 PM in response to Charles Minow

I did talk to my work ISP (we're a small non-profit with only a dialup and I'm the only IT person - in fact, I'm the only staff!). Basically, they blocked me b/c spamcop and others listed me. My ISP is terrific but they need to protect their own "reputation" so are unlikely to open up to my IP address unless I can assure them I've fixed the problem. I've since checked and my IP address 24.62.250.158 comes up on a number of lists (some b/c I'm on Comcast, some for my specific IP address). Interestingly, since closing up my wireless and posting this, my IP has been dropped from a number of lists and I can now send email via the ISPs email server. That was quick!

Still interested in confirming that my system is clean and not trying to send out spam.

Reply

Answer 12

CHP Author

Level 1

104 points

Jan 6, 2006 10:50 PM in response to JulieJulieJulie

I had already checked several sites including ORDB, but your links are helpful and will likely help anyone else who encounters a similar problem.

I'm pretty sure Comcast isn't blocking port 25, b/c I've done this for a long time without problems, and since closing down my wireless, I've dropped off several blacklists and my ISP is now accepting my email traffic!

Reply

Answer 13

CHP Author

Level 1

104 points

Jan 6, 2006 10:59 PM in response to Charles Minow

In fact, I know they aren't blocking port 25 b/c I can now send mail to my ISP as well as through comcast. And Charles is correct that you pretty much need to change the MAC address on Comcast to get a new IP - that or power off for 30 days or more!

As for changing MAC addresses, I agree it's dicey if you choose one randomly. But when I set up my router, I cloned my laptop's MAC address for the connection b/c I thought I should. I have the router MAC address which I could use instead and ENSURE I don't cause havoc.

Carl

Reply

Answer 14

Jan 7, 2006 11:03 AM in response to Charles Minow

Hello! I am not a Comcast subscriber but after a google search it appears that they do block port 25 on an individual basis. secure-port25@comcast.net appears to be the address for communicating with them about it for anyone who may be blocked.

As for changing your IP, if they are supplying IPs via DHCP then they may have a long expiry delay for clients. The easiest way to force an IP change is to switch your router from DHCP to manual, duplicate the settings and change your IP address manually. If you then switch back to DHCP you will get the new address, not the old one. On some services, changing the DHCP client ID and releasing the IP is enough to get a new number.

MAC addresses adhere to a standard format. Make up an address that does not use a registered vendor code and you won't have to worry about it conflicting with any device on the same subnet. (MAC addresses also aren't routed past the next hop.) Here is a list of vendor codes.
http://standards.ieee.org/regauth/oui/oui.txt

Reply

Answer 15

CHP Author

Level 1

104 points

Jan 7, 2006 1:10 PM in response to JulieJulieJulie

Ah, right you are JulieJulieJulie. So I guess in essence Comcast is preventing users from setting up their own mail servers, so I couldn't open port 25 to traffic if I wanted. Now as I'm thinking about it, I'm not making port 25 mailings. I'm simply sending email directly to my work ISP's port 25 SMTP server directly from a Comcast-owned IP address, and that's where the problem lies. I'm not directly connected to their service, so any foreign mail requests get scanned for blacklisting before they decide whether or not to accept them.

Interestingly, my work ISP only rejects blacklists where individual IPs are listed, and not those that list entire blocks (as SORB and othes do with Comcast IPs). While that allows me to "telecommute" rather easily as far as email is concerned, it seems to me if another Comcast user has allowed their machine to be hijacked as mine appears to have been, then that connection could be used to send out spam via my work email account. I should discuss this with them.

Reply