Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 9 replies
  • Subscribers 1 subscriber
  • Views 8292 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

RBL false positive with cbl.abuseat.org

Koulgar
Hi all,
i have a problem with the smtp Proxy. 
I get a false positive from "cbl.abuseat.org" .
If i deactivate "Use recommended RBLs" and add 
"black.rbl.ctipd.astaro.local" and 
"cbl.abuseat.org"
manually. 

I check the ips in "cbl.abuseat.org" Lookup without an entry in database. 

Astaro said  
2011:05:12-08:39:27 free exim[7095]: 2011-05-12 08:39:27 exim 4.69 daemon started: pid=7095, no queue runs, listening for SMTP on port 25 (IPv6 and IPv4) port 587 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)

2011:05:12-08:39:36 free exim[7095]: 2011-05-12 08:39:36 SMTP connection from []: (TCP/IP connection count = 1)

2011:05:12-08:39:37 free exim[9119]: 2011-05-12 08:39:37 H= []: Warning:  profile excludes greylisting: Skipping greylisting for this message

2011:05:12-08:39:39 free exim[9119]: 2011-05-12 08:39:39 id="1003" severity="info" sys="SecureMail" sub="smtp" name="email rejected" srcip="" from="" to="@" size="-1" reason="rbl" extra="cbl.abuseat.org"

2011:05:12-08:39:39 free exim[9119]: 2011-05-12 08:39:39 H= []: F=> rejected RCPT @>

2011:05:12-08:39:39 free exim[9119]: 2011-05-12 08:39:39 SMTP connection from  []: closed by DROP in ACL


When i remove "cbl.abuseat.org" from 
Extra RBL Zones the mails get through .. 

but thats no option for me 

pls help .. 

thnx in advanced 

Koulgar


This thread was automatically locked due to age.
Parents
  • 0
    put the ip into abuseseat.org's ip checker.  if it comes up positive there's a reason.  That ip probably has a compromised box on it somewhere(especially if the ip has a NAT that is serving multiple boxes).

    CBL Lookup
    The CBL FAQ

    honestly given abuseat's reputation i highly doubt it is really a false positive.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

Reply
  • 0
    put the ip into abuseseat.org's ip checker.  if it comes up positive there's a reason.  That ip probably has a compromised box on it somewhere(especially if the ip has a NAT that is serving multiple boxes).

    CBL Lookup
    The CBL FAQ

    honestly given abuseat's reputation i highly doubt it is really a false positive.

    Owner:  Emmanuel Technology Consulting

    http://etc-md.com

    Former Sophos SG(Astaro) advocate/researcher/Silver Partner

    PfSense w/Suricata, ntopng, 

    Other addons to follow

Children
  • 0 in reply to William Warren
    OK, here just a few of the Servers like to send mails ...
    dunno if its allowed to send official IPs here so  just im me if you wanna test yourselfe
    Seems to me that cbl is ok but the astaro recognize the server as false positive in the SMTP proxy.
    abter configuring the RBL server manually and removing cbl from the list everything works like normal



    CBL Lookup
    IP Address IP1 is not listed in the CBL.


    rejected" srcip="IP1" from="************x" to="yyyyyyyyyyyyyyyy" size="-1" reason="rbl" extra="cbl.abuseat.org"



    CBL Lookup
    IP Address IP2 is not listed in the CBL.


     srcip="IP2" from="************x" to="yyyyyyyyyyyyyyyyyyyy" size="-1" reason="rbl" extra="cbl.abuseat.org"



    CBL Lookup
    IP Address IP3 is not listed in the CBL.



    srcip="IP3" from="******************" to="yyyyyyyyyyyyyyyyyyyy" size="-1" reason="rbl" extra="cbl.abuseat.org"


    thnx for help ..
Cookie Information Banner