Re: Website link for 204.249.70.10

Hello,

Jason E. Isla wrote:
> Before I try to delist our ip address, which is just an internal
> Microsoft Exchange 2000 server, I want to understand how and why we got
> listed in the first place.
> Here's the message I got:
>  
> IP: 204.249.70.10
> Input IP: 204.249.70.10
> Transport: socks4 <http://dsbl.org/relay-methods#SOCKS4relaying> 
> Input Port: 12683
> Message Received: 2005/08/25 18:17:26 UTC
> Message Sent By: bertd
> Extended Information for Transport:
> Connect to 205.231.29.241:25
>  
>  
> Full Message:
>  
> Message-ID: <GnD/zX0qraYis//+TsxgbMVI4biVs3W0@anonymous@invalid>
> To: <[email protected]>
> Subject: Open SOCKS4 Proxy test message
>  
> I think I took care of the problem by eliminating anonymous access to
> the virtual smtp server in Exchange, but don't know how to check.
> Can you help enlighten me a little?

The message didn't go through your Exchange server. There was an open 
socks proxy at port 12683. The unusual port number is indicative of the 
machine at that IP address being trojanned, probably as a result of a 
virus infection. A complete reinstall, including all security patches, 
is the best solution.

Regards, Paul.