RE: Website link for 204.249.70.10

Hi Paul, thanks for the response.  That's pretty much the plan.  We've
replaced the Exchange server and are reloading that system.  Nothing
should respond on that address, but the host and domain will be the
same.  Should we still need to go through the delisting process?  The
e-mail addresses listing for the ip address are for are T1 provider
([email protected] and [email protected]).  They're tough to get
to, and we don't have access to those accounts.


Thanks,
Jason.


-----Original Message-----
From: Paul Howarth [mailto:[email protected]] 
Sent: Thursday, September 08, 2005 11:47 AM
To: Jason E. Isla
Cc: [email protected]
Subject: Re: [DSBL-Contact] Website link for 204.249.70.10

Hello,

Jason E. Isla wrote:
> Before I try to delist our ip address, which is just an internal
> Microsoft Exchange 2000 server, I want to understand how and why we
got
> listed in the first place.
> Here's the message I got:
>  
> IP: 204.249.70.10
> Input IP: 204.249.70.10
> Transport: socks4 <http://dsbl.org/relay-methods#SOCKS4relaying> 
> Input Port: 12683
> Message Received: 2005/08/25 18:17:26 UTC
> Message Sent By: bertd
> Extended Information for Transport:
> Connect to 205.231.29.241:25
>  
>  
> Full Message:
>  
> Message-ID: <GnD/zX0qraYis//+TsxgbMVI4biVs3W0@anonymous@invalid>
> To: <[email protected]>
> Subject: Open SOCKS4 Proxy test message
>  
> I think I took care of the problem by eliminating anonymous access to
> the virtual smtp server in Exchange, but don't know how to check.
> Can you help enlighten me a little?

The message didn't go through your Exchange server. There was an open 
socks proxy at port 12683. The unusual port number is indicative of the 
machine at that IP address being trojanned, probably as a result of a 
virus infection. A complete reinstall, including all security patches, 
is the best solution.

Regards, Paul.