RE: Website link for 216.104.150.202

We have completely reinstalled the compromised server as you said to remove
the Trojan virus. What a pain. We have also taken steps to prevent this from
ever occurring again, for instance the new server is running AVG 7.0 Network
edition with the latest updates. 


Thanks,

Philip Smith

IT Manager

CallingPost Communications, Inc.

www.CallingPost.com

[email protected]

706.312.2215

 

This message is intended exclusively for the individual or entity to which
it is  addressed. This communication may contain information that is
proprietary, privileged, confidential, or otherwise legally prohibited from
disclosure. If you are not the named addressee, you are not authorized to
read, print, retain, copy or disseminate this message or any part of it. If
you have received this message in error, please notify the sender
immediately by email or telephone at (866) 250-3733, and delete all copies
of the message.


-----Original Message-----
From: Alexey Lobanov (dsbl) [mailto:[email protected]] 
Sent: Tuesday, September 27, 2005 8:15 AM
To: Philip Smith
Cc: [email protected]; [email protected]; [email protected]
Subject: Re: [DSBL-Contact] Website link for 216.104.150.202

Hello all.

On 27/09/05 15:14, Philip Smith wrote:

> Dear Madam or Sir,
> 
> 	I have spoken directly with the president of GABN Georgia Business 
> Net (Mr. Clay Colvin, my ISP provider) and now on 2 different 
> coordinated occasions they have not received the confirmation email

That's really bad. It means that their mail system accepts messages for
[email protected] and kills them silently. I'm afraid, they have to locate
and fix this severe bug before any other actions. Note that DSBL server
records the queue tags assigned by GABN server; i.e., "2EF0C81EBAC". Those
tags may be tracked down inside of GABN mail system to locate the missing
messages.

> and are not blocking
> the email being sent. Please help me to resolve this situation as we 
> provide emergency messaging to thousands of citizens through 
> government organizations. The open relay issue which started this was 
> fixed on 8/29/2005.

Please note that this incidend does not seem to be a simple open relay.
Instead, it was open SOCKS proxy at non-standard port number; in most cases
it means some kind of trojan malware and requires full reinstallation of the
compromised system. Are you sure in your diagnostics?

As to practical recommendations. I can see that machine
eth202-cpost.gabn.net drops SMTP connections instantly. So, your only option
is to repair broken mail delivery for <[email protected]>.  All the test
messages have expired already, so they (in GABN) should request new test
(upon fixing the delivery problem, of course). DSBL team will be happy to
help in debugging; I see that this message has cc: to [email protected].

Alternatively, you may unblock your own mail receiver at
eth202-cpost.gabn.net and use your own address
<[email protected]> for delisting. See
http://dsbl.org/faq-listed#notmine for more details.

Best,
Alexey,
DSBL volunteer



> I have included the IP address as well as all of the history for the 
> removal request below. My office number is included below and my cell 
> is 706-836-0715. Thanks Philip Smith, IT Manager, CallingPost
Communications.
> 
> This server supports our www.message911.com site the emails are 
> information to first responder groups as well as other officials in 
> emergency
> organizations:
> 
> IP: 216.104.150.202
> State: Listed <http://dsbl.org/faq-listed> Listed in unconfirmed 
> (unconfirmed.dsbl.org): yes Listed in singlehop (list.dsbl.org): yes 
> Listed in multihop (multihop.dsbl.org): no Record last changed: 
> 2005/Aug/18 08:38:35 UTC Reverse DNS identifies server as: 
> eth202-cpost.gabn.net
> 
> 
> History
> 
> 2005/Aug/18 08:38:35 UTC          Listed in Unconfirmed (view message)
> <message?28828667> 
> 2005/Aug/18 08:38:35 UTC            Listed in Singlehop (view message)
> <message?28828667> 
> 2005/Aug/29 17:25:40 UTC      Removal Confirmation Sent EMail address:
> [email protected]
>                                                         Requestor IP:
> 24.214.45.254
>                                                         Message Report:
>                                                             
> 216.104.131.164 accepted message.
>                                                             Remote 
> host
> said: 250 Ok: queued as 4EA4E820E79
> 2005/Sep/15 15:22:00 UTC      Removal Confirmation Sent EMail address:
> [email protected]
>                                                         Requestor IP:
> 216.104.150.202
>                                                         Message Report:
>                                                             
> 216.104.131.164 accepted message.
>                                                             Remote 
> host
> said: 250 Ok: queued as 2EF0C81EBAC
> 
> 
> Messages from this host
> 
> 2005/Aug/18  08:38:35 UTC (view message) <message?28828667>  socks4 
> <http://dsbl.org/relay-methods>
> 
> 
> Support emails about this host
> 
> Initiate removal for this listing <removal?ip=216.104.150.202>
> 	
> Other DNS Based blackhole lists
> Check your status in other DNS Based blackhole lists 
> <http://www.dnsstuff.com/tools/ip4r.ch?ip=216.104.150.202>
> 
> 
> Thanks,
> 
> Philip Smith
> 
> IT Manager
> 
> CallingPost Communications, Inc.
> 
> www.CallingPost.com
> 
> [email protected]
> 
> 706.312.2215
> 
>  
> 
> This message is intended exclusively for the individual or entity to 
> which it is  addressed. This communication may contain information 
> that is proprietary, privileged, confidential, or otherwise legally 
> prohibited from disclosure. If you are not the named addressee, you 
> are not authorized to read, print, retain, copy or disseminate this 
> message or any part of it. If you have received this message in error, 
> please notify the sender immediately by email or telephone at (866) 
> 250-3733, and delete all copies of the message.
> 
> 
>