> On Mar 24, 2017, at 1:16 PM, Robert L Mathews <li...@tigertech.com> wrote:
>
> Over the last two days, our outbound customer mail servers have been
> repeatedly listed on the Spamhaus CSS ("snowshoe spammers"). This is
> odd, because unless I'm misunderstanding, the Spamhaus CSS isn't
> supposed to list "normal" mail servers (ours send hundreds of
> individual, non-bulk messages per hour; we're a hosting company).
>
> Has anyone else had a similar experience?
>
> It's certainly possible that one of our customers is sending to a
> spamtrap or something like that, but despite many hours poring over
> logs, I've been able to find no correlation with the listings and
> particular messages. And our abuse queues don't show anything unusual.
>
> I've so far been able to use the Spamhaus form to delist them, but I'd
> like to know the cause to put a permanent stop to it. Unfortunately, the
> Spamhaus CSS page doesn't show the reason for individual listings, and
> provides no contact address to get details about them. (You can contact
> them about other SBL issues, but not CSS ones.)
>
> Example IP addresses involved, if anyone cares, are 208.80.4.152 and
> 208.80.4.154.
>
> If anyone has had similar trouble and has any suggestions, I'd love to
> hear. Thanks!
Write to spamhaus and ask. It could be one of your customers doing
something odd, it could be a misfire on something at spamhaus. If
you've done some due diligence before you write to them (with the IP
in the subject line, ideally) odds are good that they'll take a look and
give you a pointer in the right direction.
Cheers,
Steve
_______________________________________________
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
