Opened 8 months ago

Last modified 8 months ago

#13624 assigned Bug/Something is broken

162.247.75.110 (CLG Newsletter IP) blacklisted by SORBS due to spam sent by ggjalliance.org

Reported by: https://id.mayfirst.org/legitgov Owned by: https://id.mayfirst.org/jaimev
Priority: High Component: Tech
Keywords: Cleveland, SORBS Cc: lori@…, https://id.mayfirst.org/sha
Sensitive: no

Description

Dear Support Team,

The IP which processes the CLG Newsletter has been blacklisted by SORBS, due to a high volume of spam sent by ggjalliance.org. Moreover, my ticket request to de-list the IP by SORBS has been denied, due to the spamming by ggjalliance.org - according to SORBS.


Below are the details. I am asking for your to intervene and help as quickly as possible, as due to the attack on Syria, I want to send more newsletters before 21 April 2018, which is when SORBS actually wants to consider de-listing the IP.


Here is their response to my ticket:

Network 162.247.75.110/32: This host has been listed once before but is not eligible for delisting until at least Sat Apr 21 20:07:11 2018 GMT+0

We are setting this ticket to 'Rejected', as an action is required 
in your part before we can update our lists regarding the IP address(es)
you wrote to us about.

Action required: As you are requesting a delisting of an IP/Network
that has either sent spam recently or has sent so much spam that it 
exceeds our preset thresholds you must reply to this message justifying
your cause and why you think you should be delisted.

Someone will then review your case and reply accordingly.

Thank you

Son of Robbie the Robot on behalf of SORBS Support
SORBS Support

More info:

Spam record for address 162.247.75.110
Description:	Spam Received from this host
Record Created:	20:07:11 13 Apr 2018 GMT+00
Message ID (munged):	513*******************************32@******************RBS
Additional Information:	No Info
Currently active and flagged to be published in DNS
The following hostname is found within this spam.
ggjalliance.org	Hostname has been marked as hosting a spamvertised website/URL.

Another:

Spam record for address 162.247.75.110
Description:	Spam Received from this host
Record Created:	20:06:46 13 Apr 2018 GMT+00
Message ID (munged):	513*******************************32@******************RBS
Additional Information:	No Info
Currently active and flagged to be published in DNS
The following hostname is found within this spam.
ggjalliance.org	Hostname has been marked as hosting a spamvertised website/URL.

Here are the MX Toolbox records:

Checking 162.247.75.110 against 94 known blacklists...
Listed 2 times with 0 timeouts

	Blacklist 	Reason	TTL	ResponseTime	
 LISTED	SORBS NEW 	162.247.75.110 was listed  Detail	3600	224	Ignore
 LISTED	SORBS SPAM 	162.247.75.110 was listed  Detail	3600	213	Ignore

Any help you can provide would be really appreciated, due to the major news stories breaking this weekend that CLG needs to cover.


Thank you,
Lori Price
www.legitgov.org

Change History (5)

comment:1 Changed 8 months ago by https://id.mayfirst.org/legitgov

Even though it's a Saturday, is it possible for someone to help with this? I am hesitant to send any newsletters until the SORBS block is removed, as many people will not receive them.
Thank you,
Lori

comment:2 Changed 8 months ago by https://id.mayfirst.org/jaimev

  • Cc https://id.mayfirst.org/sha added
  • Owner set to https://id.mayfirst.org/jaimev
  • Status changed from new to assigned

Sorry Lori, I'm just getting to this now. Also copying sha from ggjalliance.org since SORBS is reporting the spam coming through our bulk.mayfirst.org mail servers contains links to the gjalliance.org site . I haven't confirmed this yet but want to make sure everyone is notified.

comment:3 Changed 8 months ago by https://id.mayfirst.org/legitgov

Thank you, Jaime!
Lori

comment:4 Changed 8 months ago by https://id.mayfirst.org/sha

Hi there, thanks for looping me in, I don't understand what the link is to the ggjalliance.org site but is this related to the spam we've been getting through the contact page? (See ticket #13621) ~ Sha

Last edited 8 months ago by https://id.mayfirst.org/sha (previous) (diff)

comment:5 Changed 8 months ago by https://id.mayfirst.org/legitgov

Hi, the link to the ggjalliance.org website was cited by SORBS as the cause. (Please see above, under 'More info' and 'Another.') But, looking at Ticket #13621, I'm thinking spam will continue to be generated until the CAPTCHA and reCAPTCHA modules are installed/upgraded by ggjalliance.
Thank you,
Lori

Please login to add comments to this ticket.

Note: See TracTickets for help on using tickets.