On Wednesday, November 20, 2002, at 10:46 AM, Bill Cole wrote:If your logging is set high enough, you should be able to tell which machine is blacklisted by looking at them.
10:29:19 1 SMTP-158([65.32.1.41]) SPAM? Host is blacklisted per RBL relays.osirusoft.com with result [127.0.0.2]
10:29:19 1 SMTP-158(smtp-server3.tampabay.rr.com) SPAM? Recipient '<[EMAIL PROTECTED]>' rejected: sending host is blacklisted, "Please see <http://relays.osirusoft.com/> for more information."
I'm guessing this is the correct bit of stuff I need.
Yep.
Looks like the host is listed on several BLs, but I can't imagine Road Runner giving a crap.
Actually they do.
However, I don't see that 65.32.1.41 is currently listed on relays.osirusoft.com.
I've had some 'talking past each other' conversations with Joe Jared of Osirusoft about his listing policies (mainly in news.admin.net-abuse.email) and come away fully convinced that relays.osirusoft.com is an untrustworthy source of information on open relays. It is his practice to list sites as if they are relays (127.0.0.2) if they don't act precisely as he expects. If they accept test messages, they get listed for a day (my estimate, Joe doesn't say exactly...) while the tester awaits the relay. If they reject messages with a 4xx reply instead of a 5xx reply, they get listed and stay listed. In short, machines will be listed as 127.0.0.2 on relays.osirusoft.com even though they have never relayed any mail for any spammer or for any relay tester. Given what I know of RR Security, I would be unsurprised if they were doing something with their mail servers that confuses testers, and Joe is listing on uncertainty.
--
Bill Cole [EMAIL PROTECTED]
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[EMAIL PROTECTED]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
