Home page logo
/

nanog logo nanog mailing list archives

RE: Cisco Ironport and Senderbase...how to get delisted?
From: up () 3 am
Date: Wed, 17 Aug 2011 14:09:53 -0400


We weren't listed in the PSBL.  First thing I did was a few multi-DNSBL lookups
and only found a couple of obscure (to me) ones, which I immediately filled out
for delisting.

Interestingly, comcast.net was BLing us, complete with URL to do apply for
delisting.  I did, and got a response that we weren't listed.  I don't date take
down re-routing just yet.... :-/

Just went through this the other day.  In our case once we removed the IP
from the PSBL, our senderbase reputation went back to neutral within about
an hour or two.  Seemed to be pretty directly related.  I suspect senderbase
checks a handful of "reliable" BL's and your IP reputation is greatly
affected by listings in them.  As far as I can tell there is no way to
contact them to expedite things.  Worse is this one:

http://www.commtouch.com/Site/Resources/Check_IP_Reputation.asp

Unless it's just me, that page is broken and it's the only way to check
listings or request removals.

Andrew

-----Original Message-----
From: up () 3 am [mailto:up () 3 am]
Sent: Wednesday, August 17, 2011 1:58 PM
To: nanog () nanog org
Subject: Cisco Ironport and Senderbase...how to get delisted?

We had two users fall for a phishing email recently, and of course the
result was
that he gave his user/pass to a spammer.  We caught one of them in time, but
the
other got out many thousands of spam the other night before being
discovered.

I am in the process of cleaning this up.  Spamcop and others were good about
delisting us promptly.  Others will within the next day.

However, "Senderbase", apparently used in Cisco's Ironport, will let you
look up
your IP and tell you that your reputation is "poor", but offers no way to
get
delisted.  It refers you to Spamcop, which I imagine they rely on for
listings,
but not delistings.

For now, I'm re--routing per domain to a second server, but I'd appreciate
any
tips if there are any.  Seems a lot of .edu's use senderbase.




-----
No virus found in this message.
Checked by AVG - www.avg.com
Version: 10.0.1392 / Virus Database: 1520/3840 - Release Date: 08/17/11





  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault