I get an alert message when sending and/or forwarding emails in Thunderbird
I have just started having problems when I attempt to send and/or forward some Bigpond emails from Thunderbird. I get the following message "An error occurred while sending mail. The mail server sent an incorrect greeting: nskntcmgw08p Bigpond Outbound [OB105. Connection refused. 121.214.35.52 is listed on the Exploits Block List (XBL). Please visit http://www.spamhaus.org/xbl/ for more information." The message appears in the ;sent; folder but doesn't appear to be sent. Does anyone have any ideas? Thanks,
Wšě wotmołwy (2)
While we await the outcome of July the 2nds vote, you might like co contact Telstra and advise them that the spam blocking list they subscribe to has them blocking you as a spammer. They will probably try and tell you it is tour copy of outlook, that is what they told me last time I rang. That the product was not installed was irrelevant to the script jockey on the phone. Although any fairy tale will usually do.
To resolve this issue you will probably need to get through the level two support folks at bigpond. They are the ones that can do more than read scripts and are expected to actually understand how it all works.
On to the facts. The IP address 121.214.35.52 is most probably you. It is the IP address Telstra have assigned you. It appear from what I have looked at to be connected to the Melbourne suburb of Heatherton. But those Geo locators are often wrong. Mine gives an Adelaide suburb and it is off by hundreds of Kms.
In Telstras network it translates to CPE-121-214-35-1.lnse4.win.bigpond.net.au.
Checking with spamhaus, I get the following information.
IP Address 121.214.35.52 is listed in the CBL. It shows signs of being infected with a spam sending trojan, malicious link or some other form of botnet.
It was last detected at 2016-06-21 10:00 GMT (+/- 30 minutes), approximately 13 days, 20 hours, 29 minutes ago.
This IP is infected (or NATting for a computer that is infected) with the Conficker botnet.
You can rad the full text here http://www.abuseat.org/lookup.cgi?ip=121.214.35.52
This is serious information if you are using a fixed IP address from Telstra/Bigpond as it means your computer is infected. However as the "range" of IP addresses is one of those allocated for dynamic allocation, it may also be your neighbour or someone else in your exchange area that has previously had that IP address allocated. But do not shrug and go not me. This is not that tea time phone call from Microsoft Support telling you your computer is infected and contaminating the internet. (Just to be clear that phone call is an identity thief.)
So please run the scanners in the full report, just to be sure it is someone else and not you.
Either way, you are going to have to contact bigpond support. as the technical owner of the IP address they have to ask for it to be delisted once you are given the all clear.
Note here that spamhaus is a service Bigpond subscribe to. So this is Bigpond rejecting their own address because their spam filter listed one of their own address..
A fix can only be made by Bigpond as far as sending mail. If you have kids with their own computers, they are a good place to look for the virus. Especially if you have a teenage torrent freak.
Thanks Matt. I will follow this through.