The tvScience Blog - Search Results

This is NOT How You Use a Spamhaus Blocklist

TFL are rejecting authenticated mail relayed through our servers due to one of the SMTP Received: headers containing an IP address listed at Spamhaus.

In this case, it's the mistaken & inadvertent use of the Spamhaus PBL where the error lies. A majority of e-mail sent from a home broadband connection will contain an IP listed in the PBL. TFL (or is it Capita?) are wrongly using the Spamhaus ZEN blocklist which is an aggregate of all the lists maintained by Spamhaus. This includes the PBL.

Here's the rejection message:

  REDACTED@tflcc.co.uk
    host smtp.tflcc.co.uk [80.82.130.162]
    SMTP error from remote mail server after end of data:
    550 5.7.1 92.40.249.10 listed at zen.spamhaus.org

The IP address TFL take an exception to is [92.40.249.10] which is indeed listed in the PBL. The crucial thing is that this IP has not connected to TFL's servers at all. Instead it has been plucked from the trace headers included in the message.

Spam to Your PayPal E-mail Address

As PayPal give your name and e-mail address away to its merchants (i.e: they effectively make it public) - we recommend our clients to use a throw-away or time-limited address for paypal accounts. The spam will be sent to your address using your full name so:

To: "Anthony Other" <another@example.com>

Currently the spam is promoting a fake goods site with the connivance of an ISP based in Hong Kong.

Subscribe to Wowcher?

The email offers promotion company is currently heavily promoiting itself on TV in the UK. There are some reports of non-subscribers receiving spam from this organisation (search online for those).

Here's an extract from the Wowcher T&C's:

We may disclose your information (including personal information) to other companies within the Daily Mail and General Trust plc group of companies (the "DMGT Group", see www.dmgt.co.uk for further information) and may use and share within the DMGT Group information that we learn from your interactions with us and other group companies within the DMGT Group.

Massagelabs Rejecting Phishing Reports

Of little importance in the great scheme of things, but MessageLabs are currently rejecting reports sent to LloydsTSB's reporting address:

2013-07-08 09:08:18 ** emailscams@lloydstsb.REDACTED SMTP error from remote mail server after end of data: host cluster1.eu.messagelabs.com [195.245.230.115]: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1)