Received the following explanation from the admins of cbl.abuseat.org.

 

This may be an issue down the road as rbls become more aggressive:

 

 

> In the vast majority of cases (well over 99.99%), seeing an individual IP address use a variety of different names indicates that the machine is >infected with a spam trojan or proxy.

> 

>In those rare instances where it is a IPSwitch Imail, WorkGroupMail or Ensim mail sending software or certain NAT configurations (ie:

>BellSouth shared hosting) fronting multiple independent domains, we permanently remove it from the list.

> 

>IPSwitch Imail and WorkGroupMail servers, for example, attempts to simulate being different mail servers, one for each customer domain.  In doing so, it >copies the domain name through as the HELO domain.  On the other hand, when anti-spam software sees a mail server apparently not able to make up its mind >as to WHO it is, they understandably get very suspicious.

> 

>If you are using Ipswitch Imail or WorkGroupMail we would recommend that you ask the software vendor to add an option to their software to avoid this >game playing with HELO strings, largely because many other anti-spam techniques and services use similar algorithms, and both of us would be better off >if we don't get surprised months down the road when you install another one of these things.

> 

>We're sorry for the inconvenience this may have caused.

> 

 

 

Justin Dixon, CCNA

CyberSharks.Net, Inc.

http://www.cybersharks.net

 

 

 

Reply via email to