Email Security.cloud

 View Only
  • 1.  Filtered traffic to messagelabs MTAs on port 25

    Posted Jan 22, 2016 10:24 AM

    Hello,

    Our customer reported us a problem with sending mails to some domain, which uses messagelabs MTAs.

    I've discovered, that traffic from our 2 IP adresses - 94.158.130.2 and 94.158.130.5 on port 25 is filtered while i.e. port 80 is not filtered (but is refused) and all MTAs are responding to icmp echo requests.

    Using another IP address on the same machine no traffic is filtered and all is OK.

     

    $ telnet cluster5.us.messagelabs.com 25 -b 94.158.130.5

    Trying 216.82.250.83...

    Trying 216.82.250.51...

    [after few minutes]

    ^C

     

    $ telnet cluster5.us.messagelabs.com 80 -b 94.158.130.5

    Trying 216.82.251.36...

    Trying 216.82.242.34...

    Trying 216.82.242.147...

    Trying 216.82.241.195...

    Trying 216.82.250.83...

    Trying 216.82.250.51...

    Trying 216.82.242.131...

    Trying 216.82.250.99...

    Trying 216.82.251.35...

    telnet: Unable to connect to remote host: Connection refused

     

    $ ping cluster5.us.messagelabs.com -c 2 -I 94.158.130.5

    PING cluster5.us.messagelabs.com (216.82.251.36) 56(84) bytes of data.

    64 bytes from mail152.messagelabs.com (216.82.251.36): icmp_seq=1 ttl=237 time=187 ms

    64 bytes from mail152.messagelabs.com (216.82.251.36): icmp_seq=2 ttl=237 time=187 ms

     

    I've checked on site http://ipremoval.sms.symantec.com/lookup/, that:

    The IP address you submitted, 94.158.130.2, does not have a negative reputation and therefore cannot be submitted for investigation.

    The IP address you submitted, 94.158.130.5, does not have a negative reputation and therefore cannot be submitted for investigation.

     

    What is the reason of this filtering?



  • 2.  RE: Filtered traffic to messagelabs MTAs on port 25

    Broadcom Employee
    Posted Feb 02, 2016 05:52 PM

    Hello, 

    With regards to this issue, both of the sending IPs were getting throttled due to high spam rate. We've seen spam traffic being sent from them as recent as Sep 1, 2015. We've just cleared them both, so you should no longer be seeing connection refused errors. 

    Regards, 

    Art