In the domino server’s logfile, mail routing events, I found entries like these:26-08-2010 05:20:42 SMTP Server: Remote host 113.169.158.82 (.) found in blacklist at zen.spamhaus.org
26-08-2010 05:20:42 SMTP Server: Message from 113.169.158.82 (.) rejected by DNS blacklist filter
26-08-2010 05:20:42 SMTP Server: . (113.169.158.82) connected
26-08-2010 05:20:44 SMTP Server: . (113.169.158.82) disconnected. 0 message[s] received
Entries like these repeat several time a day with different ip-addressess, and this is happening for some weeks. Also on Domino servers of customers.
When I do a trace route to such an ip-address it starts with the local host name of the computer where I perform the tracert and it end at vdc.vn
SMTP mail is working normally (till now!).
Is someone trying to hack these servers?
Subject: Unless you have contacts in Vietnam, it is probably spammers looking for an open relay . . .
Have a look at WHOIS for their IP (113.169.158.82) e.g. at Whois - IP Address - Domain Name Lookup
If you put an SMTP server onto the Internet you are going to see this from time to time. You could consider hiding behind a mail cleansing service (‘in front’ of your SMTP server) e.g. Message Labs.
Subject: Resolves to a local host
Thanks for your reply. I checked the ip-address and found this:IP Address: 113.167.67.115
Host: localhost
Location: VN VN, Vietnam
Organization: VietNam Post and Telecom Corporation
The host “localhost” seems strange to me, because when I resolve our organisation’s ip-address, I found our ADSL provider’s host.
I also find this strange because the maillserver with this issue seems to resolve the ipaddress 113.167.67.115 to our local host:
Remote host 113.167.67.115 (<our server’s hostname>..local).
Subject: Could be forged DNS data (but IPs still work)
A quick check using some tools shows they did not like the DNS responses:
Trace 113.167.67.115 …
1 192.168.1.1 2ms 0ms 1ms TTL: 0 (No rDNS)
…
6 80.91.247.103 193ms 193ms 194ms TTL: 0 (hnk-b1-link.telia.net probable bogus rDNS: No DNS)
7 213.248.93.118 194ms 228ms 193ms TTL: 0 (vptc-ic-130050-hnk-b1.c.telia.net ok)
8 No Response * * *
9 No Response * * *
10 No Response * * *
11 123.29.6.86 510ms 495ms 499ms TTL: 0 (vdc.vn fraudulent rDNS)
12 113.167.67.115 520ms 498ms 515ms TTL:243 (localhost fraudulent rDNS)
but according to APNIC the IP block is registered to VietNam Post and Telecom Corporation :
role: VDC IPADMIN GROUP
address: Internet Building, Block II, Thang Long Inter Village
address: Nguyen Phong Sac str, Cau Giay Dist, Ha Noi
country: VN
phone: +84-912-800008
fax-no: +84-4-9430427
e-mail: hathm@vdc.com.vn
trouble: send spam reports to abuse@vdc.com.vn
trouble: and abuse reports to abuse@vnn.vn
so try starting with them since its their IP block.