CBL Problems

[hekri]

Hello


We also have Big problem with CBL, they dont give us any directinformation why blocking one of 10 the same configuration servers

We unblock, next day listed again. Write to cbl but they reply us that they dont have any information why block my IP.... Its not ok to block ip and dont give ovner direct raport WHY?!

Any sugestion why the list one of our ips?

[hikaro]

sound like everyone hving cbl problem as well, today i got it as well
now im bit worry if i will get blacklisted again
as i install csf and did necessary firewall to prevent this
as i know that i found some cgi script running on server

here a msg from cbl
PAY VERY CLOSE ATTENTION TO THE FOLLOWING

You can find out more detail on this by doing google searches for "YellSOFT DirectMailer" or "DarkMailer", including screenshots of the control panel this software installs on your web server (the control panel in Russian).

See, for example, Dark Mailer - Wikipedia, the free encyclopedia Serious issues with CGI script been run - EXPLOIT? - cPanel Forums

Note the references to "csf SMTP_BLOCK" and "WHM's SMTP Tweak"

This detection is that of a spammer who has broken into your web server (usually) via cracked or keylogged FTP credentials. Once they've logged in via FTP, they install perl scripts that do the spamming. CPanel and Plesk installations are the most common infectees, but others (including Apache) are also subject to this problem.

[Spiral]

Chances are you're IP showing up on CBL has little to nothing to do with
your server or any activity happening or not happening on it currently ...

CBL itself is having it's own set of issues right now and I really don't
recommend anyone using the SpamHaus blacklist databases (CBL/XBL/PBL, etc)
irregardless at the moment just because of the elevated false alerts presently.

SpamCop is still as reliable as always so no problems continuing to use their
databases but I would just avoid SpamHaus alone for the moment.