The IP 85.234.223.210 was detected most recently at:

2009:04:05 ~07:30 UTC+/- 15 minutes (approximately 13 hours ago)

sending email in such a way as to strongly indicate that the IP itself
was operating an open http or socks proxy, or a trojan spam package.

You will need to examine the machine for a spam trojan or open
proxy. Up-to-date anti-virus tools are essential.

If the IP is a NAT firewall, we strongly recommend configuring the
firewall to prevent machines on your network connecting to the Internet
on port 25, except for machines that are supposed to be mail servers.

Note: 85.234.223.210 was found to be using the following name as the HELO/EHLO
parameter during connections:

localhost.localdomain

Which is an illegal name according to the RFC2821 SMTP mail
protocol standards. RFC2821 requires that the machines claim names
that are a fully qualified domain names or IP addresses enclosed
in square brackets.

You will need to investigate why this is happening, and stop it from
doing that.

This is usually a spamware/trojan infection. In the off chance
that it isn't, we recommend you examine your mail server configuration
and ensure that your mail server is using an appropriate domain name.

One way of testing whether your mail server is misconfigured
is to send an email through it to helocheck@cbl.abuseat.org. You will
get a virtually immediate rejection. Examine the error message,
and you should see something like:

#5.1.1 SMTP; 550 Your HELO name for IP address 1.2.4.6 was "smtp"

It should be the fully qualified domain name for your mail server.
Like "mail.example.com". If it's localhost.domain, or things without
".", this is what you need to fix. If the test DOES NOT show an
invalid HELO, that means that something else on your computer is
emitting it, and you'll need to identify what it is and fix or
remove it.

Variations on "localhost" at best suggest that you're running
relatively old mail server software that hasn't been configured.

Some old versions of sendmail (particularly those on Linux),
and several Perl mail modules (eg: Net::SMTP, "SendEmail"
and "CheckUser" programs/modules) default to these values, and need
to be configured properly.

Information on configuring sendmail can be found here:

http://cbl.abuseat.org/sendmailhelp.html

More information on these detections in general (including
specifics on several Perl modules) can be found here:

http://cbl.abuseat.org/lh.html

Apparently the "MXLookup" plugin for SpamPal helos as localhost.
Turn it off until you can get a fixed version. It is unknown
as yet whether a fixed version is available.

If you're using fetchmail: older versions of fetchmail almost always
use "localhost". The latest version (as of 2006/02/22 is 6.3.2) will
use "localhost" if the gethostname() function fails. You should upgrade
to the latest version, and make sure that gethostname() returns the
fully qualified domain name of your machine - which will probably
involve mucking about with /etc/hosts and sethostname/setdomainname.
If all else fails, hack the source.

If you're running Smartmax Mailmax, please apply the changes documented
here: http://support.sightmax.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=- 229&nav=0,8,27

Useful links:

http://www.ftc.gov/secureyourserver/
http://spamlinks.net (see "Securing your System" and "proxies")
http://www.fr2.cyberabuse.org/?page=abuse-proxy

For more information on securing NAT firewalls/gateways, please
see http://cbl.abuseat.org/nat.html




This entry has already been delisted from the CBL. Unless otherwise
stated, the CBL will relist this IP if the underlying issues are not
resolved, and the CBL detects the same thing again.



-- Jay, CBL Team