Can't send email IP address blacklisted

[satatplymtree]

Hi, I have been unable to send an email through my Virginmedia connection since the end of January.

I saw a similar thread on this board and followed the instructions and reported it to netreport@virginmedia.com.

They replied asking me to pay for Gadget rescue. My systems have been checked and are free of viruses and malware. My email is set up to use authenticated SMTP. I have reset my Virgin router on numerous occasions and I have changed my email password three times.

I can send emails fine through webmail and I can send emails fine through my PC when connected to my neighbours wifi or tethered to my phone. I can't send emails when connected to my home virginmedia connection and my IP is still blacklisted and Spamhaus.

Replied to the net report team and they haven't replied for 10 days. I have spoken to the Virginmedia support team on 3 occasions and they aren't able to help or understand the problem.

Does anyone have any advice on how to get through to Virginmedia so they can understand the problem and fix it for me. I'm at my wits end.

Many thanks

[用心棒]

It would be helpful to see what, if any, error code is returned by the SMTP server in this situation. From a desktop or laptop device open a Command Shell in Window or otherwise a Terminal. and enter the following where username:password is replaced with your email address and password, i.e. richard.branson@virginmedia.com:Y54kpX5g:

curl -v smtps://smtp.virginmedia.com -u username:password

Do not post the resulting output here but instead review it for possible reported causes, i.e. VM error code; choosing to ignore this advice and posting the output here unredacted or incorrectly redacted may reveal your email address, password and / or public IP Address.

FYI if there is no issue then you should see the following output from the curl command:

⋮
> AUTH PLAIN
< 334 
> [Redacted]
< 235 2.7.0 SMTP350 Authentication successful for user [Redacted]
> HELP
< 214-2.0.0 This is cmsmtp ESMTP service help
214-2.0.0 This is cmsmtp ESMTP service help
< 214-2.0.0 To contact postmaster send email to postmaster@virginmedia.com.
214-2.0.0 To contact postmaster send email to postmaster@virginmedia.com.
< 214-2.0.0 For local information send email to Postmaster at your site.
214-2.0.0 For local information send email to Postmaster at your site.
< 214 2.0.0 end of HELP info
214 2.0.0 end of HELP info
* Connection #0 to host smtp.virginmedia.com left intact

Otherwise unsuccessful will look similar to the following:

⋮
> AUTH PLAIN
< 334 
> [Redacted]
< 525 5.7.13 Authentication Denied (VM320)
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, close notify (256):
curl: (67) Login denied

-- 
I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more
Have I helped? Click Mark as Helpful Answer and solved, or use  Kudos to say thanks

[satatplymtree]

Thanks here is the response from that

Trying 212.54.56.51:465...
* Connected to smtp.virginmedia.com (212.54.56.51) port 465 (#0)
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
* subject: CN=email.virginmedia.com
* start date: Nov 9 09:50:36 2022 GMT
* expire date: Dec 11 09:50:35 2023 GMT
* subjectAltName: host &quotsmtp.virginmedia.com" matched cert's &quotsmtp.virginmedia.com"
* issuer: C=BE O=GlobalSign nv-sa CN=GlobalSign GCC R3 DV TLS CA 2020
* SSL certificate verify ok.
< 220 csmtp6.tb.ukmail.iss.as9143.net cmsmtp ESMTP server ready
> EHLO Tinas-MacBook-Air
< 250-csmtp6.tb.ukmail.iss.as9143.net hello [REMOVED], pleased to meet you
< 250-HELP
< 250-AUTH LOGIN PLAIN
< 250-SIZE 52000000
< 250-ENHANCEDSTATUSCODES
< 250-PIPELINING
< 250-8BITMIME
< 250 OK
> AUTH PLAIN
< 334
> [REMOVED]
< 525 5.7.13 Authentication Denied (VM321)
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, close notify (256):
curl: (67) Login denied
MYNAME: *
MYEMAIL: *
RECEIVED: 11:06:34 03! /03/2023
OFFIPTYPE: ipv4

[MOD EDIT: Personal and private information has been removed from this post.]

[用心棒]

@satatplymtree, having chosen to ignore the warning not to post the curl output it is important that you change your password ASAP by signing in here Login to My Virgin Media | Virgin Media or resetting it here Forgotten your Password? | Reset Here | Virgin Media.

VM321 error indicating that too many unsuccessfully authentication attempts have been made in the last hour. Review which devices are attempting to send via the email account and either take them offline for an hour or reduce the frequency of sending.

[satatplymtree]

Thanks for your prompt reply. I have reset the account password.

As far as I know we haven't tried to send any emails from the system for the last 4 weeks. 😐

[satatplymtree]

Hi, I have just done another curl and the error code is VM304 what does that tell us?

Thanks

[coenoby]

---

@satatplymtree wrote:

 error code is VM304 what does that tell us?

---

That's just saying "Authentication denied". Are you sure you entered the correct password and email address in the curl command? That's the error you would get If one of those is mistyped in in the curl command.

If those details are right the next questions is are you still able to access the email account and send via VM webmail?

If Webmail comes up with "Account unavailable" error message then a password reset might well unlock the account.

Coenoby

[satatplymtree]

Thanks for your response.

Yes the password was correct when I ran the curl command and yes I can login to webmail with the same password and send/receive emails.

If I connect to a neighbours wifi or tether to my phones I can send emails fine and also the curl command shows a successful connection. 

The problem is only when I am connected to my home Virginmedia connection.

Do you have any idea where I can go from here?

Thanks

[coenoby]

---

@satatplymtree wrote:

If I connect to a neighbours wifi or tether to my phones I can send emails fine and also the curl command shows a successful connection. 

The problem is only when I am connected to my home Virginmedia connection.

---

Thanks for coming back with that. I agree that what you say does suggest that your IP address has been blacklisted, the strange thing is that the VM errors you are getting from the curl command do not appear to show that.

Have you actually checked whether your IP address is on a spam blacklist? If not you can do that by following these steps:

• When connected via your VM wifi, browse to https://whatismyipaddress.com/   and note or copy (Ctrl+C) the IP address
• then go to  https://check.spamhaus.org/  and paste (Ctrl+P) or type your IP address in to the "Search single IP...." box and click "Lookup"
• Your IP address may well be listed on the PBL (Policy Block List) and flagged up as an advisory but all VM home IP addresses should be listed on the PBL so that is not the reason you are unable to send emails.
• Post back if Spamhaus reports that the IP address is listed on any other blocklists, such as Spamhaus' Exploits Block List (XBL) for example.

If your IP is being blacklisted by Spamhaus it will be because they are seeing suspicious traffic coming from your IP address on a regular, continuous basis.

The most likely cause of that is that a smart device on your home network has been infected with malware and is sending out spam. That will not necessarily be coming from your laptop. It could be from any smart device on your network. In the past Amazon Firesticks (with unauthorised third party software) and Android devices (with software added from unapproved sources) have been found to be infected. One poster even reported that they had found it was their Ring video doorbell!

However, the first thing is to check whether your IP address is listed on Spamhaus.

Coenoby

[satatplymtree]

Many thanks for your reply once again. 

yes my IP address is showing on the blacklist (for sometime now) policy blocklist PBL. 

as far as I know I only have my MacBook set up to send emails. I don’t send from any other device and that has been checked for virus and malware. 

maybe there is another device on my network that has been infected. I will check to see what is connected to my router and see if there is anything suspicious. 

should the block clear itself once this has been done? 

many thanks