{"id":1401,"date":"2014-09-28T01:56:01","date_gmt":"2014-09-28T06:56:01","guid":{"rendered":"http:\/\/swildow.darktech.org\/wp\/?p=1401"},"modified":"2014-09-28T01:56:01","modified_gmt":"2014-09-28T06:56:01","slug":"backscatter","status":"publish","type":"post","link":"http:\/\/www.wildow.com\/blog\/?p=1401","title":{"rendered":"Backscatter"},"content":{"rendered":"

The Backscatterer.org IP list<\/h3>\n
\n<\/span><\/div>\n
tzink<\/a><\/span> <\/span><\/div>\n
22 Aug 2012 10:59 AM <\/span><\/div>\n
http:\/\/blogs.msdn.com\/b\/tzink\/archive\/2012\/08\/22\/the-backscatterer-org-ip-list.aspx <\/a><\/div>\n
<\/div>\n

 <\/p>\n

Office 365 (Exchange Online Protection, or EOP) frequently receives questions about the Backscatterer.org<\/a> IP blocklist.\u00a0 Customers call in and say \u201cYour outbound IPs for the service are on Backscatterer!\u00a0 What are you doing about it?\u201d This often occurs when people go to a 3rd party website, enter in our outbound IPs, and it says that our IPs are listed on Backscatterer.\u00a0<\/span><\/p>\n

Short version<\/strong><\/span><\/p>\n

EOP does not delist from the Backscatterer list. Generally speaking, when customers receive NDR messages indicating the message was blocked, it is not because the IPs were listed on Backscatterer but instead for some other reason such as a different IP blocklist, or due to content of the message. The details are in the bounce message and more details can be discovered searching support sites of the IP list responsible.
\n<\/span><\/p>\n

Long version<\/span><\/strong><\/p>\n

Backscatterer is designed to list IPs from mail servers that transmit backscatter mail \u2013 email servers that accept the email during the SMTP transaction, discover that they cannot deliver it, and then send a bounce back to the original sender.\u00a0 However, if the original sender is spoofed, then the bounce goes to the spoofed sender who may be an innocent victim.<\/span><\/p>\n

The below picture illustrates the legitimate case:<\/span><\/p>\n

\"image\"<\/a>
\nThere\u2019s nothing wrong with the above in the legitimate case because joe@example.com wants to know if his message was delivered or not.<\/span><\/p>\n

However, the following picture illustrates the backscatter case:<\/span><\/p>\n

\"image\"<\/a>
\nIn this case, joe@example.com receives a bunch of email bounces in his inbox that he did not send and this is undesirable, especially if the original message was spam.\u00a0 The on-premise mail server has different strategies to avoid this:<\/span><\/p>\n