Helping a client whose PC was infected with a trojan used to send email via SMTP. I've cleaned their PC and doubled-checked with a few online tools. Their IP was blacklisted and is still listed but says "Down for 53 days". What does this phrase actually mean? That time coincides with me cleaning the PC.

enter image description here


It means whatever source you chose to check on the IP address hasn't been able to get a response from that IP for 53 days.

However, if that is a PC as you say, it should not be surprising. PCs don't act as servers, which is normal. You must ask yourself why did this PC acted as a server 53 days ago? If the answer is "because the malware that you cleaned had been running malicious server software", then seeing this message is actually a good thing.

  • I believe the blacklisting was due to the IP address being reported to the blacklists for sending out spam with a Trojan being the most likely cause. I forgot to add the screenshot earlier. I also blocked port 25 outbound on their windows firewall. They use Google mail so there is no reason for their PC to send any SMTP email. – munrobasher Jan 23 '17 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.