Overview

When performing message forensics, messages may be  discarded for the reason of ipblocked. These messages are discarded due to Sophos's Blacklisted Sender IP service. Reasons are identified by expanding the message details from the Mail Logs search pane.

Policy Rule:Sophos Blacklisted Sender IP
Discarded:For reason: ipblocked

There are two options that can be used to check on how Sophos categorizes these messages, that is through Sophos IP Lookup or directly from Sophos Email Appliance if the IP address is confirmed to be a spam by Sophos.

The following sections are covered: 

• Through Sophos IP Lookup tool
  
• Through Sophos Email Appliance
• Feedback and contact

Applies to the following products/versions:
Sophos Email Appliance
Sophos Email Appliance Virtual

Through Sophos IP Lookup tool

1. If the IP address is known to be incorrectly detected by Sophos, go to the link: https://www.sophos.com/en-us/labs.aspx. This will open the Sophos Labs homepage.
2. Enter the IP address in the textbox and submit. A page will be displayed, explaining the reason the IP was listed by the Sophos Blacklisted Sender IP service.

Through Sophos Email Appliance

1. Login to the Sophos Email Appliance.
2. From the Dashboard, under Sender Genotype Test, enter the IP address in question and then click Test.
3. It redirects to the Sophos Labs homepage where the same procedure in this section Through Sophos IP Lookup tool can be followed.

Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.

Feedback and contact

If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article.
This is invaluable to us to ensure that we continually strive to give our customers the best information possible.