Question

Intuit IPs found in Spamcop blocking list preventing vendors from sending invoices

Forum|Forum|4 years ago
April 6, 2022
18 replies
0 views

In the past 7 days, I have 145 emails from various vendors who are being flagged due to the sending IP address being found in Spamcop's blocking list. And 153 in the past 30 days. The IP's in question have varied, however the two that seem to be reoccurring are:

167.89.82.160
167.89.58.229 (this seems to possibly have been removed from the block list)

An additional one comes up as failing to retry when the email is deferred via greylisting:
167.89.58.138

None of these IP's are listed in Intuit's list of servers found here: https://quickbooks.intuit.com/learn-support/en-us/help-article/manage-customers/3-solutions-customers-receiving-emails/L9ypZGV4I_US_en_US?uid=l1o750yj

And this seems to have started on March 30th 2022 based on my email logs.

Since I'm not a customer, I don't have a direct line to support.

QuickBooks Online

J

julezmbiAuthor

Additional screenshot of the blocked IP from Spamcop.

J

julezmbiAuthor

@AlexV while I appreciate your response. I don't believe you understood the issue. Or did not read the issue completely.

The issue at hand is not with a vendor, nor is it with my company accepting email.

The problem is that a pair of Intuit's mail servers are appearing on a public spam blocklist called Spamcop. I provided the screenshot of the block that's visible for any and all to see. If any company's mail filter utilizes this public spam blocklist (as many do) Intuit's email will be rejected.

Additionally, the IPs that are appearing are NOT in Intuit's documented mail server list.

The emails that are being rejected due to the IP's being on the blocklist are from [email address removed] not from [email address removed]. And we won't be blindly allowing that address through to skip mail protections.

J

julezmbiAuthor

The link you posted "Connect your email to QuickBooks"
https://quickbooks.intuit.com/learn-support/en-us/help-article/account-management/connect-email-quickbooks-desktop/L00d2EZek_US_en_US?uid=l25q39sy

Doesn't have a single one of Intuit's IP's or servers on it.

K

KDS4

This issue is getting worse, the sending IP addresses of Quickbooks servers have now been blacklisted in:

15 different databases for 167.89.58.138:

23 different databases for 167.89.58.229:

11 different databases for 167.89.82.160:

Any company that uses decent mail filtering software will automatically block these emails before data acceptance, and permitting these IP addresses with so many black-listings is not an option.

Quickbooks needs to remediate these listings ASAP or we will be looking for alternatives and recommending our customers also do the same.

Fiat Lux - ASIA

This issue is highly technical related to IT security and is not related to any accounting issues. I'm not sure most of the first layer support team and Intuit Community team is familiar with the terms spam filters, firewalls, endpoint security and more. You should send a private message to any Community Moderators to escalate this issue to their IT Security team and fix it immediately.

Otherwise, explore another accounting app and purchase a 3rd party conversion service if required.

K

KDS4

Thank you for forwarding this through to your team, LieraMarie_A - I appreciate the prompt response.

Have a great day.

K

KDS4

I've had no luck seeking support for this issue on behalf of our clients that are affected, so we have provided them with an explanation on what the issue is along with supporting information, and recommended that they raise the issue with Quickbooks Support directly.

This isn't a scalable solution by any means and those that have raised the issue with support report back that "...Quickbooks took a look and couldn't find any issues" or have misunderstood the issue entirely.

Just re-checking the status of the sending IPs and as expected, they've been added to additional RBL databases...

6 additional black-listings for 167.89.82.160 since my previous post.

9 additional black-listings for 167.89.58.138 since my previous post.

J

jrubow

I just created an account so I could comment on this as well. I am not a QB user, but we are seeing the same issue with one of our vendors. They can't send us invoices because of the IPs being listed in Spamcop. I am also surprised that none of their other customers are reporting this. We also don't want to add the IPs in to just blindly allow potential malicious emails thru. Let's go quickbooks, get those IPs out of your send list or get Spamcop to remove them.

F

flyinhawaiian968

Same thing here, SpamCop is reporting this ip every time my vendor sends me an invoice:

Event:	rejected
User:	-remote-
Domain:
From Address:	bounces+2327135-1053-admin=[email address removed]
Sender:
Sent Time:	Jul 7, 2022, 11:17:23 PM
Sender Host:	o4.e.notification.intuit.com
Sender IP:	167.89.82.160
Authentication:	unauthorized
Spam Score:	0
Recipient:	[email address removed]
Delivery User:	(removed for security purposes)
Delivery Domain:	(removed for security purposes)
Delivered To:
Router:	reject
Transport:	rejected
Out Time:	Jul 7, 2022, 11:17:23 PM
ID:	1o9gMr-0002KQ-nJ
Delivery Host:	o4.e.notification.intuit.com
Delivery IP:	167.89.82.160
Size:	0 bytes
Result:	JunkMail rejected - o4.e.notification.intuit.com [167.89.82.160]:8954 is in an RBL: Blocked - see https://www.spamcop.net/bl.shtml?167.89.82.160

I will never upgrade my incredibly-old version of quickbooks, it works without issue, unlike all this garbage of online versions. This is clearly an issue with Intuit's IT department's inability to keep their mailservers off blacklists!

As for not being reported very much, I can guarantee you that if quickbooks customers realized their emails were being blocked by the servers, they'd be calling in. As for my vendor, he's clueless about this issue and whined that I hadn't paid an invoice he sent weeks before contacting me about it. This has been going on for 3 months now! I researched the issue, found his email blocked by my mail service provider's spam system (Spam Cop is what they use), explained to him its not on me but on him to get Quickbooks to get their servers whitelisted on there, and it obviously went right over his head as he's not a tech person. I would bet that there's thousands of folks out there in the same boat, inept at IT issues and clueless as to why its happening and who to contact!

And just how many of these folk's ISP's are just as clueless and telling their customers that they should "just try sending it again, it should go through shortly"?

As the official "quickbooks community", it should be monitored 24/7 by quickbooks and they should automatically report these types of findings with more than a handful of similar issues posted here! Amazing that a company like quickbooks can't figure out how to keep their mailservers off the blacklists of the internet, and even more amazing that after 4+ months of being reported, it STILL hasn't been fixed! Each and every one in the IT department should be immediately fired and a new batch of techs hired to get it running!

Ami_D

Hello all. I’m Ami, one of the Moderators here in the QuickBooks Community. I want to thank everyone that participated in this conversation with more information about outbound emails being blocked/blacklisted.

I've escalated this to our engineering team for further investigation and will return to this thread with updates as I have them available.

Thank you to everyone for your diligence on this. We’ll do everything we can to find a swift resolution and make sure your invoices and other outbound emails are delivered reliably.

J

julezmbiAuthor

Thanks @Ami_D I appreciate the response. However, I've heard this story before from @QBCares on Twitter after receiving a private message from them on the matter. I've never heard anything back. I feel there's plenty of information in this thread at this point to resolve the issue. So I'm hoping either engineering can reach out to the community for testing, or if you can keep us updated in the community on the status, that would go a long way in knowing that the issue was at least top of mind.

As I mentioned to @QBCares I'd be more than happy to provide any necessary information from our side, and test if needed. Additionally, if these 3 IP addresses are valid IPs for QuickBooks invoicing, they really need to update the KB article referenced throughout this thread and in my original post. While it shouldn't be necessary that we add IP addresses to an allow list, I want it documented properly if that's the route we must go. This is obviously not a solution to most as you've seen however.

M

mBrand

Hi All!

Late to the conversation here... Has there been any movement on this issue? I am both a QBO user and small scale hosting provider, and I am seeing that WHM/cPanel keeps blocking the QBO emails based on the Spamcop issues. It feels like an unacceptable issue to let lapse on Intuit's part and is highly frustrating.

From the QBO interface side, they show as bounce errors in my account.

Curious if anyone has had any luck with a technical conversation.

Thanks for your persistence @julezmbi.

R.

T

T3chNoid

This just in from Richard at spamcop.....

"This is a shared IP belonging to Intuit, which has been sending spam to
our traps and/or users. We have seen a large increase in spam from Zoom
IP space, causing more of their IP addresses to be listed. Intuit has a
bug in their systems that allows spammers to exploit and send large
volumes of spam through their servers. Until Intuit fixes this exploit
so they stop sending large volumes of spam to our traps their IP
addresses will be subject to listing just like any other spam source.

You will have to discuss the problem with Intuit and perhaps ask to be
moved to an IP that doesn't send spam."

QuickBS? Are you listening? You can thank me later.

PS: I just emailed the president of Intuit (yes really) inviting him to view this thread.

T

T3chNoid

This just in from spamcop support....

"I'll tell you what the issue is. If it was just run of the mill
advertising spam we might throw a little less weight at it so it backs
off earlier. But, this is completely different and as you suggest,
Intuit seems completely oblivious to it.

Scammers have figured out a way to send invoices out saying you've been
charged for tech support, Geek Squad, anti-virus, etc. The invoices
include a phone number to call which happens to be the same tech support
scam centers calling us everyday trying to defraud us out of money.

These seem to be more realistic because you actually have something in
front of you with official logos and other information. We view these as
high risk of success, so hit them hard.

Here's a sample of a 'Paypal' one. Click 'view entire message'. Note
the phone number shows up on many fraud watch sites. We're seeing tens
of thousands of these every day."

QuickBS, are you out there?

N

Noonecares2

I am a server administrator for ServerMatter and I have dug in on this issue for our clients. Since we host email AND we use QuickBooks online our own clients were saying they never got our invoices. That's a real problem.

However, since we actually host the email for some of those clients, we are able to see both sides of the coin. So we created a bogus email account on our server a bogus Invoice on QuickBooks Online which we them emailed within QuickBooks and as expected - never got the email.

We figured out why and hopefully it will help some of those on this post.

In case Intuit will not allow the post of the video, you can searching youtube for the words servermatter QuickBooks spam. The video is here: https://www.youtube.com/watch?v=7DjBV2iB48g

Ami_D

Hi everyone! I wanted to update one more time before we hit the weekend. I’m connected with the teams who are working on this issue, but don’t have any official communication to share just yet. As soon as I do, I will update you here again, or at the latest will check back in on Monday morning.

Thank you again to everyone who has contributed information and experiences to this conversation. I will be back with more soon.

J

jesse41

Some customers still not receiving my invoices. When will this be fixed?

Ami_D

Hi again everyone. My morning update turned into an evening update, but I’m still with you!

I spoke with the team today and they are currently implementing measures to fix this issue. Please know that this is a high priority for us and will remain a focus until fully resolved.

I will continue to update this thread as I am able to share more.

K

KDS4

Thank you for the update (and all of those that have contributed so far), I'll be checking back daily and hopefully have some good news to give our clients using QB soon.

J

JD93

Same issue here. We have been using QB for over 8 years now and suddenly more than half of the emails sent through QB are not getting delivered. We have customers ordering multiple times a day, some of the invoices get delivered some don't. I was added to an investigation... for several months now I get the same lame excuse email: Use the download button and send email manually - Time to look for a different provider if QB doesn't get their IPs from the spam list.

C

cirrusmarketing

Several months? About how long has this been going on, would you know?

J

JD93

Around 2-3 months now

E

emabc

I'm fed up with the delay in resolving this. I suspect this is affecting way more people, but that they aren't connecting the issue to the IP addresses. I googled "quickbooks emails bouncing" and went in circles through solutions that made it seems like the issue was on my end. I only found this thread because someone linked to it from another question. 185 emails bounced yesterday. I have clients complaining that they haven't gotten an email in MONTHS. Why is this not being prioritized?

J

jrubow

Because Intuit is still able to invoice and get money from you. If they were having this issue getting you invoices, believe it would have been fixed within a day or two of being reported.

T

TitusFFX

Apparently this is still going on and needs to be a way to keep them from being spoofed. On the last email it was like this.

Pretending to be Geek Squad using a known IP (Denver, CO) that is not associated with them to get you to open a pdf file with an auto loader trojan. Intuit E-Commerce Service ([email address removed]) is what it is spoofing to show this email since that is a listed ok for most email systems but not the actual originating email. Using a padded email address from [email address removed] using a SMTP at IP: 10.217.147.138 (Los Angeles, CA)

Show more replies

Sign up

Login with SSO

Login to the community

Login with SSO