Today a few email accounts on our mail server were compromised and the accounts used to send spam. The credentials for these accounts were somehow revealed (possibly a keystroke recorder on a client's computer) and were accessed from Nigerian IP addresses. We discovered over 250000 messages in our mail queue being sent from these accounts.
Due to the flood of spam messages leaving our mail server its IP address has been listed on some blacklists (so far we're aware of Comcast, Yahoo, AOL, Road Runner, Verizon, and Barracudacentral) which prevent messages sent from our server being accepted by these networks.
To solve the problem we've done the following:
- We've blocked the Nigerian IP addresses at our firewall
- The passwords have been changed on the compromised email accounts
- Spam messages which did not yet get a chance to leave the server have been deleted
- We've submitted unlisting requests for the blacklists we're aware we're on
- UPDATE: We've also changed our IP address for outgoing mail (see update 07 Sep 11:45 below for details)
If mail you send comes back undelivered with a failure notice indicating our IP is blacklisted, please forward the notice to us at hosting@strangecode.com.
In the meantime, you are welcome to use the SMTP server provided by your ISP (AT&T, Comcast) to send messages instead of the Strangecode mail server.
We're serious about email security and reliability, and are working our best to resolve this issue. Thanks for your understanding.
UPDATE—07 Sep 11:45: We're still waiting for Yahoo and other blacklists to remove our mail server's main IP. There isn't a way to expedite these types of requests; we're at the mercy of Yahoo's expediency. But instead of waiting, we've decided to change our mail server's IP address from 67.192.236.116 to 98.129.251.228, and update the DNS zones for all domains we manage. This should have zero impact for our clients, except perhaps email client software may display a security message indicating that the IP address has changed.
UPDATE—08 Sep 01:14: The new IP address is in place, and all DNS changes have taken place. Email is now being delivered successfully to all hosts, including Yahoo.
UPDATE—08 Sep 17:55: Apparently this issue has also effected receiving email; some customers have reported email delivery failures to their accounts due to the IP address being blacklisted. We've never known a blocklist to be used this way. In any case our change of the IP address has solved this issue too. Of course if any further issues are noticed don't hesitate to email hosting@strangecode.com.
Recent Comments