EMail Server is on a blacklist

ALERT: 12/02/2016

Update: RESOLVED 12/02/2016

The following case was raised with the hosting provider and resolved at 8pm on the 12th of Feb. Not everyone was affected by this problem, there were 5 cases bought to my attention.

I have received 4 messages from people about error or bounce back messages being returned from some email addresses. They will look something like this:

host homestart-org-uk01b.mail.eo.outlook.com [213.199.154.87]

SMTP error from remote mail server after RCPT TO:<xxxxxxx@xxxxxxxxxx.org.uk;>:

550 5.7.1 Service unavailable; Client host [173.247.252.74] blocked using Spamhaus; To request removal from this list see http://www.spamhaus.org/lookup.lasso

(I have obscured the email address, they will all be different).

The red text offers the clue as to what is happening and what to do about it. Firstly if you see one of these make sure that you send a copy to me, and secondly click on the link in the message which goes to spamhaus.org and declare you are a user on this server and your domain is legitimate.

What has happened?

We are on a shared server, which means that in addition to every one I am hosting there are other people on there as well. If one of these other accounts is compromised somewhere and a hacker gets in, or one of the account holders is a spammer, then thousands of messages can be sent from the hosting. External companies and organisations have “honeypots” that trap spam messages and if they are detected then the spam source, in this case the server, is blacklisted. So everyone on that server is affected.

This is a very rare occurrence, the hosting company also does it’s own monitoring of traffic and generally detects spamming activity and traps it before it becomes a problem.

What have I done about it?

Starting last night I forwarded the error messages that people had sent to me and opened support tickets. I was not sure what the cause was. Having done a bit more research this morning and having been on chat with the hosting provider twice this morning, we have pin pointed the problem to a specific server where our mail is routed through, and confirmed that this server is on a blacklist.

So the hosting company are aware of it and addressing it. I will continue to monitor the situation.

Generally what they will do is switch all mail to another server IP address and then the problem goes away. I am waiting to hear if that has happened.

Who is affected?

Generally most mail will still get through and you will still receive email. However certain sources such as NHS, Government and local government and other large corporations will subscribe to blacklists to limit the volume of spam messages coming in. As most of you are charities then you will all be affected in some way.

I use two reseller accounts, one is based in the UK, if you have not seen any error messages coming back you are not affected by this problem.

Can I get around this problem?

The best approach if this problem is stopping your organisation from functioning is to use an email address not associated with your domain name. For example; hotmail, yahoo, gmail, btconnect, talktalk, etc as a temporary measure. This will allow you to continue to send email in the short term while we wait for this problem to be fixed.

When will it be fixed?

In short I don’t know, it is usually resolved in a few hours. I will chase the hosting company again if this problem is still there at 1pm UK time. I will also put a message at the top of this thread with any more news.

Should I be concerned about this?

Where you use a shared server irrespective of where it is located there is a risk it might be detected as a spam source by third parties if someone has done something either deliberately or by accident on the server. Many of you have come from HostPapa where it occurred regularly for short periods. If your server is at InMotion hosting then it is a very rare occurrence, and I know this company takes matters like this very seriously and monitors traffic entering and leaving the server.

Right now, I am not proposing to change the hosting provider. If you are concerned please contact me through the usual channels.

Contacting me

With immediate effect I am temporarily disconnected from my normal mobile number. Please contact me through my email address or via the contact us form on this website, or leave a message on my landline.

The cell phone number is in the process of being transferred, it should be back working Wednesday (3rd of Feb) this week.

My apologies if you have been trying to contact me.

You will need your password to proceed.

Go to Contact Us

Hacked Site

While nobody wants to have a hacked site, and we all take lots of precautions; one occurred in December. We are unable to establish what precisely had happened, but it looks as though the hacker got into the hosting space rather than into the website.

There are several ways to get into the hosting space, via the hosting provider, through my master account which can access everywhere, or through a username and password combination to something called cPanel. This controls the hosting and email.

In this case the hack was fortunately benign and quite clever. Around the website were additional menus that related to the content on the site. So to someone arriving on the site, it looked a little odd but related.

There were menus that related to families and young children, and these invited you to go to other related sites. What is happening here is that the hacker will probably receive referral fees by steering people to these other sites. This would be the motivation for doing it. So it was not a more typical defacement. Continue reading Hacked Site

Sucuri Plugin – Slow site?

All of the sites use a Sucuri plugin which monitors and hardens the site against security threats. I have had several reports and have witnessed myself that editing the sites are slower than normal, and you may see an error like this:

Sucuri: (1452076628) Send_log: SSL connect error.

This message is indicating that a message was sent to a site that logs activity on your site. When you edit something, I generally get a message to indicate at a high level that something has happened on the site. 99.999% of the time it is normal activity, so I dismiss the items. It is this function that does not seem to be working predictably.

If you site is slow to respond to editing, and/ or you see a message from Sucuri, then go to the Plugins menu item. Locate the item (see image below) and temporarily deactivate it.

sucuri

This will stop the problem from occurring. When you have finished your editing turn it back on.

Continue reading Sucuri Plugin – Slow site?

New Site Coming!

This is a selfish plea for your help. I have finally got around to reworking my original Wingrove-Media.com website and updating it to a WordPress framework. It should be completed over the next week. This is long overdue as the original site was not built using WordPress and it looks a little tired now.

I would like to have a testimonials section on this new site and am looking for people and organisations who would be willing to pass some comments that I could add on the site.

If I have helped you to make a difference, I would like to be able to pass that message out to other prospective clients. Let me know if you could help please.

Thank you.

New Year & Resolutions

Recruiting Volunteers & Donors

There are 31 days to the New Year, and 30 days before anyone thinks about what their New Year’s resolution will be.

So now is a good time to think about a recruitment or fundraising drive for volunteers and/or donors for the New Year.

You could add something to your current news page with something about 2016 and New Year’s resolutions. Talk about what you do, the people you help, and some testimonials from your current volunteers. This is really about sowing some seeds in December. If you place something like this prominently on your site, you make it seasonally relevant (and therefore fresh!), plus some people will think about it over the next month and may return in the New Year.

Equally it could be a fundraising drive where you are looking to build a “friends of community” (supporters who make monthly small donations).

December is often a time when we all look back over the past year and think about what happened and equally look to the future and begin to make new plans. Don’t let the opportunity pass without doing something.

Example Brute Force Hacking Attempt

How strong are your keys?

As you are all probably aware I get messages from all of the websites I look after that advise me of certain things that are happening on them. It may be an administrator logging in, or someone editing a post or page. I generally ignore them unless they are occurring at strange times of the day, or it is an account name I do not recognise.

brute force attacks — A small selection of the emails I get each day and night!

Continue reading Example Brute Force Hacking Attempt

Scam for .org users

22nd November 2015

I received this message this morning. (I removed the full domain name)

Domain Notification: MARK WINGROVE This is your Final Notice of Domain Listing – xxxxx.ORG

Requested Reply Before: November 23,2015

PART I: REVIEW SOLICITATION

Attn: MARK WINGROVE

As a courtesy to domain name holders, we are sending you this notification for your business Domain name search engine registration. This letter is to inform you that it’s time to send in your registration and save.

Failure to complete your Domain name search engine registration by the expiration date may result in cancellation of this offer making it difficult for your customers to locate you on the web. Continue reading Scam for .org users

Issues sending mail to Talk Talk customers

(3rd November 2015).

I have received messages from two clients over the past two days relating to “bounce back” messages being returned from the TalkTalk network.

The messages will carry this text:

Subject: Mail delivery failed: returning message to sender

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed:

someone@talktalk.net Continue reading Issues sending mail to Talk Talk customers

Using MailPoet

The following is of interest if your site has a newsletter application built in called Mail Poet.

If you have an email address list containing more than 70 subscribers for your newsletter please do take care with the last step before you send out your newsletter. Generally speaking shared hosting providers do not like bulk mailing applications running in their hosting. They use a variety of methods to detect mail being sent from the hosting which includes monitoring the volume per second/ minute and the number of error messages received such as “recipient account does not exist”. Continue reading Using MailPoet