Phishing

[Neuralnoise]

Has anyone else had their dedicated server hijacked by a phisher? My customer emails have gone through a series of bounce-backs and now delays due to a myriad of spam sent out by my server. Initial tickets from H9 were responded to but after Joshua performed a few 'tweaks' and I asked him what he did and what caused the initial problem (8 days later), the response was, 'I have no idea. That was 8 days ago'.

Since then a number of tickets have gone out containing snippets of customers bounce-backs and delay messages. I have gone to Barracuda, Comcast and now Yahoo to register my IP and get it off their blocked list, and thus feel like I have done my part to correct the situation. There has been NO answer from H9 thus far.

Have any of you had similar experiences? What have you done? I feel my next step is calling my lawyer and contacting the Better Business Bureau. H9, in the past, has handled my server issues relatively quickly with good communication...but these last few months have been horrendous. Was the company bought? Were there new hires? What happened to the customer service?

[zanass]

Originally Posted by Neuralnoise

..Initial tickets from H9 were responded to but after Joshua performed a few 'tweaks' and I asked him what he did and what caused the initial problem (8 days later), the response was, 'I have no idea. That was 8 days ago'.

Do you wnat Joshua to lie and give you some BS excuse?, and I think if you mention your lawyer again. I think your lawyer will be contacting H9's lawyer for support issues.

Thanks
Greg V

[Gene]

Did the spam come from your server / IP address or did it have a "reply to" address of a domain on your server? I get bounce backs all the time but most of the bounces will show the header that they received and it did NOT come from the IP address of any H9 server. Big difference.

[DeanClinton]

@Gene - I was about to ask the same.

Also, Google for "Backskatter" (I think that's how it's spelt).

[Neuralnoise]

Thank you to Gene and Dean for productive comments...

The bounced emails are definitely coming from my server as a few of them have come with messages from Yahoo, Barracuda and Comcast referencing my IP...and instructions on how to register my IP with them to remove my spammer status (which I have done). Dan from H9 responded 2 hours ago and told me that one of the email accounts on the server is sending massive amounts of spam so that apparently is the culprit. Hopefully just changing it's password will fix the issue, and now I have to do some damage control.

[DeanClinton]

I'd also get your server checked over for rootkits etc (rkhunter/chkroot)

[Gene]

Originally Posted by Neuralnoise

... one of the email accounts on the server is sending massive amounts of spam ....

Ouch ... bummer .. at least you found the cause. Good luck.

[josephp]

Originally Posted by DeanClinton

I'd also get your server checked over for rootkits etc (rkhunter/chkroot)

I suggest to use PlatinumServerManagement, it cost $29.95/mo and you get unlimited stuff to keep your server up to date. They will do everything for you.

I used them in the past, they are good.