One stubborn mail provider
Two weeks ago my company received an influx of delayed messages when attempting to email clients whose mail servers were lucky enough to reside at Network Solutions. After opening up trouble tickets at both our mail provider and theirs', we found that Network Solutions had been a victim of a DDoS attack and took it upon themselves to block the IP range in which our mail server lies. The notice from our own provider went like this:
Apparently Network Solutions was subject to a DDOS (distributed denial of services) attack, and responded rather bluntly by blocking large sections of the Internet, affecting multiple IP transit providers, including AT&T and Cogent, our primary peering partner. Our provider advised that Network Solutions would remove the block when contacted by the individual delegated IP space owner. We have made that request twice thus far, but remain blocked. Until Network Solutions removes that block, this situation will continue. We apologize for any impact this may have on you. If you are also a Network Solutions customer, we strongly advise you to open a technical support request with them, and open a ticket with us as well.
This
was on August 21st. As of this writing (9/2) Network Solutions is
still blocking this IP space. We have asked everyone who was willing
open up tickets with NetSol, but have since had no movement. In the
meantime we've been forced to provide clients with alternate email
addresses in order to stay in contact. Our mail provider seems to have
given up on NetSol and is acquiring new IP addresses for their mail
servers in response to its customers pleas.
Another update from our mail provider states that the IPs were, in fact, spoofed:
Another update from our mail provider states that the IPs were, in fact, spoofed:
As of today, August 28th, our IP range remains blocked by Network Solutions. Network Solutions continues to block portions of the AT&T and Cogent networks. As best we can determine from our contacts with Network Solutions and Cogent, the attack on Network Solutions consisted of a DDOS attack from spoofed IP addresses. What that means is that while the attack appeared to originate from particular IP addresses, those addresses were falsified in the packets. The true origin of the attack is thus very difficult to determine. Network Solutions has blocked the spoofed addresses, not the actual origin of the attack. As the blocked addresses did not in fact originate the attack, there is nothing Cogent or AT&T can do/fix/change. Apparently Network Solutions, however, does not intend to remove the block until they find the true origin of the attack. We do not know how long this could take.The most frustrating part of this whole ordeal is that our own provider looks like the bad guy when they were essentially denied service to Network Solutions vast customers.
0 TrackBacks
Listed below are links to blogs that reference this entry: One stubborn mail provider.
TrackBack URL for this entry: http://blog.techoutfit.net/cgi-bin/mt-tb.cgi/2
Leave a comment