Global Blacklisting Results in Undeliverable Email

Yesterday (August 22nd, 2013) a massive number of IP addresses used for email gateways on virtually every webhost in the world became blacklisted on multiple networks.  This resulted in a global inability for email to be received (any time the email originated from one of the blacklisted IPs and was “received” on one of the blacklisting networks). The issue is on-going at the time of this writing, and some customers are still being affected at this moment, however HostGator was one of the first companies to successfully mitigate the situation and we have since been assisting other companies with this issue.  As it stands, we are presently working to now get our IPs removed from the blacklists and restore full worldwide email deliverability from our network. This situation resulted from a combination of multiple factors stretching back a few months.  Before we explain the circumstances, we want to once again stress the importance of keeping all scripts on all hosting accounts updated.  Failure to update scripts, as well as  not exercising basic security practices, is what allows situations like this to continue to occur.  An out-dated script on a hosting account is akin to an unlocked car left in a parking lot… it’s an invitation for maliciousness by unscrupulous individuals. Unlike the situation back in April that affected WordPress , this time the target was Joomla.  Back in May, there was a string of exploits against known vulnerabilities in Joomla.  These vulnerabilities, related to a component called JCE, had been previously addressed via certain mod_sec rules.  However, a workaround was discovered that allowed malware to be installed, and later activated, to allow the uploading and execution of mailing scripts. These mailing scripts were activated en masse yesterday, beginning a massive spamming campaign resulting in the blacklisting of email gateway IPs worldwide.  One of the largest networks with users reporting issues initially was AOL, resulting in us creating this forum post . As with all issues of this nature, there are lessons to be learned.  The most important lesson here is to (again) keep all scripts on your hosting account up-to-date.  Most scripts have a one-click feature to update them anytime a new version is released.  Keeping scripts up-to-date is paramount in ensuring a secure hosting account. HostGator has now added additional monitoring capability to our systems which will alert us to situations like this even faster than yesterday.  Our work in on-going, though we should have the majority of the blocks resolved by tomorrow (spam lists move slow, with good reason).  But remember, there is no better way to keep your car safe than to lock it.  Please take this moment to log into your hosting script back-ends and ensure they are up-to-date.  Don’t give the bad guys an open door to walk through.