Email DoS attack

[McDuff]

Email DoS attack

I am doing web- email stuff for our US non-profit and also for our sister organization in Europe. That site –www.rozmberk.org- is hosted locally. I am considering already longer getting all the websites to FQ but the hosting was paid for within a joint project.

Now a serious problem occurred, and I would like to know if people here have had something similar and – specifically asking the FQ staff – how FQ would have dealt with that if it had happened here.

Normally, only two of the five user@rozmberk.org addresses get some spam, average about 10-40 a day; annoying but not a big deal. However, last week suddenly the provider was swamped with emails to the main addresses. At the peak they got something like over :shock:ten thousand emails per minute:ytrubeye::shocked:.

This is a local computer-internet company; they do hosting just as a side-service for clients (less than 400 sites total). They have a few servers with a larger, specialized hosting company. These servers could not cope and in the end in desperation they just blocked all email addressed to that account.

This provider mentioned that the only solution they saw was to physically move the account to the main provider that had the infrastructure to deal with this; installing the extra soft- and hardware to deal with it would be too expensive for them.

Some questions – remarks:
- Since it is the only …org domain on those servers, maybe this was a part of a more coordinated attack on ..org domains and the attackers did not even know where the servers were?.

- Anybody ever experienced something like that?

- Are these email addresses burned for good or is this a one-off occurrence?

- Complaining to any police makes any sense?

- If these accounts would have been hosted with FQ, would it have resulted in the same block or do we at FQ are better protected?

That question is rather important; I would not want to move that website to FQ to find out that I am causing problems or will end up with the same problems.

Thanks, have a nice weekend
Mcduff

[sheila]

McDuff,

We do our best to accept all email, and that is what we do pretty much all of the time.

However, if the mail servers really were being overrun, we would have to take measures to enable the servers to continue to operate and provide email service.

I do want to make it clear that we always analyze problem situations. We do our best to determine the cause and find the least invasive workaround. Sometimes we are able to filter the incoming traffic and maybe only drop some emails, based on their characteristics, rather than simply not accepting any email for the given domain.

It sounds like this was really a surprise and unanticipated attack, not something you could have predicted in any way. Ten-thousand emails per minute is an awful lot for any network to handle.

I wouldn't say bringing the domains over sounds like it would be causing problems for FutureQuest, unless you have some reason to expect something like this again? From what you've written above, it sounds like it was rather random and any domain could have been targeted?

[McDuff]

It sounds like this was really a surprise and unanticipated attack, not something you could have predicted in any way. Ten-thousand emails per minute is an awful lot for any network to handle.

I wouldn't say bringing the domains over sounds like it would be causing problems for FutureQuest, unless you have some reason to expect something like this again? From what you've written above, it sounds like it was rather random and any domain could have been targeted?

Totally coming out of the blue. The other domains on the same server and our domain here had no problem. Those provider people mentioned that just accepting and sorting what was clearly spam and what was real at their first filter level already took al their bandwith and capacity, so they gave up and did not open it up again (for local standards they are not bad, but client service and response time is a lot lower than here at FQ :yeah:).

I cannot imagine why somebody would specicially attack our domains, so I do not expect a replay. Then again, I do not know how and why they organize these attacks; just attack everybody on a list of harvested addresses, pick one with a needle and see if you get a nice response, any other reason?

With going beyond "normal spam", does FQ alerts any police or whoever to help trace origins of such an attack or is that waste of time?

Thanks
McDuff

[sheila]

FutureQuest does not alert police or other agencies of matters such as this. If the site owner felt such an action were appropriate, it would be up to him to do this. We generally scope our response to the technical aspects only.

[McDuff]

I finally spoke with the real technician, he nuanced some earlier remarks made by their other staff.

Turned out that those addresses received already more spam than we realized (cannot see stats there) and their first main filter took out a lot already. However, the sudden raise in spam about 10 days ago came unexpected and was significant higher; their system just spent all their capacity to check and reject. So they blocked it. Now they opened up and tighten the spam filter rules; lets see what happens.

Thanks for the replies.
McDuff