My VPS with VestaCP blacklisted

[nedajba]

Hello,

I have 3 VPS with VestaCP. Everything works just fine for a while.

First VPS worked just fine before two weeks ago.

I got blacklisted on CBL XBL, SPAMHAUS ZEN.

On this VPS are many websites (Wordpress, ..) And i mean it was blacklisted becouse of Hacked Websites.
Then i setup a new VPS with just E-Mail and DNS service activated for a USERs.
Then i copied some USERS (Backup on old server than Restore data on new server). After copying data, i suspended Websites and even manually deleted content from web directory on new VPS.

After few days new VPS worked perfectly and did just DNS and E-MAIL service.

Today, IP Adress on new VPS is also blacklisted. :(

It's not possible to send E-mails to Microsoft domains (hotmail.com, live.com, outlook.com, etc.)

I get replay like this:
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]
SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=1636:
host mx4.hotmail.com [65.55.92.168]: 550 SC-001 (SNT004-MC3F24) Unfortunately, messages from 89.163.213.207 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors.

Is there any right way how to find a Problem and much important how to avoid such situations in future to be blacklisted?

Thx in advance.

Regards,
Nedim

[demlasjr]

Pretty sure one of your websites got hacked, they uploaded a shell and use your server to send spam. Check logs and graphs.

It's not Vesta Panel problem. They blocked your IP because of spam emails

[nedajba]

Thx for your replay.

It's not Vesta Panel problem. They blocked your IP because of spam emails

New VPS has NEW IP Adress and NO Websites / content in public_html directorys on it.

Just DNS and E-mail... Compleatly new installed and new IP Adress checked for blacklists, before setup VestaCP.

[govoip]

can you tell me how to check blacklisted or white listed IP address?
I need to check my IP address.

Thanks
Debnath Bitan

[Sanity]

there are many websites to check the blacklist. for example http://mxtoolbox.com/blacklists.aspx

[lossehelin]

i had the same problem once, took me forever to fix it but i eventually did. got my ip unblocked. BUt i still keep an eye from time to time.
the new vps is used for email and dns... ok but if it is being used for email what is generating the email? your websites on the other vps? If it is and your websites are hacked it does not matter that email is being handled by a new vos, the hackers can still use mail capabilities... you need to find the files that are doing this. check all your wordpress installation for files that dont belong there.
Install rkhunter and maldetet. Check the code of every file detected and then delete them.

[skurudo]

Code: Select all

New VPS has NEW IP Adress

There is no such thing as NEW IP, it may used before and used for spam, and was blocked for spam.
It's sad, but only way to unblock IP.

[l170v]

I did have the same problem (550 SC-001 (BAY004-MC1F58)) . For resolve it, I did send a request to microsoft

https://support.microsoft.com/en-us/get ... 4524366399

Regards,
li70v

[skurudo]

That all because of the next ACL rule:

Code: Select all

deny message = smtp auth requried
     sender_domains = +local_domains
     !authenticated = *

But you can't disable it because your MX become an open relay for every message sent from your domain. The best solution is to submit directly from client to the MX. While port 25 can be blocked by ISP ports 465 and 587 sould be opened for SMTPS/SMA. You have to configure clients properly. (c) http://serverfault.com/questions/770016 ... ired-error