topic Our Mailgateway is alway blocked in General Topics

Our Mailgateway is alway blocked

it64.ch — Mon, 27 Feb 2017 09:55:58 GMT

in your database our mailhost inet.schneider-pc.ch is always note as containing Malware..

we can remove but about 1 day later it again on the list..

inet.schneider-pc.ch has no webservices only Mail.. Our daily mailflow is about 9000 Mails

(we have about 150 business-mail-customers) We have the problem that our customers has

mailtraffic with customers with paloalto Firewalls ... and the paloalto-customers cant send

mails to inet.schneider-pc.ch. we need more technical informations about the reasons on blocking..

I know .. a forum is not the right place for discuse such problems but your webseite has no technical contact forms

Re: Our Mailgateway is alway blocked

santonic — Mon, 27 Feb 2017 10:35:18 GMT

Go to https://support.paloaltonetworks.com with same credentials.

Then Tools->Case management and open a case.

Or contact the partner who sold you PA if you have partner enabled support.

Re: Our Mailgateway is alway blocked

it64.ch — Mon, 27 Feb 2017 10:54:35 GMT

Im not a paloalto customer

on your link i got https://support.paloaltonetworks.com/Error/UnAuthorizedAccess

Re: Our Mailgateway is alway blocked

santonic — Mon, 27 Feb 2017 12:10:41 GMT

I would suggest one (or more) of PA customers to contact PA about this then.

For you i'm afraid I don't know what is the correct path to contact PA about this issue. Some PA employess also visit these forums, maybe they will be able to provide more info.

Re: Our Mailgateway is alway blocked

bradk14 — Mon, 27 Feb 2017 15:20:53 GMT

Are you saying you have visited https://urlfiltering.paloaltonetworks.com confirmed it's categorized as Malware (which it is) and requested it be recategorized already?

worst case -- and not recommended by any means -- is to have your client with PA firewalls create a whitelist allow rule above the Malware deny rule specifically for your domain.

I have to believe it's in PanDB as Malware for a reason, but Brightcloud and TrustedSource doesn't seem to see it as a problem site.

Re: Our Mailgateway is alway blocked

BPry — Mon, 27 Feb 2017 15:24:19 GMT

@it64.ch,

What is it exactly that you are sending out, and if you are a hosted email provider what are your users sending out. If your site is repeatedly getting marked as Malware then someone is reporting it or Wildfire is picking up your attachments as malicious.

Re: Our Mailgateway is alway blocked

BPry — Mon, 27 Feb 2017 15:26:05 GMT

@it64.ch,

You are also on the Protected Sky blocklist currently, just so you know.

Re: Our Mailgateway is alway blocked

it64.ch — Tue, 28 Feb 2017 07:14:18 GMT

Thanks for the hint with protected sky... at weekend an Mailaccount was hacked... i dont know if this is real solution of my problem... because the the paloalto firwall customer has contacted me about 2 weeks before.. i wait until my blacklistproblem is solved...

Re: Our Mailgateway is alway blocked

Brandon_Wertz — Tue, 28 Feb 2017 12:42:12 GMT

A mail account could have shown indications of compromise this past weekend, but unauthorized access could have occurred well before you first obseved malicious behavior.

It's not a stretch that Palo's AV/WF sigs reacted to traffic originating from your enviornment just a few weeks prior to any observed activity.