Our Mailgateway is alway blocked

[it64.ch]

Hi

in your database our mailhost inet.schneider-pc.ch is always note as containing Malware..

we can remove but about 1 day later it again on the list.. 

inet.schneider-pc.ch has no webservices only Mail.. Our daily mailflow is about 9000 Mails

(we have about 150 business-mail-customers) We have the problem that our customers has

mailtraffic with customers with paloalto Firewalls ... and the paloalto-customers cant send

mails to inet.schneider-pc.ch. we need more technical informations about the reasons on blocking..

I know .. a forum is not the right place for discuse such problems but your webseite has no technical contact forms

[santonic]

Go to https://support.paloaltonetworks.com with same credentials.

Then Tools->Case management and open a case.

Or contact the partner who sold you PA if you have partner enabled support.

[it64.ch]

Im not a paloalto customer

on your link i got https://support.paloaltonetworks.com/Error/UnAuthorizedAccess

[santonic]

I would suggest one (or more) of PA customers to contact PA about this then.

For you i'm afraid I don't know what is the correct path to contact PA about this issue. Some PA employess also visit these forums, maybe they will be able to provide more info.

[bradk14]

Are you saying you have visited https://urlfiltering.paloaltonetworks.com confirmed it's categorized as Malware (which it is) and requested it be recategorized already?

worst case -- and not recommended by any means -- is to have your client with PA firewalls create a whitelist allow rule above the Malware deny rule specifically for your domain.

I have to believe it's in PanDB as Malware for a reason, but Brightcloud and TrustedSource doesn't seem to see it as a problem site.

[BPry]

@it64.ch,

What is it exactly that you are sending out, and if you are a hosted email provider what are your users sending out. If your site is repeatedly getting marked as Malware then someone is reporting it or Wildfire is picking up your attachments as malicious. 

[BPry · Accepted solution]

@it64.ch,

You are also on the Protected Sky blocklist currently, just so you know. 

[it64.ch]

Thanks for the hint with protected sky... at weekend an Mailaccount was hacked... i dont know if this is real solution of my problem... because the the paloalto firwall customer has contacted me about 2 weeks before.. i wait until my blacklistproblem is solved...

[Brandon_Wertz]

A mail account could have shown indications of compromise this past weekend, but unauthorized access could have occurred well before you first obseved malicious behavior.

It's not a stretch that Palo's AV/WF sigs reacted to traffic originating from your enviornment just a few weeks prior to any observed activity.