I have an interesting issue where one of my 3 servers was "suspended" by my NOC. It's been 17 hours and I have not heard back from them about what "suspended" means (I'm fully paid up) and I have 20 domains on this box that have been offline since 1am EST Saturday. I have backups of all the web files and configs and email. How difficult is it to fire up a new box somewhere else to take the place of this server and have it be the 3rd node in the system? The IP Address would be different of course. Do I just install IPConfig 3 on a new potential box? How do I make all my clients point to the new box? Is there a tutorial on this somewhere?
They finally brought the server back up. The said: This is to notify you that one or more of your server's IP address(es) have been blacklisted. Blacklist: Hostkarma Black When the IP address of a VPS is listed in a blacklist, the VPS is suspended to protect the integrity of the network and ensure a clean environment for all users. For the first incident, the VPS will remain suspended until such time the IP address is listed in the blacklist. For the second incident, the VPS will remain suspended for a minimum period of 7 days. For the third incident, the VPS service will be terminated. Please note that you are responsible for all activities from your VPS and our services are non-refundable. So I go through a few jumps and click a button to remove me and within 5 minutes I'm clear. Some of these black list people need to go away. I check mail.log and I don't see anything out of the ordinary. There are only 20 domains on this box and email traffic looks fine (very little). But you never get any feedback from the blacklist people indicating why you got listed. Shoot first, ask questions later. Awful.
Being blacklisted doesn't necessarily have to do with mail abuse. It also can be a hacked / compromised website that's misusing other servers on the internet. I've had the same some time ago with a compromised Wordpress site. Another ISP blocked the whole subnet because of all kinds of suspicious connections to a server in their network. Though I do agree there are several blacklists out there that do need to disapear. They contain more unverified false positives than legit listings.
