Good day everyone,
Ran into a wonderful brain boggler and I'm ready to tear some hair out. I have a client who has a server running Exchange 2007, it also has a pop to exchange downloader called POPCon that has been up and running fine for quiet sometime until this morning when all of the mailboxes it downloads for suddenly weren't getting connected anymore. Getting "POP3 Host did not acknowledge password and returned the following error: -ERR [Auth].
None of these passwords have changed.
So far, I stopped POPCon from downloading emails and logged into one of the accounts with the same credentials POPcon was using, worked fine.
Tried setting the email up in Outlook through pop3 and get continuously challenged on the password until it gets rejected with the server rejecting the login.
Now here is the kicker, I got the guy who hosts their emails, who is external to the site set this account up in his outlook with the exact same credentials and settings. It connects and authenticates fine.
I can access webmail onsite but cannot connect an email client or the POPcon downloader.
Even went so far as to turn off the accounts popcon monitors and created a new entry for the email we used externally and still get the same.
It came to my attention later on in the day that one of the users had opened a suspicious email on their workstation. Bit Defender didn't find anything but Malwarebytes found it and cleaned it off.
So I'm thinking in my head what has happened here is that the company that hosts the emails has blacklisted remote access client (outlook, popcon) attempts. Now the guy I mentioned before, got the current IP whitelisted for brute force attacks.
In my head what I'm think is this site is just going to need a certain amount of time to get off of what ever blacklists its on, but I would love to hear from anyone with info or similar experience.
I'm sure you'll be the first on the scene, hi mxnerd!
Ran into a wonderful brain boggler and I'm ready to tear some hair out. I have a client who has a server running Exchange 2007, it also has a pop to exchange downloader called POPCon that has been up and running fine for quiet sometime until this morning when all of the mailboxes it downloads for suddenly weren't getting connected anymore. Getting "POP3 Host did not acknowledge password and returned the following error: -ERR [Auth].
None of these passwords have changed.
So far, I stopped POPCon from downloading emails and logged into one of the accounts with the same credentials POPcon was using, worked fine.
Tried setting the email up in Outlook through pop3 and get continuously challenged on the password until it gets rejected with the server rejecting the login.
Now here is the kicker, I got the guy who hosts their emails, who is external to the site set this account up in his outlook with the exact same credentials and settings. It connects and authenticates fine.
I can access webmail onsite but cannot connect an email client or the POPcon downloader.
Even went so far as to turn off the accounts popcon monitors and created a new entry for the email we used externally and still get the same.
It came to my attention later on in the day that one of the users had opened a suspicious email on their workstation. Bit Defender didn't find anything but Malwarebytes found it and cleaned it off.
So I'm thinking in my head what has happened here is that the company that hosts the emails has blacklisted remote access client (outlook, popcon) attempts. Now the guy I mentioned before, got the current IP whitelisted for brute force attacks.
In my head what I'm think is this site is just going to need a certain amount of time to get off of what ever blacklists its on, but I would love to hear from anyone with info or similar experience.
I'm sure you'll be the first on the scene, hi mxnerd!
Last edited: