NRTC Managed Services Hosted Email and SPAM Filtering
August 4, 2026 11:57AM EDT
INVESTIGATING
We are investigating reports of some users experiencing issues connecting to the Zimbra Hosted email platform with some email clients and through the webmail interface of the Zimbra Hosted Email system. Common clients for these reports are Apple Mail and Microsoft Outlook. We will provide additional information as available.August 4, 2026 5:36PM EDT
IDENTIFIED
Access to the Hosted Zimbra Email platform has been disrupted for some users based on IP mitigation against a large scale distributed abuse campaign against the platform.
Mitigation steps against this campaign involved blocking over 100,000 IP addresses from the platform. Some addresses within member networks, and or 3rd party addresses that aggregate connections such as Microsoft Outlook and Apple Mail were included inadvertently and are being allowed as identified.August 5, 2026 9:01AM EDT
IDENTIFIED
We have reviewed the IP addresses blocked as part of the distributed attack on the Zimbra Hosted Email platform and removed any blocks related to networks we could identify as part of an NRTC members. Please reach out to us via our ServiceDesk at https://servicedesk.nrtc.coop or servicedesk@nrtc.coop for any subscribers still having issues accessing the platform. Include the IP address, email address, and ASN for your network in the request or email and we will review and restore access as soon as possible.August 5, 2026 9:05AM EDT
August 5, 2026 5:32PM EDT
MONITORING
We continue to monitor for reports of users unable to access the Zimbra Hosted Email platform following the IP mitigation put in place August 3rd and 4th. Recent reports have primarily been from 3rd party and mobile IP space. Please continue to reach out to us via our ServiceDesk at https://servicedesk.nrtc.coop or servicedesk@nrtc.coop for any subscribers still experiencing issues accessing the platform. Include the IP address and email address in the request or email and we will review and restore access as soon as possible.August 6, 2026 11:26AM EDT
MONITORING
We continue to monitor for reports of users unable to access the Zimbra Hosted Email platform following the IP mitigation put in place August 3rd and 4th. Reports of continued issues have been trending down with recent reports primarily being from 3rd party and mobile IP space. Please continue to reach out to us via our ServiceDesk at https://servicedesk.nrtc.coop or servicedesk@nrtc.coop for any subscribers still experiencing issues accessing the platform. Include the IP address and email address in the request or email and we will review and restore access as soon as possible.August 6, 2026 5:50PM EDT
MONITORING
Ongoing access disruptions for some end users to the Zimbra Hosted Email platform have been identified to compromised "IoT" devices triggering brute force login prevention mechanisms on the platform. In many cases, the IP addresses with compromised devices appear on the SpamHaus eXploits Blocklist (XBL) available for review at https://check.spamhaus.org. Please continue to reach out to us via our ServiceDesk at https://servicedesk.nrtc.coop or servicedesk@nrtc.coop for any subscribers still experiencing issues accessing the platform. Include the IP address, email address, and whether the subscriber has issues connecting with clients, webmail, or both.August 7, 2026 10:56AM EDT
MONITORING
Ongoing access disruptions for some end users to the Zimbra Hosted Email platform have been identified to compromised "IoT" devices triggering brute force login prevention mechanisms on the platform. In many cases, the IP addresses with compromised devices appear on the SpamHaus eXploits Blocklist (XBL) available for review at https://check.spamhaus.org. Please continue to reach out to us via our ServiceDesk at https://servicedesk.nrtc.coop or servicedesk@nrtc.coop for any subscribers still experiencing issues accessing the platform. Include the IP address, email address, and whether the subscriber has issues connecting with clients, webmail, or both.August 14, 2026 4:40PM EDT
MONITORING
Brute force login attempts matching patterns similar to Internet of Things and other compromised devices on end user networks continue to attempt to access the Zimbra Hosted Email Platform.
The clearest symptom of brute force login prevention blocking access for an IP address to the platform is a user unable to login with POP/IMAP clients, but still able to access the platform via webmail.
For any users on you network displaying this symptom, please create a request through https://servicedesk.nrtc.coop we will have the block removed and put in an exemption for the duration of the attack.