Emergency Infrastructure Review

When you need an emergency review

Emergency reviews are for situations that cannot wait for a scheduled audit. If any of the following apply, contact us immediately:

Server or platform sending spam Your server, hosting platform or client accounts are sending unsolicited email. Mail queues are full, abuse reports are coming in, and your IP addresses may already be blacklisted. Every hour of delay means more damage to your sender reputation and more clients affected.

Phishing detected on your infrastructure Phishing pages or redirects have been found on your server. This may have been reported by a client, a browser warning, a hosting abuse report, or a third-party takedown request. Immediate containment is critical to limit liability and stop further abuse.

Malware on hosting platform or server Malicious files, injected code, web shells, cryptominers or backdoors have been discovered. You may not know the full scope of the compromise, which accounts are affected, or how the attacker gained access.

IP addresses blacklisted Your server or mail IPs appear on one or more blacklists (Spamhaus, Barracuda, SORBS, etc.). Email delivery is failing for you or your clients. You need to understand why it happened and what to fix before requesting delisting.

Compromised accounts Administrator, hosting panel, billing system or client accounts have been taken over or show unauthorized activity. Passwords may have been changed, data accessed, or services modified without authorization.

Suspicious server behavior Unexplained high CPU or memory usage, unknown processes running, unexpected outbound connections, modified system files, unfamiliar cron jobs, or new user accounts you did not create. Something is wrong but you are not sure what.

Client data exposure risk You suspect that client data, credentials, payment information or personal data may have been accessed. You need to understand the scope quickly to decide on notification obligations and containment.

Abuse reports from upstream provider Your hosting provider, data center, or registrar has sent an abuse complaint. You have a deadline to respond and resolve, or you risk suspension. You need to understand and fix the issue under time pressure.

What we do in an emergency review

Our goal is to give you clarity as fast as possible: what happened, what is still at risk, and what to do next.

• Immediate triage — assess severity, scope and active risk within the first hours
• Probable cause analysis — identify the most likely entry point, attack vector or root cause
• Scope assessment — determine which servers, accounts, services or clients are affected
• Containment recommendations — concrete steps to stop the bleeding (isolate, block, disable, patch)
• Log review — examine system logs, mail logs, access logs and application logs for evidence
• Malware and persistence check — look for web shells, backdoors, modified binaries, suspicious cron jobs and unauthorized SSH keys
• Mail abuse analysis — review mail queues, outbound patterns, blacklist status and authentication issues
• Urgent findings report — a prioritized list of what needs to be done, in what order, with clear instructions

What you receive

A focused report covering:

• Incident summary and probable cause
• Affected systems and services
• Evidence collected from logs and system review
• Containment steps (completed or recommended)
• Immediate remediation actions with priority order
• Recommendations for preventing recurrence
• Whether a full infrastructure audit is advised

Response time

Emergency reviews are priority engagements, subject to availability. We aim to begin triage as quickly as possible after receiving access and incident context.

When you contact us, include:

• Brief description of the incident
• When you first noticed the issue
• What systems or services are affected
• Any abuse reports or deadlines you are facing
• Your availability for a call or access handoff

Pricing

Emergency infrastructure reviews start from 950 EUR + VAT.

This covers initial triage, analysis and the urgent findings report. If the situation requires complex remediation beyond containment recommendations (full cleanup, server rebuild, migration, extended forensics), that work is quoted separately based on scope.

After the emergency

An emergency review addresses the immediate crisis. Once the situation is stabilized, we recommend a full Infrastructure Audit to:

• Identify underlying weaknesses that allowed the incident
• Check for residual compromise or persistence mechanisms
• Review and harden the entire platform, not just the affected component
• Establish monitoring and processes to detect future incidents earlier