Hello Benoit, Please submit a ticket to complia...@messagebird.com and I will look into it.
Thank you, Tracey On Tue, 14 May 2024 at 03:15, <mailop-requ...@mailop.org> wrote: > Send mailop mailing list submissions to > mailop@mailop.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://list.mailop.org/listinfo/mailop > or, via email, send a message with subject or body 'help' to > mailop-requ...@mailop.org > > You can reach the person managing the list at > mailop-ow...@mailop.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of mailop digest..." > > > Today's Topics: > > 1. Phishing hosted by Cloudflare-ipfs.com / Abuse Handled by > Sparkpostmail.com? (Benoit Panizzon) > 2. Re: Phishing hosted by Cloudflare-ipfs.com / Abuse Handled by > Sparkpostmail.com? (Faisal Misle) > 3. Re: Phishing hosted by Cloudflare-ipfs.com / Abuse Handled by > Sparkpostmail.com? (Michael Irvine) > 4. Re: Someone at Google (GSuite) with a clue? (Gellner, Oliver) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 13 May 2024 17:04:44 +0200 > From: Benoit Panizzon <benoit.paniz...@imp.ch> > To: mailop@mailop.org > Subject: [mailop] Phishing hosted by Cloudflare-ipfs.com / Abuse > Handled by Sparkpostmail.com? > Message-ID: <20240513170444.511b4...@go.imp.ch> > Content-Type: text/plain; charset=UTF-8 > > Hi all > > Our customers increasingly get phishing emails targeting our email > platform accessible under the domain: Cloudflare-ipfs.com > (interplanetary file system, I guess that is their name for CNS). > > I reported some of those to the cloudflare abuse desk. > > To my surprise, after usually 1 or two days I get a replies From: > "Cloudflare" <ab...@sparkpostmail.com> about them blocking some of the > single URL we report. > > So is sparkpostmail.com linked to cloudflare? > > Unfortunately the basic issue is not being addressed. The phishers > seem to be able to generate new URI under cloudflare-ipfs.com much > faster than ab...@spakpostmail.com is able to block them. > > Even SpamAssassin now has a rule matching those: > > URI_CLOUDFLAREIPFS References Interplanetary File System PtP > content via CloudFlare, likely phishing > > Mit freundlichen Grüssen > > -Benoît Panizzon- > -- > I m p r o W a r e A G - Leiter Commerce Kunden > ______________________________________________________ > > Zurlindenstrasse 29 Tel +41 61 826 93 00 > CH-4133 Pratteln Fax +41 61 826 93 01 > Schweiz Web http://www.imp.ch > ______________________________________________________ > > > ------------------------------ > > Message: 2 > Date: Mon, 13 May 2024 17:33:28 +0200 > From: Faisal Misle <fai...@emailgeek.eu> > To: mailop@mailop.org > Subject: Re: [mailop] Phishing hosted by Cloudflare-ipfs.com / Abuse > Handled by Sparkpostmail.com? > Message-ID: <75d038da-8911-46ed-a84f-01a6d8560...@emailgeek.eu> > Content-Type: text/plain; charset="utf-8"; Format="flowed" > > I know Cloudflare uses Sparkpost's infra to send replies from their > abuse desk system, which is likely what you're seeing. > > Received: from mta-87-157.sparkpostmail.com ([192.174.87.157]) > by safari.mxrouting.net with esmtps (TLS1.2) tls > TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 > (Exim 4.96-58-g4e9ed49f8) > (envelope-from<msprvs1=19814xF2cWR4F= > bounces-265...@notify.cloudflare.com>) > id 1roj7P-0002sE-3D > Subject: [a765c4b07061f747] Cloudflare: Abuse report confirmation > > On 5/13/24 5:04 PM, Benoit Panizzon via mailop wrote: > > Hi all > > > > Our customers increasingly get phishing emails targeting our email > > platform accessible under the domain: Cloudflare-ipfs.com > > (interplanetary file system, I guess that is their name for CNS). > > > > I reported some of those to the cloudflare abuse desk. > > > > To my surprise, after usually 1 or two days I get a replies From: > > "Cloudflare"<ab...@sparkpostmail.com> about them blocking some of the > > single URL we report. > > > > So is sparkpostmail.com linked to cloudflare? > > > > Unfortunately the basic issue is not being addressed. The phishers > > seem to be able to generate new URI under cloudflare-ipfs.com much > > faster thanab...@spakpostmail.com is able to block them. > > > > Even SpamAssassin now has a rule matching those: > > > > URI_CLOUDFLAREIPFS References Interplanetary File System PtP > > content via CloudFlare, likely phishing > > > > Mit freundlichen Grüssen > > > > -Benoît Panizzon- > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: < > https://list.mailop.org/private/mailop/attachments/20240513/c7eb4cdd/attachment-0001.htm > > > > ------------------------------ > > Message: 3 > Date: Mon, 13 May 2024 17:05:42 +0000 > From: Michael Irvine <m...@greatsys.com> > To: Benoit Panizzon <benoit.paniz...@imp.ch>, "mailop@mailop.org" > <mailop@mailop.org> > Subject: Re: [mailop] Phishing hosted by Cloudflare-ipfs.com / Abuse > Handled by Sparkpostmail.com? > Message-ID: > < > sj0p222mb0520cdd5bd21a8a162913eb5a3...@sj0p222mb0520.namp222.prod.outlook.com > > > > Content-Type: text/plain; charset="utf-8" > > This is normally an issue when it comes to SaaS solutions offering a free > trial that happens to allow outbound email sending. Scammers will use it as > many tend to trust the source. This is true for many senders as I still get > at least 1-3 fake document shares a week on my personal Google account. > > Thanks, > > Michael Irvine > > -----Original Message----- > From: mailop <mailop-boun...@mailop.org> On Behalf Of Benoit Panizzon via > mailop > Sent: Monday, May 13, 2024 10:05 > To: mailop@mailop.org > Subject: [mailop] Phishing hosted by Cloudflare-ipfs.com / Abuse Handled > by Sparkpostmail.com? > > CAUTION: This email originated from outside of the organization. Do not > click any links or open attachments unless you recognize the sender and > know the content is safe. > > > > Hi all > > Our customers increasingly get phishing emails targeting our email > platform accessible under the domain: Cloudflare-ipfs.com (interplanetary > file system, I guess that is their name for CNS). > > I reported some of those to the cloudflare abuse desk. > > To my surprise, after usually 1 or two days I get a replies From: > "Cloudflare" <ab...@sparkpostmail.com> about them blocking some of the > single URL we report. > > So is sparkpostmail.com linked to cloudflare? > > Unfortunately the basic issue is not being addressed. The phishers seem to > be able to generate new URI under cloudflare-ipfs.com much faster than > ab...@spakpostmail.com is able to block them. > > Even SpamAssassin now has a rule matching those: > > URI_CLOUDFLAREIPFS References Interplanetary File System PtP > content via CloudFlare, likely phishing > > Mit freundlichen Grüssen > > -Benoît Panizzon- > -- > I m p r o W a r e A G - Leiter Commerce Kunden > ______________________________________________________ > > Zurlindenstrasse 29 Tel +41 61 826 93 00 > CH-4133 Pratteln Fax +41 61 826 93 01 > Schweiz Web http://www.imp.ch > ______________________________________________________ > _______________________________________________ > mailop mailing list > mailop@mailop.org > https://list.mailop.org/listinfo/mailop > > ------------------------------ > > Message: 4 > Date: Tue, 14 May 2024 07:05:22 +0000 > From: "Gellner, Oliver" <oliver.gell...@dm.de> > To: "mailop@mailop.org" <mailop@mailop.org> > Subject: Re: [mailop] Someone at Google (GSuite) with a clue? > Message-ID: > < > am9pr01mb83132ac344d15ee53c4c670b82...@am9pr01mb8313.eurprd01.prod.exchangelabs.com > > > > Content-Type: text/plain; charset="utf-8" > > On 13.05.2024 at 17:12 von Aaron C. de Bruyn via mailop wrote: > > > While it was a groups permission issue, the GSuite logs for GMail do > *not* show anything about a permission problem. See attached photo (if the > list supports attached photos). > > Usually Google delivers a DSN from mailer-dae...@googlemail.com to the > return path address which includes a reason why a message to a group was > rejected. I would have assumed that this information is also available > somewhere on the Google Workspace Admin page. > I agree that accepting emails just to later on reject them with a bounce > is not a good practice. However if the return path address throws away > error messages then you can't blame Google for not giving out any > information. > > -- > BR Oliver > ________________________________ > > dmTECH GmbH > Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe > Telefon 0721 5592-2500 Telefax 0721 5592-2777 > dmt...@dm.de<mailto:dmt...@dm.de> * www.dmTECH.de<http://www.dmtech.de> > GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927 > Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher > ________________________________ > Datenschutzrechtliche Informationen > Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser > ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in > Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder > sich bei uns bewerben, verarbeiten wir personenbezogene Daten. > Informationen unter anderem zu den konkreten Datenverarbeitungen, > Löschfristen, Ihren Rechten sowie die Kontaktdaten unserer > Datenschutzbeauftragten finden Sie hier< > https://www.dm.de/datenschutzerklaerung-kommunikation-mit-externen-493832 > >. > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > mailop mailing list > mailop@mailop.org > https://list.mailop.org/listinfo/mailop > > > ------------------------------ > > End of mailop Digest, Vol 46, Issue 20 > ************************************** >
_______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
