[mailop] att.net bounce

2024-12-12 Thread Bitfox via mailop
do you know if att.net has a whitelist policy for their incoming email? many of my customers' regular email were rejected by them. So I am asking this question. Thank you. ___ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mail

Re: [mailop] PayPal Phishing from Paypal servers.. Now coming through o365 as well

2024-12-12 Thread Michael Peddemors via mailop
Another annoying case.. MailGun IPs, probably compromised MailGun accounts.. pointed to o365 list addresses, to get the invoice vishing through.. Subject: New invoice INV02214 from Healthy Eats Cafe LLC From: Healthy Eats Cafe LLC To: norep...@hendrixwarrenbryan074.onmicrosoft.com X-Mailgun-T

Re: [mailop] [ext] Re: PayPal Phishing from Paypal servers.. Now coming through o365 as well

2024-12-12 Thread Louis via mailop
Did a content block, and of course the content has now updated. I've decided I'm just going to block PayPal emails where the to header doesn't match the RCPT TO. If PayPal wants forwarding to work for their email, they shouldn't allow phishing content in them. Hope to revisit this if they ever cha

Re: [mailop] The "NEW" Outlook

2024-12-12 Thread Francois Petillon via mailop
On 12/12/24 16:44, Scott Q. wrote: I understood that. You  temp block the MS IP that shows high failure rate, which may or may not be warranted. No. I'm blocking the accounts, not the IPs. I won't block an IP that is clearly authenticating on compromised accounts. My fault for the misunderst

Re: [mailop] The "NEW" Outlook

2024-12-12 Thread Scott Q. via mailop
I understood that. You  temp block the MS IP that shows high failure rate, which may or may not be warranted. My question was more along the lines of: by allowing MS IPs to mask the user's true identity, how can you identify when a mailbox has been compromised ? Thanks, Scott​​ On Thursday, 12/1

Re: [mailop] The "NEW" Outlook

2024-12-12 Thread Francois Petillon via mailop
On 12/12/24 16:19, Scott Q. wrote: How can you tell if they are compromised if legitimate user A connects from France via 'New' Outlook and hacker B connects from Australia via 'New' Outlook ? I'm afraid you misunderstood my previous answers. When an IP is behaving like : IP 4.233.216.98 (8075

Re: [mailop] The "NEW" Outlook

2024-12-12 Thread Scott Q. via mailop
How can you tell if they are compromised if legitimate user A connects from France via 'New' Outlook and hacker B connects from Australia via 'New' Outlook ? Scott​ On Thursday, 12/12/2024 at 09:25 Francois Petillon via mailop wrote: On 12/12/24 14:52, Scott Q. wrote: > So are you guys blockin

Re: [mailop] The "NEW" Outlook

2024-12-12 Thread Francois Petillon via mailop
On 12/12/24 14:52, Scott Q. wrote: So are you guys blocking the connections from the MS ASN ? Does that result in 'New' Outlook not being able to login at all or not ? No, we disable accounts when the credentials seem to be compromised. François ___

Re: [mailop] The "NEW" Outlook

2024-12-12 Thread Scott Q. via mailop
So are you guys blocking the connections from the MS ASN ? Does that result in 'New' Outlook not being able to login at all or not ? Scott​ On Thursday, 12/12/2024 at 05:37 Francois Petillon via mailop wrote: On 12/11/24 17:19, Scott Q. via mailop wrote: > It seems MS is pushing really hard fo

Re: [mailop] [ext] Re: PayPal Phishing from Paypal servers.. Now coming through o365 as well

2024-12-12 Thread Ralf Hildebrandt via mailop
* Richard Clayton via mailop : > In some cases ... where phone numbers are present, then ringing that > number (the only way that the recipient can contest the invoice) will > get you to "PayPal Customer Service". > > They will explain that the bad invoice issue is well-known and direct > you to

Re: [mailop] The "NEW" Outlook

2024-12-12 Thread Francois Petillon via mailop
On 12/11/24 17:19, Scott Q. via mailop wrote: It seems MS is pushing really hard for the 'NEW' Outlook adoption. This software, along with Outlook Mobile and myMail (mail.ru), etc, cache logon information on their own infrastructure and then basically proxy the connection to the service provider.