[mailop] Lotus Notes and "250 2.6.0 Bad message, but will be delivered anyway"

2017-06-09 Thread Benoit Panizzon
Hello We have a 'challenging' problem between two companies sending each other emails. The sender keeps getting notifications, that his emails to the recipient are delayed. But this is not true. Analyzing the email headers the recipient sent me I can confirm, the emails take about two seconds! fr

[mailop] What are "printing ASCII characters" RFC 850/2822 (was: Re: Lotus Notes and "250 2.6.0 Bad message, but will be delivered anyway"))

2017-06-09 Thread Benoit Panizzon
Hello Thank you for the replies suggesting that the problem could be caused by an amavis virus scanner. That was bullseye :-) Indeed, amavis at recipioents site generates a delayed bounce, which is then sent directly to the MX of the sender and thus bypassed my sniffing between our filter and the

Re: [mailop] What are "printing ASCII characters" RFC 850/2822

2017-06-09 Thread Benoit Panizzon
Hi all > Are you sure that Lotus Notes is using that character? Have you got > an example? Ok, as I told, they use some sort of automatic order form processing software which communicates via email. So it looks like an external module or similar for lotus notes which generates those messages, inc

[mailop] GMX on various blacklists

2017-07-28 Thread Benoit Panizzon
Hi http://multirbl.valli.org/lookup/82.165.159.13.html Blacklisted: 17 Anyone knows if some outbreak just got GMX thrown in that many lists? -Benoît Panizzon- -- I m p r o W a r e A G-Leiter Commerce Kunden __ Zurlindenstrasse 29

[mailop] Sender MX pointing to *.registrar-servers.com => 100% Spam!

2017-08-31 Thread Benoit Panizzon
Hello Since a couple of days we get a lot of spam from randomly changing domains under gtld bid. faith. website. loan. to name a couple. Now I found one thing in common to those spam mails. All of them point to MX Records from: eforward1.registrar-servers.com. to eforward5.registrar-servers.com.

Re: [mailop] Sender MX pointing to *.registrar-servers.com => 100% Spam!

2017-08-31 Thread Benoit Panizzon
Hi Stefano > From my data I'd say that those MX are MX for PARKED domains at > namecheap (I logged more than 1000 domains using that MX and randomly > checking some of them, they are parked domains). > > I guess it can be safe to drop incoming email from a parked domain. Strange, todays active d

Re: [mailop] outlook.com and greylisting

2017-10-24 Thread Benoit Panizzon
Hi Mark Outlook is not the only one that re-sends and email from a different ip with each attempt. What tool do you use for greylisting? I can recommend milter-greylist which has ways to react to such situations: subnetmatch /24 subnetmatch6 /64 will consider ip addresses within a /24 IPv4 and

[mailop] spamalarm.org

2017-10-26 Thread Benoit Panizzon
Dear Fellow Mailops Today I came across and interesting statement in a spam email. The sender pretends to co-operate with and antispam reporting organization http://spamalarm.org and recommends that recipients not wanting his emails should report them there. Well they do seem to forward the comp

Re: [mailop] Certified Senders Alliance

2017-11-02 Thread Benoit Panizzon
Hi I made mixed experience with CSA. Their 'complaints' team does react quickly on complaints and also document the number of complaints they receive per CSA Member. But by 'reacting' they just acknowledge the complaints and document the complaint. Not much more happens to make the problem stop.

[mailop] mail.ru google and DMARC

2017-11-02 Thread Benoit Panizzon
Dear List I have come across a strange problem. One of our customers is forwarding his emails to his google account. We do implement SRS to rewrite the envelope sender to match our SPF record. All other headers are preserved, in case they are DKIM Signed. Google rejects the emails with: : host

[mailop] rescam.org experiences?

2017-11-12 Thread Benoit Panizzon
Hi List rescam.org made it to the swiss national tv news lately. Generally I like the idea of wasting the time of scamers and spamers. The goal is reached when the scamer can not distinguish between real and bot answers and wastes most of his time talking to bots. I have been trying out the serv

[mailop] reject because of helo / hostname mismatch?

2018-01-02 Thread Benoit Panizzon
Hello List Happy New Year! I seem to observe, that more servers have started rejecting email because of 'helo / hostname' mismatch. If for example, you run a mailman installation with virtual domains enabled and use SSL for the Web-Management part, you have one ip address per domain. sendmail o

[mailop] Delisting an IP Address from Outlook 365

2018-01-12 Thread Benoit Panizzon
Dear Michael 2018-01-12 09:59:11 SMTP error from remote mail server after RCPT TO:: host nyfelermetallbau-ch01i.mail.protection.outlook.com [213.199.154.106]: 550 5.7.606 Access denied, banned sending IP [87.102.181.130]. To request removal from this list please visit https://sender.office.com/ an

Re: [mailop] Delisting an IP Address from Outlook 365

2018-01-12 Thread Benoit Panizzon
Oh, bummer! that was not his private email address... ___ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Once more: outlook.com services abused for Backscatter DDOS Attacks

2018-02-15 Thread Benoit Panizzon
Hello List We had an incident where one of our users got completely flooded by 'delivery error' for emails he did not send. The source were about a hundred different ip addresses. It turned out, most (if not all) bounces were generated by outlook.com customers. When does outlook.com stop sendin

[mailop] Google 'Group' Mails bouncing?

2018-06-26 Thread Benoit Panizzon
Hello List A Google 'Business' Mail recipient is probably forwarding his email to an internal Google recipient group. The mail is being bounced with: Your email to group i...@medlanes.com was rejected due to spam classification. To address this issue: * Contact the owner of the group, who can c

Re: [mailop] Orange.fr and Wanadoo.fr Hardbounces

2018-07-05 Thread Benoit Panizzon
Hi Erme I've seen similar problems with ISP using, as I recall, something sounding like 'xmailserver' as SMTP Server. That Server has a very serious bug, instead of rejecting invalid recipients during the 'rcpt to' handshake, it does this after 'data' has been initiated by issuing a human readabl

[mailop] outlook.com blocking reason: S3150 "network is on our block list"

2018-09-28 Thread Benoit Panizzon
Dear List Does anyone know, what kind of blocklist outlook.com is using? Source IP in question is: 157.161.12.54 Source Domain 'bman.ch' https://mxtoolbox.com/SuperTool.aspx?action=blacklist%3a157.161.12.54&run=toolpage Not in any blacklist. IP passes SPF: bman.ch descriptive text "v=spf1 ip6:

[mailop] How to find 'low flying' spamers? (Re: outlook.com blocking reason: S3150 "network is on our block list")

2018-10-01 Thread Benoit Panizzon
Hi List Well thank you for all the hints. I also (thanks to Al) found out, that you need to set the browser language to english, to get to the propper help page where the delisting request form can be found. With german, you're lost :-) But I would like to use that topic on a discussion about wha

[mailop] Microsoft blocklists are secret - how to comply with microsofts technical requirements?

2018-10-07 Thread Benoit Panizzon
Hi List Now I am sort of baffled, after a lengthy email exchange about the blocklist case, Microsoft states: "As previously stated, your IP(157.161.12.54) is mitigated at this time. I do apologize, but I am unable to provide any details about this situation since we do not have the liberty to dis

[mailop] Microsoft SNDS "Sorry, whois.ripe.net will not let us do any more lookups today. Please come back and try again tomorrow"

2018-10-08 Thread Benoit Panizzon
Hi List Since about a week I regularly try to add our IP Ranges to the Microsoft SNDS Service to be able to react more quickly to incidents. Unfortunately Microsoft does not seem to have talked to RIPE to get a large enough request quota. I always get: "Sorry, whois.ripe.net will not let us do a

Re: [mailop] Microsoft SNDS "Sorry, whois.ripe.net will not let us do any more lookups today. Please come back and try again tomorrow"

2018-10-11 Thread Benoit Panizzon
Hi List Microsoft is getting ridiculous... We use ab...@imp.ch for our SNDS Login. I have been trying to add our IP Ranges multiple times every week now and even attempted to open a case, which was not yet successful (apparently because I left an old case ID in the subject). The result, is that

Re: [mailop] Microsoft SNDS "Sorry, whois.ripe.net will not let us do any more lookups today. Please come back and try again tomorrow"

2018-10-11 Thread Benoit Panizzon
Short update on this... > To unblock, MS wants to send an SMS to our fixed line abuse desk phone > number we added when creating the account, this of course is not > working as switzerland has discontinued fixnet SMS services in July of > this year. So we are stuck here. It looks like it was a se

Re: [mailop] Microsoft SNDS "Sorry, whois.ripe.net will not let us do any more lookups today. Please come back and try again tomorrow"

2018-10-16 Thread Benoit Panizzon
Hi Michael Could you please escalate the case? Apparently your techs don't even bother to look at the problem on their side. Message from the SNDS Website while trying to add IP Ranges: "Sorry, whois.ripe.net will not let us do any more lookups today. Please come back and try again tomorrow" I

Re: [mailop] Microsoft SNDS "Sorry, whois.ripe.net will not let us do any more lookups today. Please come back and try again tomorrow"

2018-10-16 Thread Benoit Panizzon
Hi Tobias > Do you try to add a Range? I had problems with the same Error a couple of > years ago, until I figured out that they also look up the Network IP, so for > us it helped to add PTR-RR to 192.168.0.0 with a Domain that also belonged to > us... Ok, so the error message regarding the re

[mailop] Amazon AWS as 'spam sending farm' via phished account?

2018-10-29 Thread Benoit Panizzon
Hi List We increasingly notice, that when an account got phished, it is being abused to send spam from usually one or two Amazon AWS US IP Addresses simultaneously, staying below our account auto-block thereshold. Quite some time in the past, when I first observed this, contacted the Amazon Abuse

[mailop] What do other ISP / ESP do about the MailChimp spam problem?

2018-11-06 Thread Benoit Panizzon
Hi List We again face problems with services by MailChimp. Their platform is equally fashioned by serious companies sending permission based newsletters and by very persistent repetitive spamer. They repeatedly get blacklisted on our platform, because of recipient complaints. Then repeatedly cu

Re: [mailop] What do other ISP / ESP do about the MailChimp spam problem?

2018-11-08 Thread Benoit Panizzon
Hi Al > My question is, "What Mailchimp spam problem?" Where's data? All I see > is useless bombastic complaining that belongs on NANAE or SPAM-L, not > here. Ok, there is a point here which I did not consider enough. I did not collect any numbers about emails send by mailchimp to our email plat

Re: [mailop] Microsoft SNDS "Sorry, whois.ripe.net will not let us do any more lookups today. Please come back and try again tomorrow"

2018-11-12 Thread Benoit Panizzon
Hi List Finally git positive Feedback from the SNDS Support Team. It looks like, after some escalations, they solved the issue of too many requests to RIPE. (they only had to contact ripe and ask politely for the quota to be risen I suppose). I was now able to 'Request Access' to more than just s

[mailop] Mailexperts / spamrl.com support/delisting process deadlock.

2018-11-27 Thread Benoit Panizzon
Hi List Does anybody have a good recipe on how to solve the support deadlock created by mailexperts / spamrl.com? One of our customers is blacklisted by spamrl.com. Only by spamrl. Our abusedesk has no recorded spam complaints about the IP in question. Spamrl.com requires our customer to contact

[mailop] mailchannels.ch / mailchannels.net ESP contact?

2018-11-29 Thread Benoit Panizzon
Hi List Does anyone know about mailchannels.ch? Looks a bit like an ESP but they send out emails with a sender domain hosted on our email plattform and protected by SPF. Unfortunately this makes us receive all the bounces. https://www.mailchannels.ch/ leads to a site with many certificates, none

[mailop] What should an MTA do when receiving 452 4.5.3 (aka too many recipients)

2018-12-13 Thread Benoit Panizzon
Hi List Email is sent to multiple recipients. When for whatever reason, recipients have incompatible settings (one wants spam to be rejected during SMTP Handshake, another one wants spam to be tagged and delivered to his inbox as example).. ...during the 'RCTP TO' phase, we don't yet know what t

Re: [mailop] What should an MTA do when receiving 452 4.5.3 (aka too many recipients)

2018-12-13 Thread Benoit Panizzon
Hi Thank you for the feedback. So I wonder if others might have found a clever solution to that problem. Goal 1: Do NOT send a delayed bounce. (aka backscatter) Goal 2: Never have an email 'disappear' in the system. Goal 3: Respect Recipient's anti-spam settings. Consider an email sent to two r

Re: [mailop] What should an MTA do when receiving 452 4.5.3 (aka too many recipients)

2018-12-13 Thread Benoit Panizzon
Hi Michael > Kind of breaks the chain of responsibility though, so make sure you have > good logging of the event. Logging alone is not good enough. Emails disappearing without a trace (for the recipient and sender) are always bad. Spam Mails usually are delivered to single recipients. So the h

Re: [mailop] Quick question on SPF...

2019-01-24 Thread Benoit Panizzon
Hi Eric > Is this a legit method? Looks like it's a typical round-robin so will fail > more often then work.. As far as I remember, 'a' does just specify ip address without specifying the protocol version. So if a hostname is ipv4/ipv6 dual stack, 'a' includes all ipv4 and ipv6 addresses that h

Re: [mailop] Digital Ocean Sextortion Spammers..

2019-04-08 Thread Benoit Panizzon
> This has gone on now for more than a month, and they aren't even trying > to hide.. Interesting digitalocean is also hosting at least two UBS.com phishing sites and it took quite a while to persuade their abuse-desk to verify by looking at the code of the site, or to use an VPN to access th

[mailop] AS Number RBL (Re: Digital Ocean Sextortion Spammers..)

2019-04-11 Thread Benoit Panizzon
Hi List Our Mail Infrastructure just got hit by a new sextortion wave originating from vairous IP @ AS14061 I wondered, aren't there any RBL providers blacklisting whole AS ip ranges or returning the AS number when queried with the reversed IP, so blocking / penalizing could be easily implemented

[mailop] Outage @outlook.com creating invalid sender addresses?

2019-04-12 Thread Benoit Panizzon
Hi List Today, our support team started getting quite some emails from legitimate customers, but with envelope sender and From: header looking like: From: "Firstname Name" That Hex String is different for each sender. Recieved: header show, they got sent via outlook.com plattform, but the send

[mailop] All mx?.hotmail.com down?

2019-04-23 Thread Benoit Panizzon
Hi List A customer told us he is getting timeouts trying to send emails to a recipient under @accountprotection.microsoft.com. It looks like he is trying to reply some sort of challenge response system which I guess is not meant to be used by email. mail.msa.msidentity.com mail is handled by 5 mx

Re: [mailop] Bounces from outbound.protection.outlook.com

2016-04-29 Thread Benoit Panizzon
Hi Renaud > I am seeing in my logs some bounces messages (empty sender) from > various outbound.protection.outlook.com servers. All those bounce > messages are directed towards one specific email address which is > probably used as an envelope field in a spam run. > > Now my question is: if it co

Re: [mailop] Bounces from outbound.protection.outlook.com

2016-04-29 Thread Benoit Panizzon
Hi Michael > This has been going on for some time now, there was discussion on > this list regarding the topic, we ended up putting a policy in our > platforms just to deal with this issue. "Reject messages from senders > forging bounce messages". So you just drop everything with envelope sender

[mailop] Strange reaction to spam complaints from cleverreach.

2016-05-30 Thread Benoit Panizzon
Hi all As an ISP we operate email services under various domain names for our end-customers. We also operate the community based SWINOG DNS Anti-Spam Blacklist services. Now I came across a strange behaviour from the email marketer Cleverreach(.de) He blocked outbound emails to one of our main

[mailop] Massive Spamrun from Cox Net: 68.230.241.0/24

2016-05-31 Thread Benoit Panizzon
Hello At the moment we see a very large amount of emails containing Microsoft Office Documents containing malware, all originating from IP Addresses in the Range: 68.230.241.0/24 We therefore blocked that range. Anyone else? Maybe a Cox.Net Email Admin reading this list? -Benoît Panizzon- -- I

[mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-10 Thread Benoit Panizzon
Hi List I wonder how other Email Ops, especially in Europe, handle Mailchimp and Mandrill App. They are a constant issue with the Swinog Blacklists. The problem boils down with differences in the privacy laws of US vs EU. In Switzerland (and probably most EU countries too), a company who sends

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-10 Thread Benoit Panizzon
Hi Suresh > There seems to be a miscommunication - I personally have seen > Mailchimp / Mandrill suspend a large number of spamming customers. Yes, the Mailchimp Customer I remember most, because one of my personal email addresses were targeted, was suspended, but probably re-subscribed under a s

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-10 Thread Benoit Panizzon
Hi Suresh > They aren’t under any obligation to reveal customer identity to you > and would potentially face legal liability for doing so. This is exactly the problem. Privacy Laws in Switzerland (and most other countires I know) states, that the sender must provide proof of opt-in. Therefore,

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-10 Thread Benoit Panizzon
Hi Suresh > As I doubt that mailchimp operates under Swiss jurisdiction- and they > probably have a customer contract that stipulates US jurisdiction .. > you'd have to rely on them suspending the spammer. I am aware of that. But the way mailchimp operates now, is as a spamer heaven. I don't kno

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-10 Thread Benoit Panizzon
Hi Matthias > > Therefore, the sender must be identifiable. If the sender is not > > identifiable, the ISP of the sender must provide the identity of the > > sender. > > On what legal theory is this based on? I am not a lawyer, but in my job I had some contacts with OFCOM, SECO, Lauterkeitskomm

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-13 Thread Benoit Panizzon
Hi Tim > Rule #1: Spammers lie. What sort of "proof of opt-in" could they > provide that can't be forged? Also, it does not follow from that > requirement that senders must be "identifiable." That may be a > separate legal requirement, but it doesn't logically follow from the > opt-in proof requir

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-13 Thread Benoit Panizzon
Hi Laura > Again, were you approaching this as an individual or was your lawyer > involved? There is no need to involve a lawyer. You don't need one. You contact the sender and request the proof of opt-in. If he does not comply, you file a complaint with the SECO (or you could try to fill one wi

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-13 Thread Benoit Panizzon
Hi Suresh > Did you try to identify the spammer with a dummy purchase If he is > doing something illegal? In my opinion, this is very dangerous and could get back on you. By doing a purchase, you get into a legal contract with that customer you don't want to comply with, but by which you get inf

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-13 Thread Benoit Panizzon
Hi Laura > > There is no need to involve a lawyer. > > There is if you’re asking a company to release customer information > to you. Which is what your request of Mailchimp is. Could you please provide legal background to your statement? I have been in contact with the legal advisers of OFCOM

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-14 Thread Benoit Panizzon
Hi Jay > ESP to victim: That mail was sent on behalf of ABC Company, and you > can contact them [here]. We don't tolerate spammers, and our customer > contracts require openness so these issues can be resolved. Attached > is a PDF of their signed statement where they certify that they have > your

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-14 Thread Benoit Panizzon
> Victim to ESP: I got this spam from your IP and have no idea why. It > touts some product, but all of the links are tracking bugs that point > back to you. Where did you get my address and on whose behalf did you > send it? > > ESP to victim: We believe you and we have disconnected the customer.

Re: [mailop] Mailchimp / Mandrill App: European VS US Privacy Laws

2016-06-14 Thread Benoit Panizzon
Hi Eric > So all I need to do to shut down a competitor is sign up for their > mailing list, then issue a complaint to their ESP? It's not that easy :-). If you signed up, your competitor can provide a proof (Time, IP-Address, received verification email) you signed up to you and the ESP. So you

[mailop] Abuse Contacts hosted @ gmail and Google's Spam filter

2016-06-28 Thread Benoit Panizzon
Hello Operating the experimental future SWINOG Spamtrap development and Spam Reporting infrastructure I often come across the problem, that many abuse desks have their abuse contact address hosted by Google. Unfortunately Google does not know about ARF Reports and very quickly considers an email

Re: [mailop] Abuse Contacts hosted @ gmail and Google's Spam filter

2016-06-30 Thread Benoit Panizzon
Am Tue, 28 Jun 2016 15:57:39 -0700 schrieb Hal Murray : > > > There is currently no way to deliver spam to abuse@ > domain> > > Google isn't the only problem. There are lots of outfits that do > content filtering on their abuse mailbox. > > It seem reasonable to reject mail from IP Addresses o

[mailop] Gmail SRS Problem: low reputation of sending domain

2016-08-12 Thread Benoit Panizzon
Hello Our Email Services implement SRS to forward emails from SPF protected domains. So the envelope server is being rewritten to the domain of the 'forwarder'. Example: eloig...@whutherl.local-girls.org => exam...@eblcom.ch (forwards to exam...@gmail.com) After SRS Rewriting the sender looks

Re: [mailop] Gmail SRS Problem: low reputation of sending domain

2016-08-14 Thread Benoit Panizzon
Hi John > >Any good ideas how to prevent that problem? > > A) don't use SRS > > B) don't blindly forward mail without spam filtering it first > > C) really, don't use SRS Yes, if you would ask me, email forwarding generally is a bad thing to do and we should start getting rid of it. But custom

Re: [mailop] Gmail blocking due to "missing" PTR record

2016-08-15 Thread Benoit Panizzon
Hi Seth > Terminal: (host 167.89.88.20 > 20.88.89.167.in-addr.arpa domain name pointer > o1.webmaillist.flowerdeliveryexpress.com.) 20.88.89.167.in-addr.arpa domain name pointer o1.webmaillist.flowerdeliveryexpress.com. $ dig -t any o1.webmaillist.flowerdeliveryexpress.com. ;; ANSWER SECTION: o

Re: [mailop] Facebook/Twitter, advice/anyone here?

2016-08-15 Thread Benoit Panizzon
Hi Michelle > Have a similar (though substantially smaller numbers) with Apple > iCloud accounts... main problem there is people sending receipts for > their purchases... you'd think they (the consumers) might be worried > about a third-party getting all their (valid) credit card details, > but I

[mailop] How to Contact: Office365 Customer Support - as non customer (ISP)

2016-08-18 Thread Benoit Panizzon
Hi Michael Do you know if there is a way to contact the Office365 Mail 'Tech' Support, as an email service offering ISP? I have tried to do that in the past, but the support always required me to provide some kind of contract ID or proof, that we use any kind of Office365 products, which we don't

[mailop] increased spam from "newslettertool2.1und1.de"

2016-08-29 Thread Benoit Panizzon
Hello In the last couple of days I have come across more spam emails originating from: mout.kundenserver.de [212.227.126.133] (whitelisted as much legitimate emails is sent from that IP) but which contain an unsubscribe link pointing to newslettertool2.1und1.de I wonder if OneAndOne created a new

Re: [mailop] Spamcop Contact

2016-09-01 Thread Benoit Panizzon
I used to discuss issues on their NNTP Server: news://news.spamcop.net/ But it is down at the moment (or has it been put out of service? I haven't connected for a long time) -Benoît Panizzon- -- I m p r o W a r e A G-Leiter Commerce Kunden _

Re: [mailop] Cloudflare not taking actions agains spamers?

2016-09-05 Thread Benoit Panizzon
Hi I also think a big difference is: Your Browser's cache does not hide the origin of the content. Cloudflare does. To prevent DDOS Attacks to the source of the content, that is their business. Bug this also hides where spamers host their stuff and provides a safe haven to them. At least they co

Re: [mailop] Cloudflare not taking actions agains spamers?

2016-09-06 Thread Benoit Panizzon
Hi Dave > Truthfully, forwarding complaints is a bit of a messy business as this > could easily forward to the abuser themselves. But, this should at > least be an option when filing a complaint, as should actually > terminating the abusive customer. I do know the problem. But I don't think it's

Re: [mailop] Cloudflare not taking actions agains spamers?

2016-09-07 Thread Benoit Panizzon
Hi Frank > It is hard to justify: take down this content because I received a bad > email. I would not take the site down after receiving one complaint. But usually a ISP receives various complaints from various sources. And that is a strong hint, that the customer is indeed a spamer. -Benoît Pa

[mailop] Getting Cloudmark Reputation Informations and Evidences of Issues?

2016-10-07 Thread Benoit Panizzon
Hello Does anyone know, if it is possible to get abuse feedback loop informations from cloudmark? Or if they have a way to query the reputation of IP Adress ranges within our responsability to find out what causes delivery issues? We offer wholesale email services for other ISP and take various m

Re: [mailop] Getting Cloudmark Reputation Informations and Evidences of Issues?

2016-10-07 Thread Benoit Panizzon
Hi Ken > If you're wholesaling then aren't you segmenting your sending IP > ranges on a per customer basis to identify ISPs with low quality > customers? Yes, we do (postfix regex transport rules mapping customer domains to outgoing server(IP) instances). In this case our 'catch all' IP's for sen

[mailop] Massive Spam advertizing .xyz domains

2016-10-13 Thread Benoit Panizzon
Hello Since about one week I notice higher load on my spamtraps. http://blacklist.woody.ch/rbltop.php Aeh, yes, nearly exclusively .xyz domains hitting my spamtraps at the moment. Anyone else noticing this? Worth notifying the registrar? Has anyone a good contact to nic.xyz? -Benoît Panizzon-

Re: [mailop] Massive Spam advertizing .xyz domains

2016-10-13 Thread Benoit Panizzon
Hi Stefan > the question is what's behind those domains? i didn't have the time to > analyze it, yet. I had a bit a deeper look into it. The Emails them self come from various IP Addresses. It's obviously a botnet. Almost all those xyz domains resolve to an IP within a /24 from AS41122. So I s

Re: [mailop] Massive Spam advertizing .xyz domains

2016-10-20 Thread Benoit Panizzon
Just a quick positive feedback on that case. I already noticed, that the massive spam avalanche suddenly dropped some when past week-end. Today I got feedback from gen.xyz that they had already suspended 20 of those domains prior to my complaint because of other complaints and that with the evide

[mailop] hosting.com mailservices failing on greylisting?

2016-10-21 Thread Benoit Panizzon
Hello We had complaints about delivery issues from hosting.com. After looking at the logs, it's obvious what goes wrong: We use greylisting, combined with exceptions for whitelists like dnswl.org or dnswl.swinog.ch to fend of botnet spam and accept email without delay from known/trusted ranges.

[mailop] connection issues from .*?.bullet.mail.(skk|kks).yahoo.co.jp

2016-10-28 Thread Benoit Panizzon
Hello I see a lot of connections from servers with hostnames ending in: bullet.mail.(skk|kks).yahoo.co.jp, but no emails sent. So I sniffed one of the connections. I see this SMTP Handshake: Me=> 200 Welcome to my server Yahoo <= HELO (hostname of yahoo server) Me=> 200-Hello I do suppo

Re: [mailop] connection issues from .*?.bullet.mail.(skk|kks).yahoo.co.jp

2016-10-28 Thread Benoit Panizzon
> PS: Maybe I am not supposed to send multiline prompts if a server > greets with HELO instead of EHLO? Note to self, next time read RFC before sending email... Old RFC 821 does not state, that a reply to HELO can be multiline. After changing my spamtrap to only send one line in reply to HELO, it

Re: [mailop] connection issues from .*?.bullet.mail.(skk|kks).yahoo.co.jp

2016-10-28 Thread Benoit Panizzon
Hi Vladis > in Appendix E). Only the EXPN and HELP commands are expected to > result in multiline replies in normal circumstances, however > multiline replies are allowed for any command. > > Note the last sentence. Nice, so Yahoo's mailservers are broken? -Benoît Panizzon- -- I m

Re: [mailop] connection issues from .*?.bullet.mail.(skk|kks).yahoo.co.jp

2016-11-10 Thread Benoit Panizzon
Hi all Thank you for the various feedback I got. I have re-worked my spamtrap SMTP dialogues. But still I get weird behavior from yahoo servers. (not yahoo japan this time, but servers like: nm37.bullet.mail.ne1.yahoo.com nm41-vm8.bullet.mail.ne1.yahoo.com I see them repeatedly connecting, iss

Re: [mailop] Yahoo blacklist removal

2016-11-15 Thread Benoit Panizzon
Hi Dave Some years ago I was in contact with yahoo because of a spam issue. I also had a hard time to find out how to contact a human. Try: uk-ab...@cc.yahoo-inc.com kwo...@uk.yahoo-inc.com They could advise you on who to contact. Also I was told not to send email to network-ab...@cc.yahoo-inc.

Re: [mailop] Yahoo blacklist removal

2016-11-16 Thread Benoit Panizzon
Hi Jay > You've masked what is actually a good idea there. Yahoo doesn't view > you as a customer in this case, hence no service. Get a recipient who > is a Yahoo customer to complain to them about not getting your wanted > mail. An Abuse Desk should never say 'you are not a customers', but look

Re: [mailop] Yahoo blacklist removal

2016-11-17 Thread Benoit Panizzon
Hi John > OK, they look at the problem and see no evidence that it's one that > any customers care about. Ticket closed. Agreed, if this is the case. But in Dave's case they see: * Our customers cannot receive email from this IP because we do blacklist them. * The owner of the range has chang

[mailop] cv.net abuse desk dead?

2016-11-28 Thread Benoit Panizzon
Hello Since a couple of weeks I observe a steady spam stream from: 24.38.92.131 (mail.orfclone.org). I did try to contact the domain owners, and the abuse desk or inetops addr of cv.net AS6128 All I get back are notices about my emails being deleted unread. Does anyone have a direct contact the

Re: [mailop] domaincop247.com service?

2016-12-15 Thread Benoit Panizzon
Hi > Based on your report and on this, I strongly suspect that this is a > scam. Yes, it turned out to be scam. The website hosting the abuse reports probably contained malware. The hoster took it offline after complaints from other ISP about fraudulent abuse reports regarding their ressources. S

Re: [mailop] Postmaster contact at orange.fr/wanadoo.fr?

2016-12-20 Thread Benoit Panizzon
Hi Nicolas Orange.fr / wanadoo.fr can be a real pain. Beginning 2015 we started seeing more and more spam from their "MAIL-ESSENTIALS-FRANCE" IP Ranges. Their abuse desk never reacted to any complaints. Escalations via Orange Switzerland lead to nothing, because the brand 'orange' in France appar

[mailop] Spamcop: 'this is not spam' feedback form broken?

2017-01-02 Thread Benoit Panizzon
Hello out there As abuse desk, when you get reports from spamcop, they contain a link where you can submit feedback to the reporter. Actually there is an abuse desk from another ISP which reported a couple spam reports we sent him back as spam to spamcop. I double checked. The email address is li

[mailop] UPC / Liberty Global: No retries after tempfail (greylisting)?

2017-01-03 Thread Benoit Panizzon
Hello Due customer complaints I started inspecting our logfiles for UPC anomalies. Indeed, UPC seems to have migrated it's email services from austria (chello.at ip range) to a Liberty Global IP range in NL This range is not yet whitelisted by SWINOG or DNSWL.org so our infrastructure applies gr

Re: [mailop] UPC / Liberty Global: No retries after tempfail (greylisting)?

2017-01-05 Thread Benoit Panizzon
Hi David Quick update on the issue. A tech from UPC Switzerland just called me back. Apparently they are having a hard time, lots of UPC Switzerland customers complaining about the email issue. Lots of trouble tickets opened by other swiss ISP. Responsible for the mess is UPC Austria (chello.at

[mailop] Offtopic: How does an taiwanese IRT work / ppt.cc URL shortening

2017-01-29 Thread Benoit Panizzon
Hi all My spamtraps are being hit by chinese spam advertizing the URL on the shortening service ppt.cc for several day now, with an incredible rate! Source is obviously a botnet as source IP's are spread around the globe. So it's time to look into the issue and send some personal email to the ab

[mailop] spamrl.com listings / Infos / contact?

2017-02-13 Thread Benoit Panizzon
Hello Does anyone know how to contact the operator of spamrl.com to get information why a IP address got listed? That domain is registered via anonymizing proxy and the webpage states they do not answer any delist and evidence requests but I should contact the 'recipients antispam provider'. Only

[mailop] How does Sendgrid validate customers (Swisscom Invoice Incident)?

2017-02-16 Thread Benoit Panizzon
Hi all I am wondering how such an incident could happen. Yesterday several of our customers (and also several of our support contact email addresses) got very carefully crafted and very authentic looking fake email invoice notifications from Swisscom. The 'online invoice' link points to a file c

[mailop] weird SPF problem with Round Robin DNS entries

2017-02-16 Thread Benoit Panizzon
Hello I wonder, are there any issues, if an SPF a:host entry resolved to multiple IP addresses? smtp.imp.ch has address 157.161.13.198 smtp.imp.ch has address 157.161.13.197 smtp.imp.ch has address 157.161.13.196 smtp.imp.ch has IPv6 address 2001:4060:1:1001::13:198 smtp.imp.ch has IPv6 address 2

[mailop] How to tell google, that our IOS Email Profile Geneator is not a phishing site?

2017-03-03 Thread Benoit Panizzon
Hello We are having a strange problem with our online IOS Email Profile generator to facilitate the configuration for IOS devices for our customers. https://autoconfig.breitband.ch/ It is also reachable under http://autoconfig.breitband.ch/ we will fix this. It is available under almost all doma

Re: [mailop] Why is it so hard to have takedown's performed..

2019-04-29 Thread Benoit Panizzon via mailop
Hi Michael Just a short update on DigitalOcean after I to their abuse desk that it took them almost a month to take down an ubs.com phishing site and they didn't even seem to bother to look at the other spam sources I mentioned in the same incident report. It again took them about two weeks to r

[mailop] DigitalOcean calling for social media s* storm? (Re: Why is it so hard to have takedown's performed..)

2019-04-29 Thread Benoit Panizzon via mailop
Hi List I wonder if DigitalOcean is running for some social media related wake-up call. I Twittered to @digitalocean about the lack of responsiveness from their abuse desk. They promptly replied via Twitter: "We apologise for the trouble. Our security & operation team is already looking into it

[mailop] Anyone with contact to: Digibyte Media B.V. Netherlands?

2019-05-13 Thread Benoit Panizzon via mailop
Hi List Since a couple of weeks our customers (and some of our support email addresses) get spam emails advertising erotica services hosted by DigiByte Media B.V. in the Netherlands. Blocking is not easy, as the sender IP, content of emails and redirection service URI used keeps changing. Their

[mailop] Mylove@1

2019-05-16 Thread Benoit Panizzon via mailop
Hi List I wonder if others have also stumbled over the password "Mylove@1". We use RoundCube as Webmail. We have 'stupid' customers, who give away their email password by answering to phishing emails or just simply are victims of trojans stealing their credentials. Subsequently those accounts g

[mailop] Anyone on this List with Access to Amazon SES Maillogs?

2019-05-16 Thread Benoit Panizzon via mailop
Please contact me off-list Short story: A customer of Amazon SES is attempting to send emails to one of our customers. Our customer is not getting them, we don't see ANY trace of those emails in our logs, they just seem to disappear in transit. Re-Tested yesterday, exact times known. Long last

[mailop] Did CloudFlare change tolerant attitude against spamer?

2019-05-16 Thread Benoit Panizzon via mailop
Hi List I have noticed that we didn't get any spamtrap hits advertising cloudflare.com in the last couple months. Before, spamers did love their anonymizing proxy service and their policy which stated as long as it's not DMCA or CP related we won't take down a customer's site. Is still states sp

Re: [mailop] Anyone on this List with Access to Amazon SES Maillogs?

2019-05-17 Thread Benoit Panizzon via mailop
> >nc: connect to rrmx.imp.ch. port 25 (tcp) failed: Network is unreachable > >nc: connect to rrmx.imp.ch. port 25 (tcp) failed: Network is unreachable > >nc: connect to rrmx.imp.ch. port 25 (tcp) failed: Network is unreachable > > > >So maybe AWS SES is trying to connect to the IPv6 address and ca

[mailop] Any contact to Google to debug 'aspmx' troubles?

2019-05-27 Thread Benoit Panizzon via mailop
Hi all I'm looking for a contact to Google (or anyone with insight on what could cause the problem) to solve a specific issue we have with a company using their ASP services. Observed Problem: I send them an email from the email client 'claws-mail'. This is received perfectly. But we use RT/4 a

Re: [mailop] Any contact to Google to debug 'aspmx' troubles?

2019-05-28 Thread Benoit Panizzon via mailop
Hi Grant > Why are messages, presumably from a human, outbound from RT/4 setting > the Precedence: header to bulk? I suppose to silence auto-responders to prevent them to play email ping-pong. I know the good old 'vacation' tool does not reply on presence of the bulk header. And also RT/4 itself

  1   2   3   >