Re: [mailop] Ubuntu Noble/24.04 - TLS 1.0, 1.1 and DTLS 1.0 are forcefully disabled

2024-03-13 Thread Robert Giles via mailop
On 3/13/2024 at 12:55, Slavko via mailop wrote: Has anyone checked what traffic is still using TLS 1.0 or TLS 1.1 ? Yes, some infected machines from DZ, BR, AR, ID and so :-) I checked last 90 days log now, i found only small number of plain text deliveries to me, but no one legitimate host wi

Re: [mailop] [spamhaus] de-listing requests successful, but only for a couple of days.

2024-03-15 Thread Robert Giles via mailop
On 3/15/2024 at 10:35, Chris Adams via mailop wrote: Linode/Akamai has $5/month VMs that include a /64. So that's not a good excuse either. This. And Linode actually has an effective abuse desk. ___ mailop mailing list mailop@mailop.org https:/

[mailop] random.onmicrosoft.com SPAM

2024-03-20 Thread Robert Giles via mailop
Seeing this type of stuff quite a lot originating from legitimate Microsoft infrastructure, and their abuse desk never seems to take any action; I suppose dropping any *.onmicrosoft.com envelope-from is probably the right course of action here? From: Makita 6-pc Combo Kit Department ---

[mailop] Uptick in Google Groups spam?

2024-08-27 Thread Robert Giles via mailop
On the topic of free services that Google provides (with no support or abuse contact whatsoever), has anyone else noticed an uptick in Google Groups spam lately? I'm wondering what SpamAssassin rule to boost, but it seems like this operator has mostly covered their bases? KAM_INFOUSMEBIZ migh

Re: [mailop] Uptick in Google Groups spam?

2024-08-28 Thread Robert Giles via mailop
On 8/28/2024 at 07:27, Gellner, Oliver via mailop wrote: We have seen an increase of spam and phishing emails from Google Groups since 21.08. It seems the spammers are adding large amounts of collected addresses to groups and then sending their spam messages to the group address. While the spam

Re: [mailop] Uptick in Google Groups spam?

2024-08-28 Thread Robert Giles via mailop
On 8/28/2024 at 08:08, Gellner, Oliver via mailop wrote: Well, entirely for everyone who is not using Google Groups himself. If you have a small user base this might be actually "everyone". You can use the header X-Google-Group-Id. I have so far not seen any other emails from Gmail or Gsuite wh

Re: [mailop] Uptick in Google Groups spam?

2024-08-28 Thread Robert Giles via mailop
On 8/28/2024 at 13:48, Mark E. Mallett via mailop wrote: I'm on (I think) 7 such lists. At least one of them (beancount) is quite active. Only one (redo, a build system) is getting flooded with spam, and that just recently. FWIW, these are *new* Google Groups lists, expressly created for SPAM:

Re: [mailop] Unsolicited messages from *.outbound-mail.sendgrid.net

2024-10-14 Thread Robert Giles via mailop
On 10/14/2024 at 05:31, Paul Menzel via mailop wrote: Since at least September 17th, 2024, we receive a lot of unsolicited messages from SendGrid. I forwarded five to ab...@sendgrid.net, but there was no reply and the problem persists. Today at least five messages from xvfrkpcc.outbound-mail.se

Re: [mailop] Unsolicited messages from *.outbound-mail.sendgrid.net

2024-10-14 Thread Robert Giles via mailop
On 10/14/2024 at 07:17, Marco Moock via mailop wrote: They simply ignore mails to that address. It is a company that at least tolerates spammers using their services. I recommend rejecting all mail from them. The problem is convincing Sendgrid's customers - like Aegean S.A. - to quit and inso

Re: [mailop] Outlook IMAP implementation

2024-10-27 Thread Robert Giles via mailop
On 10/27/2024 at 13:47, Scott Q. via mailop wrote: Or intentionally sabotage the IMAP experience, because it's a really bad experience with this behavior. I'm pretty sure it's this; along the same lines as Microsoft barring GSSAPI auth against IMAP targets from Outlook (while allowing the sam

Re: [mailop] Blacklisting of Microsoft Exchange Online Nov. 2024

2024-11-11 Thread Robert Giles via mailop
Interesting; is there a straightforward way to drop that traffic entirely? I think the HRDP IPs and hostnames are probably indistinguishable for folks outside of the Microsoft ecosystem, and "OutboundIpPoolName=HighRiskOutboundPool" is some tenant-viewable internal marker that's not actually

Re: [mailop] onmicrosoft.com customers forging @microsoft.com addresses for phishing

2024-09-20 Thread Robert Giles via mailop
I've been reporting these to Microsoft (ab...@microsoft.com, ab...@outlook.com, j...@office365.microsoft.com), but I don't think they grok what's going on: --- Hi, Based on the information you provided, it appears to have originated from an Office 365 or Exchange Online tenant account. To r

Re: [mailop] Human contact at Office365?

2025-02-20 Thread Robert Giles via mailop
On 2/20/2025 at 09:31, Atro Tossavainen via mailop wrote: Are you forwarding the messages, or including full messages as attachments as their instructions say? (I think this is wholly unreasonable, but it is what they say, and I am very mildly curious as to whether it makes a difference if you do

Re: [mailop] Human contact at Office365?

2025-02-20 Thread Robert Giles via mailop
On 2/19/2025 at 23:19, Hans-Martin Mosner via mailop wrote: However, j...@office365.microsoft.com seems to be a black hole. There are no responses, and apparently no action to stop the spam (at least not within my attention span which is a number of days but not weeks). Is there any human ther

Re: [mailop] Cisco IronPort (iphmx.com) contact

2025-05-15 Thread Robert Giles via mailop
No, Ironports will use whatever DNS servers you specify. Also, I don't believe it's typical to employ third-party RBLs with Ironports; Cisco's SBRS is pretty good alone, IMO. Scott Q: not sure if you're aware, but there's a very coarse reputation check you can do here for your sending IP:

Re: [mailop] Cisco IronPort (iphmx.com) contact

2025-05-15 Thread Robert Giles via mailop
ministry in a foreign government. Their volume is so low it doesn't register anywhere so it's probably some extreme configuration Pfanner did to block unknown domains or something. Scott​​ On Thursday, 15/05/2025 at 08:36 Robert Giles via mailop wrote: No, Ironports will use