Hi, On Mon, May 8, 2017 at 7:30 AM, David Jones <djo...@ena.com> wrote: > From: do...@mail.com <do...@mail.com> > >>I received this very unusual email a few days ago. It (or another >>email), timed out my spamassassin check (which is a first). > >>I'm interested if this mail is legit, or if it's just a new trap. > >>> Return-Path: <rele...@racolage.xxx> >>> Received: from racolage.xxx ([216.51.232.227]) by mx.mail.com > > My Postfix postscreen RBL checks would have blocked this email > (right now anyway) based on the current RBL listing mainly from > senderscore.org score of 8 out of 100. > > http://multirbl.valli.org/lookup/216.51.232.227.html > > Also, like Joe Quinn said, it's from a xxx TLD which I don't allow. > This domain was recently registered which is another red flag.
It would have been rejected here with our postfix MP3 content filter. /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.mp3"?;?$/ REJECT mp3 .. although it appears to have been 'sniped' by the OP
