ViRGE Posted September 25, 2015 Share Posted September 25, 2015 I'm not sure if anyone else has noticed this, but I'm suddenly seeing a fair bit of spam come through on my old Spamcop account. It tends to mostly be of the "Buy cheap Meds" variety, and prior to about two weeks ago I wasn't seeing anything like this. Given how obvious and easy to block it is, I'm wondering whether Cisco changed their forwarding policy to stop silently dropping spam. Though there aren't any headers to indicate that the Ironport equipment is IDing it as spam... Link to comment Share on other sites More sharing options...
petzl Posted September 26, 2015 Share Posted September 26, 2015 I'm not sure if anyone else has noticed this, but I'm suddenly seeing a fair bit of spam come through on my old Spamcop account. It tends to mostly be of the "Buy cheap Meds" variety, and prior to about two weeks ago I wasn't seeing anything like this. Given how obvious and easy to block it is, I'm wondering whether Cisco changed their forwarding policy to stop silently dropping spam. Though there aren't any headers to indicate that the Ironport equipment is IDing it as spam... Yes must of been a glitch? Stopped now. It was all BOTNET spam FAKE DRUG OR PLAIN PHISHING Link to comment Share on other sites More sharing options...
ViRGE Posted September 26, 2015 Author Share Posted September 26, 2015 It's still going on this morning, so whatever it was it hasn't stopped. And actually it's a bit annoying not because it's getting through, but because since it's being handed off via SC/Cisco's servers, it's getting negative (ham) points with SpamAssassin for coming from a reliable source. Link to comment Share on other sites More sharing options...
petzl Posted September 27, 2015 Share Posted September 27, 2015 It's still going on this morning, so whatever it was it hasn't stopped. And actually it's a bit annoying not because it's getting through, but because since it's being handed off via SC/Cisco's servers, it's getting negative (ham) points with SpamAssassin for coming from a reliable source. I find it pays to effectively report spam (I check the abuse addresses are correct SC uses "abuse.net which often by default uses "abuse at" even though SC picks up correct address) SpamCop won't send reports to "spam [ AT ] access.ironport.com"? Try sending them from your private account with SpamCop Tracking URL not sure if it's acknowledged but I'm not now getting BOTNET spam now? I did but in SC report also looked up who had the Botnet and reported it to countries "cert" as well I do spend a bit of time making spam reports pretty thorough though. https://www.spamcop.net/sc?id=z6172948368z52220b2c850cfbc036a566bf0a4194e1z This one I were the only one to report it. 1.52.195.225 is still listed as a Bornet though, it's not now on SC Blocklist it was when I reported it. My boiler plate though my be what they implement Example 1.52.195.225 BOTNET ATTACK HOST http://www.abuseat.org/lookup.cgi?ip=1.52.195.225 BLOCK OUTBOUND PORT 25, RESERVE FOR LEGIT EMAIL SERVER CHANGE TO SECURE PASSWORD SCAN INFECTED COMPUTER FOR MALWARE Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.