Jump to content

Did The spam Deletion Policy Change?


ViRGE
 Share

Recommended Posts

I'm not sure if anyone else has noticed this, but I'm suddenly seeing a fair bit of spam come through on my old Spamcop account. It tends to mostly be of the "Buy cheap Meds" variety, and prior to about two weeks ago I wasn't seeing anything like this.

Given how obvious and easy to block it is, I'm wondering whether Cisco changed their forwarding policy to stop silently dropping spam. Though there aren't any headers to indicate that the Ironport equipment is IDing it as spam...

Link to comment
Share on other sites

I'm not sure if anyone else has noticed this, but I'm suddenly seeing a fair bit of spam come through on my old Spamcop account. It tends to mostly be of the "Buy cheap Meds" variety, and prior to about two weeks ago I wasn't seeing anything like this.

Given how obvious and easy to block it is, I'm wondering whether Cisco changed their forwarding policy to stop silently dropping spam. Though there aren't any headers to indicate that the Ironport equipment is IDing it as spam...

Yes must of been a glitch?

Stopped now.

It was all BOTNET spam FAKE DRUG OR PLAIN PHISHING

Link to comment
Share on other sites

It's still going on this morning, so whatever it was it hasn't stopped. :(

And actually it's a bit annoying not because it's getting through, but because since it's being handed off via SC/Cisco's servers, it's getting negative (ham) points with SpamAssassin for coming from a reliable source.

Edited by ViRGE
Link to comment
Share on other sites

It's still going on this morning, so whatever it was it hasn't stopped. :(

And actually it's a bit annoying not because it's getting through, but because since it's being handed off via SC/Cisco's servers, it's getting negative (ham) points with SpamAssassin for coming from a reliable source.

I find it pays to effectively report spam

(I check the abuse addresses are correct SC uses "abuse.net which often by default uses "abuse at" even though SC picks up correct address)

SpamCop won't send reports to "spam [ AT ] access.ironport.com"?

Try sending them from your private account with SpamCop Tracking URL not sure if it's acknowledged but I'm not now getting BOTNET spam now?

I did but in SC report also looked up who had the Botnet and reported it to countries "cert" as well

I do spend a bit of time making spam reports pretty thorough though.

https://www.spamcop.net/sc?id=z6172948368z52220b2c850cfbc036a566bf0a4194e1z

This one I were the only one to report it.

1.52.195.225 is still listed as a Bornet though, it's not now on SC Blocklist it was when I reported it.

My boiler plate though my be what they implement

Example

1.52.195.225
BOTNET ATTACK HOST
http://www.abuseat.org/lookup.cgi?ip=1.52.195.225
BLOCK OUTBOUND PORT 25,
RESERVE FOR LEGIT EMAIL SERVER
CHANGE TO SECURE PASSWORD
SCAN INFECTED COMPUTER FOR MALWARE
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...