Increase in email spam lately

I would say in the last week, we have seen an increase in random spam coming through our IronPort C160. We are on async version 7.6.0-444. It seems in the message logs quite a few get out there with random. My boss just got 3 pieces of spam mail in the last 10 minutes. Here are our the settings in anti-spam.
Anything you guys recommend? Why the uptick in spam all of a sudden?
IronPort Anti-Spam Overview
IronPort Anti-Spam Scanning:
Enabled
Message Scanning Thresholds:
Always scan 128K or less.
Never scan 3M or more.
Timeout for Scanning Single Message:
120 seconds
Regional Scanning:
Off
CASE Core Files
21 May 2014 12:13 (GMT +00:00)
3.3.1-009
Not Available
CASE Utilities
21 May 2014 12:13 (GMT +00:00)
3.3.1-009
Not Available
Structural Rules
03 Sep 2014 12:56 (GMT +00:00)
3.3.1-009-20140902_211701
Not Available
Web Reputation DB
02 Sep 2014 11:48 (GMT +00:00)
20140902_113957
Not Available
Web Reputation DB Update
03 Sep 2014 16:26 (GMT +00:00)
20140902_113957-20140903_162316
Not Available
Content Rules
03 Sep 2014 17:21 (GMT +00:00)
20140903_172026
Available
Content Rules Update
03 Sep 2014 17:21 (GMT +00:00)
20140903_172101
Available
No updates in progress.

Ok I altered the values to 80 and 40 respectivly, and also slightly altered the SBRS score ranges for blacklist, throttled and allowed. Our CIO still got another piece of spam. I had him install the Ironport outlook plugin and report it as spam.
How can we stop this from getting in?
Envelope and Header Summary
Received Time:
04 Sep 2014 11:57:32 (GMT -04:00)
MID:
8565070
Message Size:
1.39 (KB)
Subject:
Hey, Need_to_Finance _a_New_Car? (AllCreditOK)
Envelope Sender:
[email protected]
Envelope Recipients:
-undisclosed recipients
Message ID Header:
<[email protected]newcarsfound.net>
SMTP Auth User ID:
N/A
Attachments:
N/A
Sending Host Summary
Reverse DNS Hostname:
point70.breadhosting.net (verified)
IP Address:
209.95.37.187
SBRS Score:
None
Processing Details
MAIL POLICY "DEFAULT" MATCHED THESE RECIPIENTS: undisclosed recipient
04 Sep 2014 11:57:31 (GMT -04:00)
Protocol SMTP interface Management (IP 192.168.1.200) on incoming connection (ICID 13310837) from sender IP 209.95.37.187. Reverse DNS host point70.breadhosting.net verified yes.
04 Sep 2014 11:57:31 (GMT -04:00)
(ICID 13310837) ACCEPT sender group SUSPECTLIST match sbrs[none] SBRS None
04 Sep 2014 11:57:32 (GMT -04:00)
SMTP delivery connection (DCID 4387118) opened from Cisco IronPort interface 192.168.1.200 to IP address 10.1.1.3 on port 25.
04 Sep 2014 11:57:32 (GMT -04:00)
Delivery connection (DCID 4387118) successfully accepted TLS protocol TLSv1 cipher RC4-SHA .
04 Sep 2014 11:57:32 (GMT -04:00)
Start message 8565070 on incoming connection (ICID 13310837).
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 enqueued on incoming connection (ICID 13310837) from [email protected].
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 on incoming connection (ICID 13310837) added recipient (undisclosed recipient).
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 SPF: helo identity [email protected] Pass
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 scanned by engine SPF Verdict Cache using cached verdict.
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 SPF: mailfrom identity [email protected] Pass
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 does not contain DKIM signature.
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 contains message ID header '<[email protected]newcarsfound.net>'.
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 original subject on injection: Hey, Need_to_Finance _a_New_Car? (AllCreditOK)
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 (1425 bytes) from [email protected] ready.
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 matched per-recipient policy DEFAULT for inbound mail policies.
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 scanned by Anti-Spam engine: CASE. Interim verdict: Negative
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 scanned by Anti-Spam engine: CASE. Final verdict: Negative
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 scanned by Anti-Virus engine Sophos. Interim verdict: CLEAN
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 scanned by Anti-Virus engine. Final verdict: Negative
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 scanned by Outbreak Filters. Verdict: Negative
04 Sep 2014 11:57:32 (GMT -04:00)
Message 8565070 queued for delivery.
04 Sep 2014 11:57:32 (GMT -04:00)
(DCID 4387118) Delivery started for message 8565070 to undisclosed recipient.
04 Sep 2014 11:57:33 (GMT -04:00)
(DCID 4387118) Delivery details: Message 8565070 sent to undisclosed recipient
04 Sep 2014 11:57:33 (GMT -04:00)
Message 8565070 to undisclosed recipient received remote SMTP response '2.6.0 <[email protected]newcarsfound.net> Queued mail for delivery'.

Similar Messages

Excessive Email Spam

I have been receiveing excessive spam email today that is not being filtered out by the verizon email spam filter. Has anyone else noticed this? The spam filter was previously working.
Ed

I have also seen a lot more SPAM the last few days than I am used to. I suspect the issue is tied to an intermittent failure of one or more of Verizon SMTP and POP servers. Both problems appeared at the same time. There is another thread on this board about Verizon email being broken.
I would hesitate to use the word broken, let's just say unreliable. The POP/SMTP servers seem to go up and down like a yo-yo, and talking to Verizon Customer Service is like talking to a brick wall. The only thing they can do is play with your computer. The possibility that it is actually a Verizon problem is beyond their comprehension.
If the www.verizon.net says it is unavailable, and my email client says it is getting a status of ' service temporarily unavailable', I seriously doubt that changing anything on my computer will have any effect, since www.verizon.net is interacting directly with the pop servers without my computer being involved in the conversation.
anyway I suspect that when they get the server issues fixed, the SPAM filter will also begin working reliably again.

TS1424 I get error message -3253 when downloading purchased music. Have changed my email address lately. Suggestions?

Have bought music on iTunes. Get error message -3253 when downloading. Has changed email address lately.

Changing my DNS settings worked for me (3253 errors on my MBP). I followed the instructions here:
http://appletoolbox.com/2010/09/itunes-10-the-network-connection-was-reset-fix/
Hope that helps!

Email spam filter

I am using Intuit's GoPayment to process my credit card payments from customers. GoPayment allows me to email a receipt to my customer but many do not have email addresses so I purchased the HP3522 ePrinter so that I could email the receipt directly to the printer's email address enabling me to provide them with a printed receipt. The email spam filter is rejecting these emails. Intuit creates the email and sends it with my gmail account listed as sender. (I have the settings on the printer set to accept ANY addresses). Anyone else have this issue?
I am able to send the receipt to myself and then send that email to the printer but that seems rather counter-productive and time-consuming. Is there a way to get these receipts to print on this printer without this added step??
I paid for the printer, the paper, and the ink cartridges - shouldn't it be MY decision if spam emails are using it up??? Please, let ME decide what is spam!!!

Hi CARParts. The spam filter for email prints cannot be overridden. If the subject line is blank, that could be a reason it is being blocked, but I imagine it has something typed in. If you wish to print these receipts a workaround to consider would be to have them sent to your email directly and then save/convert them to a PDF file, and then send to the printer.
TwoPointOh
I work on behalf of HP
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the bottom to say “Thanks” for helping!

Unhappy with OS X Server handling of email spam

I'm unhappy with the way that OS X Server (on Mountain Lion) handles email spam.
What I *want* is to be able to set some SpamAssassin rules, and then to have the mail server refuse spam emails (not accept and put into Junk, but refuse to accept them in the first place). I used to do this with Exim and the sa-exim tool. In 10.7 I decided to switch to the built-in mail server, but that doesn't offer this functionality.
I would settle with being able to set some SpamAssassin rules and then have the server filter junk email into my Junk folder. 10.7 Server used to do this; I had to enable webmail and turn on the setting in there, and it would configure Pigeonhole (a Dovecot plugin) to put spam into the Junk folder. 10.8 server no longer offers webmail and no longer comes with Pigeonhole. I can add it myself with MacPorts, but I don't understand how to configure it on OS X Server.
So I have to settle for my OS X Server delivering all junk emails to my inbox, where then I have to delete them one-by-one on my iPhone. I could leave a Mac on at home all day to do the spam filtering, but that just seems silly.
If anyone could tell me how to set up Pigeonhole on OS X Server (10.8) to put my spam into a folder - or even how to set up Postfix to refuse spam in the first place - I would be very, very happy.

The issue you've run into is that postfix uses amavisd as its post queue (I.e. received and accepted by smtp) filter.
If you don't want to set server-side rules ( easiest way is still webmail / Managesieve plugin) to auto move junk mail into a junk folder because of security concerns, then there are other options.
Most of the logic for spam checking is done by amavis. It calls as subprocessess spamassassin and clam av.
Changes you make in spamassassin conf are used by spamassassin but amavisd may overrule spamassassin.
So your options are:
1. Make webmail a local intranet access only - I.e. use a custom port 8xxx and don't open that to the Internet via your router or firewall rules.
2. Quarantine spam to a new mailbox so it doesn't get delivered to the user.
I haven't done this but, if you have a look at http://wiki.apache.org/spamassassin/IntegratedInPostfixWithAmavis ,
It has some instructions on how to adjust the amavisd conf ( path to server/mail/config/amavisd/amavisd.conf ) , set up a new mailbox and quarantine the spam to there. This saves you having to set up webmail /Managesieve plugin, and means that you don't lose any mail incorrectly classified, although you will need to clean it out from time to time.
If you have a lot of users, number 1. Is a better fit for an administrator because the user can manage their own spam.
At the moment I'm grappling with how to get the child-process spamassassin to look up user-managed auto white lists and prefs set through webmail sauserprefs plugin. Still a work in progress.......
Hope that helps.

Iphone Email Spam!!!

Iphone Email Spam... How do I filter the spam? My yahoo account filters the spam, but the Iphone does not!!

How you are accessing your Yahoo account on your computer is called webmail access using a browser with IE which also indicates Yahoo is doing the SPAM filtering at the incoming mail server for your account which should be the same when accessing the account with the iPhone's email client.
The iPhone's email client which is similar to using Outlook Express or Outlook on your computer if you used either one but is on a more limited scale does not include a SPAM filter. You may want to contact Yahoo technical support regarding why the SPAM filtering they are doing at the incoming mail server when accessing the account via webmail when using IE is not applied when the iPhone's email client checks the account for new messages before messages are downloaded from the incoming mail server.

Junk email/spam iphone5

How can I filter junk email / spam from coming into my inbox on my iPhone5?

You will have to do that through your mail service provider. The iPhone does not provide any additional features to filter email.

Were COMODO cerfiticate collection emails SPAMmed?

I tried a few times to use COMODO S/MIME E-Mail certificate on my iCloud mail.
But still now, I have not received any emails which titled as "Your certificate is ready for collection!" and should be from "Certificate Customer Services <[email protected]>".
Were those emails SPAMmed?
The try before the last was about 3 weeks or even earlier before. No email arrived.
Then I revoked that certificate and tried again today at around 3:00PM. No email arrived.

Well, it fixed by myself.
I created a new rule on icloud.com: While mails from '[email protected]' arrived, 'MOVE TO FOLDER' Archive automatically.
As a result, the mail arrived, althrough that was still in Inbox.

How can I protect against email spam robots in muse?

how can I protect against email spam robots in muse?

Put recaptcha or becaptcha on all of your contact forms and set up cloudflare on the site.

I have an Apple computer, use both Firefox and Safari browsers, use Comcast for my email. Lately, when on Firefox, my email is not functioning properly. Why?

I have an Apple computer, use both Safari and Firefox browsers. I use both Apple mail and Comcast for my email. Lately, when in Firefox, my email does not work properly. I get a message "your servers license has expired". While I can usually access my emails I cannot delete unwanted emails. This problem does not happen when I use Safari and Apple mail. Is this a Firefox issue or Comcast? Do you know what license expiration refers to?

Hello,
Many site issues can be caused by corrupt cookies or cache. In order to try to fix these problems, the first step is to clear both cookies and the cache.
Note: ''This will temporarily log you out of all sites you're logged in to.''
To clear cache and cookies do the following:
#Go to Firefox > History > Clear recent history or (if no Firefox button is shown) go to Tools > Clear recent history.
#Under "Time range to clear", select "Everything".
#Now, click the arrow next to Details to toggle the Details list active.
#From the details list, check ''Cache'' and ''Cookies'' and uncheck everything else.
#Now click the ''Clear now'' button.
Further information can be found in the [[Clear your cache, history and other personal information in Firefox]] article.
Did this fix your problems? Please report back to us!
Thank you.

Emails spams

Hello
I have lots of emails spams coming into my emails. How to stop them from emailing me with spams?hope you can help?

Setup email filters on your mail provider's website. The iPad Mail App does not have filtering capability.

Noticeably increased amount of spam with Ironport

Hello,
We are using Ironport C170 for several clients. All the clients have a lot more untagged spam emails during last two weeks. Is it expected? Maybe there is some new known bot-net activity on the Internet?
Thanks,
Nikolay

Hello Nikolay,
bot activities should not result in the numbers of spam increasing significantly, of course at the beginning of a campaign there will always be something slipping through, but this should not be a permanent issue. I'd suggest that you check your system monitor, in the inbound section the number of messages blocked by reputation filtering should be in the 85 to 90 (or higher) range, if not then maybe there is something wrong.
Also, use message tracking to figure out which sendergroups the missed spam has been hitting, often the reason for that is a host that is whitelisted in the HAT and does not get scanned by IPAS.
Hope that helps,
Andreas

A lot of Spam lately

Hello,
someone else posted a message about this and I think its a strange coincidence.
All of a sudden I started receiving all these spam messages (multiple per day) about meds, etc. Usually the others on the To and Cc list are .mac adresses...
I know I can configure junk and rules and such, but should apple not do something about this? Can they?
thanks

Do you use this email address when making online purchases (except when purchasing from the Apple online store if used) or when required for website access and do you automatically render all HTML received or ever use the remove from mailing list link included with spam?
If so, you are contributing to the amount of spam you are receiving and the same will occur regardless the ISP or email account provider and there is much more included with the cost of a .Mac account than email account access.
Copied from the first link I previously provided.
No single strategy is completely effective when it comes to managing Unsolicited Bulk Email (UBE), also known as "spam". People who are intent on sending spam are ingenious at coming up with ways around any filtration schemes.
Automatically rendering all HTML received can reveal that your email address is valid to a spammer if the recieved message is not automatically marked as spam. When a spam message is formatted in HTML and includes embedded images and/or objects that must be rendered from a remote server, this can inform the spammer that your email address is "known good" and "known good" email address lists are sold/exchanged with other spammers causing even more spam to be received. If a spam message is correctly marked as spam when received, no HTML is rendered but not for spam messages that are not marked as junk.
If spam keeps coming and is ever increasing, it has been my experience that something was inadvertantly done previously or continues to be done that is causing the problem. Once the cat if out of the bag, it is difficult to stop without creating a new email address.
Regarding the custom mail or spam feature, I use none and only the default Junk Mail rules and I have very few problems with spam.

Email SPAM filter doesn't work

Is the webmail SPAM filter supposed to ... like ... prevent SPAM? I get the same SPAM every day. The SPAM button does nothing,

I have been marking about 30 per day as spam and forwarding all of them to the address that Verizon says is for undetected spam. The spam I get is all from the same outfit, I believe, based on the uniformity of how they package their notes and the fact that all of the links are spoofed. One would think that after 30 a day for several months, somebody in Verizon would wake up to the fact that Verizon users are getting killed with spam. One would think that if they truly cared about our email experience they would have an army of folks jumping on the spam we forward to them, aggressively pursuing it and working to reduce it. The fact is that they show no evidence of putting forth ANY effort at making our experience better.
The fact seems to be that they have little concern for their email users. The more of us that stick with Verizon for our home internet service, paying them their monthly fee, but jump to other, better email providers merely means less work for them. Not a bad model for making maximum profit, but a sucky way to treat customers.
My Verizon Wireless service has been fantastic. But my Verizon phone/internet service sucks. I'm just waiting until another provider is available in my area so I can leave Verizon forever. Lousy support, uncaring employees. I send in notes to them and get zero response. Look at the complaints in these forums that continue to rack up. Almost no response from the company. We're all left to try to deal with our problems ourselves with only minimal support. Probably some intern that spends his/her shift playing Angry Birds.

Email spam question

I get alot of spam and windows mail stops it pretty well.. my question is when i setup my iphone to recieve email all the mail comes spam and all.. anyway around this...

so i have to get ahold of my isp?.. maybe i will try routing it thru google.. seemed to work on my htc magic

Increase in email spam lately

Similar Messages

Maybe you are looking for