Ironport Spam Quarantine Service Abandonment

[#1]

I have been using the Ironport service since it was introduced.
Served me well. No need to log-on to view my spam stuff. No clearing to do. Absolutely brilliant. Any false detection easily dealt with.
Now I get an email from Plusnet telling me they are unable to continue with this service.
I believe it was introduced because they exposed our email address info to the outside world.
Now they tell be I have to go back to the old system. Nothing better. Just the same old crap system as before. I remember that thing being totally unmanageable, clogging up unless daily visits to clear the dross.
Please tell me this isn't so.
If I have to log-on to the web to view my spam I may as well take my email somewhere else and do it all on the web.
Len

[#2]

It's *only* the quarantine service we're removing, spam protection is staying in place.

[#3]

If you don't want to have to log in to webmail to see the spam emails you still have a number of options available in the spam settings at http://email.plus.net/

Move the email to the normal inbox so that when you collect mail you collect those as well with their [-SPAM-] marker

Use IMAP instead of POP3 in your mail client which will allow you to access the Spam folder without using webmail

Create a mailbox called spam and chose the setting to have spam moved to that mailbox. You can then collect the spam emails from that mailbox using your mail client. This has the advantage that it collects all spam for your domain in one mailbox instead of it being in all the individaul mailboxes. I find this works best with IMAP as false positives I can then move to the correct mailbox using my mail client (Thunderbird). This is the option I'll be taking.

[#4]

Think it's also worth adding that spam doesn't arise out of nowhere. A long while back a batch of pn accounts had their details harvested due to a hacking incident, but that is long enough ago that the resulting spam will probably have ceased. The vuln which allowed that has long since been dealt with. If you are still being hit with heavy spam then it's likely your personal details are being harvested from somewhere else on the Web. For example, a personal webpage, a Facebook entry, or a business-directory site.
This might be due to a vuln in some other site's Web backend, but it's more likely that your address is visible as a plain, unprotected 'mailto' on a page somewhere. You need to search for your email address, then locate and fix all instances of pages where it is being exposed to harvesting 'bots.

[#5]

I was one of those who's email was hacked, I was given a very nice new address.
but I kept the old one (free-online and IDPS(I dont pay supscriptions)),  I dont send using those, only my new one - but still get a lot of e-mails to the old
I also still get a lot of SPAM to these old , and some to the new.

I also use unique pre @ to identify who has leaked my address  got one this month, sent them off a stiff reply

[#6]

Quote from: Anteaus

A long while back a batch of pn accounts had their details harvested due to a hacking incident, but that is long enough ago that the resulting spam will probably have ceased.

My email address was also harvested in the famous leak. I got quite a lot of spam for a time afterwards. I use 'catch-all' to enable me to give unique addresses to commercial sites, public bodies, etc., and I have 'blackholed' a few of these. I seem to remember getting a spam email (properly identified as such by the Ironport server) some time in March this year. Haven't had one since.
Chris
PS -- I've never used the quarantine service and I don't use webmail unless I'm out and about, so I think that must be a red herring....

[#7]

Quote from: Chris

It's *only* the quarantine service we're removing, spam protection is staying in place.

2 questions:-
1. I've reset my spam filter to direct it to a new folder 'Spam' I've created in Windows Live Mail. Does this mean that from now on the spam that was previously quarantined will now go to my new Spam folder instead? I don't want to setup an imap account. I want to continue with my POP3.
2. I already have an anti-virus and Firewall setup on my computer. Does your Mcafee security conflict with it, or is it limited only to anti-spam? I would prefer not to have Mcafee.

[#8]

McAfee will definitely conflict with your existing, and probably better, security package
This has nothing to do with Spam filtering by Plusnet

[#9]

As for your question 1, if you want to continue using POP3, you will need to direct Plusnet ('Spam' tab under 'Manage My Mail' in the Members Centre) to mark spam as [-SPAM-] in the subject line and deliver it to your Inbox. (This is the only folder accessed by POP3 as far as I know.) You can then set up a Rule in your email client (Windows Live Mail or whatnot) to automatically deliver anything with [-SPAM-] in the subject line to your own Spam Folder.
Hope this helps.
Chris

[#10]

Alternatively
Set up a new email address and then direct the spam to it
It is then much easier to keep it separate

[#11]

Quote from: Anteaus

Think it's also worth adding that spam doesn't arise out of nowhere. A long while back a batch of pn accounts had their details harvested due to a hacking incident, but that is long enough ago that the resulting spam will probably have ceased. The vuln which allowed that has long since been dealt with. If you are still being hit with heavy spam then it's likely your personal details are being harvested from somewhere else on the Web. ------ snipped ------

Thanks for the replies.
I don't see a huge amount of spam, just enough to have to deal with it. (100's after a 2 week holiday!) I do still get mail addressed to a mail box that was closed after the 'vuln'. So that incident still has fallout. I guess my personal details are still floating around out there. I see no reason why those details are ever going to cease to be out there?
My domain name isn't changing and that's where most of it comes from (unless that's a false assumption?). So is that my problem? I don't need to publish an email address on the web, it's the website address itself that is the target?

Quote from: pierre_pierre

I was one of those who's email was hacked, I was given a very nice new address. ----- snipped -----

I don't  remember this being offered? Not sure how this would work? Or are you referring to using different mailboxes on your account?
I too have changed the prefix@ part of my reply address depending where it is going and don't think I have ever had any spam mail with the prefix correct. Its always marita@ or xyzq@ stuff. One of the last mails had 9 different prefixes marked as 'envelope recipient' One of those prefixes was a pre-'vuln' one. It would have been better if I had changed to a much smaller sub-set than I have. Then I could have whiteboxed just that few.
I thought that the main and overiding point of the Ironport Quarantine was that suspect mail was kept away from my hardware. To suggest solutions that allows that to again come to my inbox is surely a huge retrograde step.
I haven't had need to get my head around IMAP so don't understand how this might help.
As I said above, thanks for the replies.

[#12]

my original PN  address is username.free-online.co.uk,  they also brought out a variation username.idps.co.uk the idps being short for "I Dont Pay Subscritions"
after the hack, we were offered new names, I chose username.me.uk, so for instance one of my e-mails is mr@username.me.uk.
with no effort from me, all three variations go the the same mailbox, likewise I was given web space, again I can WWW any of the three and it goes to my site

[#13]

Quote from: Len5771

I do still get mail addressed to a mail box that was closed after the 'vuln'.

Do you still get genuine email to that email address? If not go to http://email.plus.net and select the Redirects tab. Add a new redirect with the Re-direct name of the prefix to be dumped. At the bottom select "I would like to blackhole this address and not receive email to it.". You will never see a single email to that email address again. The one problem with that is that if someone still has that email address and sends you a genuine email it silently disappears and they don't get a bounce. I'm about to make another post on how to make Plusnet do a proper bounce.