cancel
Showing results for 
Search instead for 
Did you mean: 

Is this Ironport or have the spammers lost the email address

Community Veteran
Posts: 38,209
Thanks: 902
Fixes: 54
Registered: 15-06-2007

Is this Ironport or have the spammers lost the email address

I have a number of email addresses which were compromised and I used to get a lot of spam (mostly picked up by Postini) but now don't get any at all. Even the catchall only gets 2 or 3 a week.
Is this down to the Ironport or have the spammers who pilfered the email addresses from Plusnet given up or otherwise stopped.
16 REPLIES
Community Veteran
Posts: 26,341
Thanks: 598
Fixes: 8
Registered: 10-04-2007

Re: Is this Ironport or have the spammers lost the email address

Try turning spam filtering off temporarily to find out! Tongue
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
Community Veteran
Posts: 38,209
Thanks: 902
Fixes: 54
Registered: 15-06-2007

Re: Is this Ironport or have the spammers lost the email address

That is a bit extreme  Shocked - but presumably disabling edge protection would just dump it all in the spam folder
Community Veteran
Posts: 26,341
Thanks: 598
Fixes: 8
Registered: 10-04-2007

Re: Is this Ironport or have the spammers lost the email address

Not if they are being rejected because of the senderbase reputation, they would still be rejected.
jelv (a.k.a Spoon Whittler)
   Why I have left Plusnet (warning: long post!)   
Broadband: Andrews & Arnold Home::1 (FTTC 80/20)
Line rental: Pulse 8 Home Line Rental (£13/month)
Mobile: iD mobile (£4/month)
Community Veteran
Posts: 38,209
Thanks: 902
Fixes: 54
Registered: 15-06-2007

Re: Is this Ironport or have the spammers lost the email address

On the basis that I don't seemed to have lost any emails I think I will leave well alone  Grin
Community Veteran
Posts: 6,253
Thanks: 430
Fixes: 39
Registered: 30-07-2007

Re: Is this Ironport or have the spammers lost the email address

Quote
Not if they are being rejected because of the senderbase reputation, they would still be rejected.

Yep , I tried turning Edge protection off and the volume of spam didnt increase.
Superuser
Superuser
Posts: 8,876
Thanks: 407
Fixes: 36
Registered: 06-04-2007

Re: Is this Ironport or have the spammers lost the email address

I think the most likely explanation for the absence of spam to the previously targetted addresses is SenderBase doing its job. However after having a compromised address of mine blackholed for some months I enabled it again and since then it has not received any spam (this was originally pre-IronPort). So it seems the spammers can and do detect "dead" addresses and stop using them.
The corollary of this is that SenderBase rejection might (in time) result in an address ceasing to receive spam.
In my case I haven't received any spam to a compromised address I still use for two weeks. Prior to that I was receiving 1 or two a day (compared with upwards of 10 a day with Postini. (I have "edge protection" off.)
David
Community Veteran
Posts: 19,092
Thanks: 428
Fixes: 21
Registered: 31-08-2007

Re: Is this Ironport or have the spammers lost the email address

I would turn the soon to be renamed "edge protection" off JIm, then any genuine messages that might have been dumped will at least get a bounce.
Community Veteran
Posts: 38,209
Thanks: 902
Fixes: 54
Registered: 15-06-2007

Re: Is this Ironport or have the spammers lost the email address

Done - lets see if there is a difference
Community Veteran
Posts: 38,209
Thanks: 902
Fixes: 54
Registered: 15-06-2007

Re: Is this Ironport or have the spammers lost the email address

I received two bank spam emails but from different IP addresses
ip=66.21.41.101
ip=79.170.40.140
Community Veteran
Posts: 38,209
Thanks: 902
Fixes: 54
Registered: 15-06-2007

Re: Is this Ironport or have the spammers lost the email address

Received 4 spam emails from ip=79.170.40.140 all about banks
This is with edge protection turned off
Superuser
Superuser
Posts: 8,876
Thanks: 407
Fixes: 36
Registered: 06-04-2007

Re: Is this Ironport or have the spammers lost the email address

Those are from a domain hosted by Heart Internet in Nottingham. The mailserver is rated "neutral" whereas others are "good". Reverse DNS is OK, so I guess IronPort would accept tham. Were the messages subsequently identified as spam and placed in your spam folder or is that classification one applied by yourself?
David
David
Superuser
Superuser
Posts: 8,876
Thanks: 407
Fixes: 36
Registered: 06-04-2007

Re: Is this Ironport or have the spammers lost the email address

Moderator's Note:
I've moved the previous 3 posts from the Blacklisting/Whitelisting problems thread since I think they were intended to be follow-up feedback in this one after turning "Edge Protection" off.
David (spraxyt)
David
Community Veteran
Posts: 38,209
Thanks: 902
Fixes: 54
Registered: 15-06-2007

Re: Is this Ironport or have the spammers lost the email address

David,
i was replying to this post by Bob http://community.plus.net/forum/index.php/topic,71651.msg583854.html#msg583854
Yes they were in the spam fiolder
Superuser
Superuser
Posts: 8,876
Thanks: 407
Fixes: 36
Registered: 06-04-2007

Re: Is this Ironport or have the spammers lost the email address

Jim,
I'm puzzled by the relevance to that. That thread is about White/Blacklisting problems and the question you referenced relates to misidentified spam/not-spam (in the context of that thread because white/blacklisting doesn't work for catch-all addresses not assigned an alias (and there is one report that the lists don't work even if an alias is assigned)). There is also an outstanding question about what should happen for a redirect.
Are you saying the bank meesages that ended up in your spam folder are not spam and you have the address whitelisted?
David
David