Re: [mailop] AT&T Block

[Jeff Pang via mailop]

I suspect that this is being blocked because these are new IPs that AT&T 
has never received mail from, so they block them by default. Is there an 
official way to inform AT&T before trying to send mail from new IPs that 
new IPs will be sending mail?  As far as I know AT&T is the only service 
that outright blocks messages from new and unseen IP addresses by default.


No. TNL(t-online) is even worse.
BTW, you may contact Lili directly who is on this list.


--
Jeff Pang
jeffp...@aol.com
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] drunks and lampposts, Contact Qualtrics

[Tobias Fiebig via mailop]

Moin,

> I really think you should look at some of the human factors research 
> rather than guessing.  The SOUPS conferences are a good place to
> start.

Oh, I did not know that there was conferences about this stuff. I just
did some quick googling, and found a really interesting summary paper:

https://arxiv.org/pdf/2103.13287

Will definitely give it a read and report back on what I learned. :-)

With best regards,
Tobias

> > 

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] drunks and lampposts, Contact Qualtrics

[John R Levine via mailop]

On Fri, 5 Jul 2024, Tobias Fiebig wrote:

I think we had that discussion as well today; Something about me
claiming that sending mails looking that much like phishing actually
trains people to not question all the other funny mails coming in; I
think that is why I said 'this is going to my "this is why phishing
works" folder' about the message you are referring to below.


I really think you should look at some of the human factors research 
rather than guessing.  The SOUPS conferences are a good place to start.



By the way, the message you got from Qualtrics that provoked this
issue had a web bug.


Which one do you mean? The likely personally parameterized URI for the
survey, or the likely not so GDPR compliant 1px image sharing the same
parameters going to some "Watermark.php" at the bottom of the mail?


Web bug is the usual name for the 1 pixel thing.

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Jeff Pang via mailop]

OT question, can return-path be customized by sender MTA/MUA? Or must it  be 
envelope?

July 6, 2024 at 1:45 AM, "Mark Fletcher"  wrote:



> 
> On Fri, Jul 5, 2024 at 5:31 AM Jeff Pang via mailop 
> 
> wrote:
> 
> > 
> > When an user requests to join mailing list, which address should we
> > 
> >  take? The envelope address, or the header From address?
> > 
> >  For email subscriptions, we use the header From address.
> > 
> 
> For email to a list, we look at the header From, Reply-To and then envelope
> 
> address, in that order, to determine if they are a subscriber.
> 
> Cheers,
> 
> Mark
>

Jeff Pang
jeffp...@aol.com
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Jeff Pang via mailop]

Great to know this point Thanks Victor.
And I think this is the reason why DMARC uses header address for DKIM/SPF not 
envelope address.


July 6, 2024 at 12:02 AM, "Viktor Dukhovni via mailop"  
wrote:



> 
> On Fri, Jul 05, 2024 at 07:45:10PM +0800, Jeff Pang via mailop wrote:
> 
> > 
> > When an user requests to join mailing list, which address should we
> > 
> >  take? The envelope address, or the header From address?
> > 
> 
> The envelope sender address is the address to use for bounces, SPF and
> 
> little else. It can change in transit (e.g. SRS). Therefore, you
> 
> should use the *header* "From:" address, which is also the address that
> 
> replies would typically go to, ...
> 
> The actual email address of the message author appears in the "From:"
> 
> header, and that's the address that is requesting to join the list.
> 
> -- 
> 
>  Viktor.
> 
> ___
> 
> mailop mailing list
> 
> mailop@mailop.org
> 
> https://list.mailop.org/listinfo/mailop
>

Jeff Pang
jeffp...@aol.com
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] drunks and lampposts, Contact Qualtrics

[Tobias Fiebig via mailop]

Moin,

> Most mail clients don't even show the From header addresses, and what
> studies there are consistently say that even if they do, people don't
> look at them.  They're much more likely to be confused by the message
> body formatted to look like whatever they're impersonating.

I think we had that discussion as well today; Something about me
claiming that sending mails looking that much like phishing actually
trains people to not question all the other funny mails coming in; I
think that is why I said 'this is going to my "this is why phishing
works" folder' about the message you are referring to below.

> By the way, the message you got from Qualtrics that provoked this
> issue had a web bug.

Which one do you mean? The likely personally parameterized URI for the
survey, or the likely not so GDPR compliant 1px image sharing the same
parameters going to some "Watermark.php" at the bottom of the mail?

> Did you notice?

No. I at some point decided to use the "Never load remote content from
the Internet" radio button, given that essentially every second email
has one of those these days, and stop caring about them. Which, to be
honest, is not really something I am overly fond of.

I am really yearning for going back to mutt; I just need to find a
useful caldav client which i can directly feed ics from mutt, then I
could actually do that.

With best regards,
Tobias
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[John Levine via mailop]

It appears that Jeff Pang via mailop  said:
>Hello
>
>When an user requests to join mailing list, which address should we 
>take? The envelope address, or the header From address?

This is a religious argument, but the One True Religion is the header From.

I used to use ezmlm which used the envelope address and it was a pain.

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] drunks and lampposts, Contact Qualtrics

[John Levine via mailop]

It appears that Tobias Fiebig via mailop  said:
>For reasons (mainly me mindlessly publicly stating that it would be
>ideal for starting phishing campaigns, and not wanting to see it go to
>the wrong hands), i just reg'ed qemaiIserver.com, while qualtrics is
>sending mails from qemailserver.com;

This is the PaypaI attack which was a big deal two and a half decades
ago in 2000. It is irrelevant now. Even if you could figure out all of
the near homographs for qemailserver or Qualtrics, it wouldn't matter.

Most mail clients don't even show the From header addresses, and what
studies there are consistently say that even if they do, people don't
look at them.  They're much more likely to be confused by the message
body formatted to look like whatever they're impersonating.

By the way, the message you got from Qualtrics that provoked this
issue had a web bug.  Did you notice?

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Mark Fletcher via mailop]

On Fri, Jul 5, 2024 at 5:31 AM Jeff Pang via mailop 
wrote:

>
> When an user requests to join mailing list, which address should we
> take? The envelope address, or the header From address?
>
> For email subscriptions, we use the header From address.

For email to a list, we look at the header From, Reply-To and then envelope
address, in that order, to determine if they are a subscriber.

Cheers,
Mark
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Alessandro Vesely via mailop]

On Fri 05/Jul/2024 15:00:45 +0200 Jaroslaw Rafa wrote:

Dnia  5.07.2024 o godz. 19:45:10 Jeff Pang via mailop pisze:


When an user requests to join mailing list, which address should we
take? The envelope address, or the header From address?


I think you should follow the best practice, ie. how it is implemented in
the predominant mailing list software (eg. mailman).



That's right.  It is incredible how little standardization exists about mailing 
lists.  For Mailman 3, there are sentences like this:

While configurable, the sender addresses by default are those named
in the From:, Sender:, and Reply-To: headers, as well as the envelope
sender (though we won’t worry about the latter).

https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/runners/docs/incoming.html#sender-addresses

The complicate setup can work around several problems at the crossroads of 
various standards, but there is no standard.


Best
Ale
--






___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Viktor Dukhovni via mailop]

On Fri, Jul 05, 2024 at 07:45:10PM +0800, Jeff Pang via mailop wrote:

> When an user requests to join mailing list, which address should we
> take?  The envelope address, or the header From address?

The envelope sender address is the address to use for bounces, SPF and
little else.  It can change in transit (e.g. SRS).  Therefore, you
should use the *header* "From:" address, which is also the address that
replies would typically go to, ...

The actual email address of the message author appears in the "From:"
header, and that's the address that is requesting to join the list.

-- 
Viktor.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] Contact Qualtrics / qemaiIserver.com / qemailserver.com

[Tobias Fiebig via mailop]

Moin,

is maybe somebody from Qualtrics reading along or has a contact there?

For reasons (mainly me mindlessly publicly stating that it would be
ideal for starting phishing campaigns, and not wanting to see it go to
the wrong hands), i just reg'ed qemaiIserver.com, while qualtrics is
sending mails from qemailserver.com;

For now it is just setup with "v=spf1 -all" and "p=reject", but I'd be
happy to hand the authcode to Qualtrics (as soon as the post-reg
transfer lock expired).

Would be happy to hand it over if they want it; Just don't feel like
this should be free/registered by the wrong people. ;-)

With best regards,
Tobias
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] AT&T Block

[Scott Mutter via mailop]

Anyone from AT&T on the list that can assist with the blacklisting of the
IPs:

23.239.97.150
5.101.141.35

Message is

553 5.3.0 alph749 DNSBL:RBL 521< 23.239.97.150 >_is_blocked.For assistance
forward this error to abuse_...@abuse-att.net

As is the usual case, I've gotten no response from an inquiry to
abuse_...@abuse-att.net.  I sent one to abuse_...@abuse-att.net for
23.239.97.150 on July 2nd and no response.  To be fair, I wrote
abuse_...@abuse-att.net about 5.101.141.35 just yesterday (July 4th) so it
really hasn't been 24 hours yet, but past experience has taught me that I
rarely get a response from an inquiries sent to abuse_...@abuse-att.net.

I suspect that this is being blocked because these are new IPs that AT&T
has never received mail from, so they block them by default.  Is there an
official way to inform AT&T before trying to send mail from new IPs that
new IPs will be sending mail?  As far as I know AT&T is the only service
that outright blocks messages from new and unseen IP addresses by default.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Jaroslaw Rafa via mailop]

Dnia  5.07.2024 o godz. 19:45:10 Jeff Pang via mailop pisze:
> 
> When an user requests to join mailing list, which address should we
> take? The envelope address, or the header From address?

I think you should follow the best practice, ie. how it is implemented in
the predominant mailing list software (eg. mailman).

You can check the documentation for such software or even check the code
itself if in doubt.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Marco Moock via mailop]

Am 05.07.2024 um 19:45:10 Uhr schrieb Jeff Pang via mailop:

> When an user requests to join mailing list, which address should we 
> take? The envelope address, or the header From address?

Both should match in that case.

> In the mailop life, I saw many sender addresses in header are
> different than the envelope addresses.

This is the behavior of mailing lists.
The MAIL FROM: envelope address will be used for bounces.
If you post to a mailing list, you don't want to receive the bounce of
subscribers addresses that are  undeliverable (e.g. mailbox
full, account deleted etc.).

> For instance,
> 1. use gmail to send email from address other than gmail
> 2. Freenet.de 's aliases, when sending with alias, the header From 
> address is different with envelope address.

The MAIL FROM will be matched by SPF and that will fail if you relay it
to any other external machine that checks it.


-- 
Gruß
Marco

Send unsolicited bulk mail to 1720201510mu...@cartoonies.org
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] envelope or header address?

[Benny Pedersen via mailop]

Jeff Pang via mailop skrev den 2024-07-05 13:45:

When an user requests to join mailing list, which address should we 
take?


envelope


The envelope address, or the header From address?


from is not smtp

In the mailop life, I saw many sender addresses in header are different 
than the envelope addresses.


this is as it should be from forwarders, like maillists


For instance,
1. use gmail to send email from address other than gmail
2. Freenet.de 's aliases, when sending with alias, the header From 
address is different with envelope address.


irellevant
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] envelope or header address?

[Jeff Pang via mailop]

Hello

When an user requests to join mailing list, which address should we 
take? The envelope address, or the header From address?


In the mailop life, I saw many sender addresses in header are different 
than the envelope addresses.


For instance,
1. use gmail to send email from address other than gmail
2. Freenet.de 's aliases, when sending with alias, the header From 
address is different with envelope address.


Thanks.

--
Jeff Pang
jeffp...@aol.com
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Massive mail flooding from gmail

[Gerald Vogt via mailop]

Hi,

On 05.07.24 10:19, Hans-Martin Mosner via mailop wrote:

Am 05.07.24 um 09:24 schrieb Gerald Vogt via mailop:

Hi,

since June 28th we are flooded with thousands of emails from various 
gmail accounts going to one of our list addresses.


We have already reported some of them at

https://support.google.com/mail/contact/abuse

but it didn't really helped. There was a break from July 2nd but today 
it started again. By now we have got more than 15.000 mails like this.


All mails are a reply to the same automated mail from us, with one 
line added before the full quote like


"Thanks again for bringing this matter to my attention."
"Please let me know if that is acceptable with you."
"My great pleasure to meet you last week."


Have you checked whether there is an URL link as well? I recognize this 
pattern as a kind of social engineering attack where the attackers use 
the contents of a hacked mailbox to make their mails look legitimate and 
get the recipient to click on some malicious link.


No. That's the odd thing: the quoted text is unmodified from us 
containing two links from us. The only addition is a one line text at 
the top, in the plain text and html parts. The html is O.K. It doesn't 
contain any links or images. Either. I'll paste one mail body at the bottom.


Of course, this is only from a random sample. I haven't checked all 
15.000 mails for further modifications. But those I have sample all 
follow the same dumb pattern.


Reporting to Google may or may not help, their abuse desk does not seem 
to reply, and from the experience with spam from addresses that were 
already reported they also don't seem to reply (at least not in a timely 
fashion that would be appropriate for this kind of spam).


Well, it's a thousand addresses from even more mails. It's impossible to 
report them all through the report form.


Thanks,

Gerald

P.S.: Here a copy of the body of one of the latest emails (with 
thunderbird wrapping lines):


--777fb4061c7b302b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thank you for your immediate response.

On Fri, Jun 28, 2024 at 10:18=E2=80=AFAM  wrote:

> Thank you for creating a new ESGF-CoG account.
>
> Your User Name is: nillsonmandilla
> Your OpenID is: https://esgf-data.dkrz.de/esgf-idp/openid/nillsonmandilla
>
> Please note that you will need your OpenID to login.
>
> CoG Tutorials: https://www.earthsystemcog.org/projects/cog/tutorials_web
>
> CoG Support: cog_supp...@list.woc.noaa.gov
>
>

--777fb4061c7b302b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Thank you for your immediate response.On Fri, Jun 28, =
2024 at 10:18=E2=80=AFAM e...@dkrz.de> wrote:Th=
ank you for creating a new ESGF-CoG account.

Your User Name is: nillsonmandilla
Your OpenID is: https://esg=
f-data.dkrz.de/esgf-idp/openid/nillsonmandilla">https://esgf-data.dkrz.de/e=
sgf-idp/openid/nillsonmandilla

Please note that you will need your OpenID to login.

CoG Tutorials: https://www.=
earthsystemcog.org/projects/cog/tutorials_web">https://www.earthsystemcog.o=
rg/projects/cog/tutorials_web

CoG Support: mailto:cog_supp...@list.woc.noaa.=
gov">cog_supp...@list.woc.noaa.gov



--777fb4061c7b302b--

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Massive mail flooding from gmail

[Hans-Martin Mosner via mailop]

Am 05.07.24 um 09:24 schrieb Gerald Vogt via mailop:

Hi,

since June 28th we are flooded with thousands of emails from various gmail 
accounts going to one of our list addresses.

We have already reported some of them at

https://support.google.com/mail/contact/abuse

but it didn't really helped. There was a break from July 2nd but today it started again. By now we have got more than 
15.000 mails like this.


All mails are a reply to the same automated mail from us, with one line added 
before the full quote like

"Thanks again for bringing this matter to my attention."
"Please let me know if that is acceptable with you."
"My great pleasure to meet you last week."


Have you checked whether there is an URL link as well? I recognize this pattern as a kind of social engineering attack 
where the attackers use the contents of a hacked mailbox to make their mails look legitimate and get the recipient to 
click on some malicious link.


Reporting to Google may or may not help, their abuse desk does not seem to reply, and from the experience with spam from 
addresses that were already reported they also don't seem to reply (at least not in a timely fashion that would be 
appropriate for this kind of spam).


Cheers,
Hans-Martin
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] Massive mail flooding from gmail

[Gerald Vogt via mailop]

Hi,

since June 28th we are flooded with thousands of emails from various 
gmail accounts going to one of our list addresses.


We have already reported some of them at

https://support.google.com/mail/contact/abuse

but it didn't really helped. There was a break from July 2nd but today 
it started again. By now we have got more than 15.000 mails like this.


All mails are a reply to the same automated mail from us, with one line 
added before the full quote like


"Thanks again for bringing this matter to my attention."
"Please let me know if that is acceptable with you."
"My great pleasure to meet you last week."

The original mail from us is from June 24th 2019, i.e. five years old, 
sent to the gmail address nillsonmandilla  gmail.com


The latest From address was msangw...@gmail.com, but I am counting more 
than 800 others gmail addresses in our logs.


All mails arrive via google servers. Here are the headers of one of tge 
last once as they arrive on our relay:



Received: from mail-vs1-xe2d.google.com (mail-vs1-xe2d.google.com 
[IPv6:2607:f8b0:4864:20::e2d])
by mailin3.dkrz.de (Postfix) with ESMTPS id 87D4D40588D
for ; Fri,  5 Jul 2024 06:29:21 +0200 (CEST)
Received: by mail-vs1-xe2d.google.com with SMTP id 
ada2fe7eead31-48ff6336bbbso235023137.0
for ; Thu, 04 Jul 2024 21:29:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20230601; t=1720153760; x=1720758560; darn=dkrz.de;
h=to:subject:message-id:date:from:in-reply-to:references:mime-version
 :from:to:cc:subject:date:message-id:reply-to;
bh=HOkX535AcL52LUUXCCu24PqTN2wB+3jZ9rUIpsxr5W4=;
b=krN2lFOA4cm7XZIuZ+JaDA+algk9bM2H7LvWDaTqoJh2KqeBETk2dnS5S6q40MbjV8
 03QtPf5wGJ44OHKufc85RFJ7eQ8fSxsu5bcFHp/LSM+AB/UaqlOJYWltKYIiFPzcO/WT
 FQkeQSOzH0P+olnwWnBRekHXA8WRAIA1pKNN3+jZUU11X6aepq+xo6P5CflC14SmIdKi
 ybP/wX9XjQl27i1AfStU+pa+/hDTD76rfAyOT9ZM775b1J0VAqZvThSFIugewwkRSCNW
 wuBZtC0l1wf4Mm3WugRtEEYHNzbiabwTal/PN7f38P9825XL48O7otR76O1/NqDRBA1a
 f+5g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1720153760; x=1720758560;
h=to:subject:message-id:date:from:in-reply-to:references:mime-version
 :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=HOkX535AcL52LUUXCCu24PqTN2wB+3jZ9rUIpsxr5W4=;
b=fzKu882yAc/NEdYtzqiGp0Gk07I0+66haZYrbNew33K+M5MEIvWDAM6+rej4XIzAQ9
 CvshZadDmEmmKXSpNVb8y+6EKlH2EVDkhqj9+Cw31vG0qlIA/dWmz3rQzunT1M0ZaJIO
 NaRocJZB00mwKTz5QF29bni7zQhoUMGikRzrYo4jDhkyexwCp4X9VWI0jWdQ4Ftoke3J
 DRMwLm9x02pWMc0n93kZwu3oxPu66RskpBDoPajkjC322ZRmTeaVxFtIbEPb/t9W/VDY
 cyZKI+IqqcQBCTUoh532SQWlMn387UJcIyLJG+ViRGqxLYFhfgRT/WTpMgaDk+KmbT2z
 bQiQ==
X-Gm-Message-State: AOJu0YwAwsQSgIkf6rgSP0doJKX5LCX2TINlXIbfp2jD46ySn4aqEW6j

0mQFXXc6bamAqKxy75r/Ppr48Iiajx46Wb54o6XWEa4idLnAxIX2kEfp8POJpJzxXRh7ahVbt8M
PLNYW5n8g2Y49PnAZ934Laq49a4PaYA==
X-Google-Smtp-Source: 
AGHT+IHX04wQOYMq5sJEvibBHiQDK/+j7onGYzciJ9OmJC51eQeyAM1aAwk5pxubHc5ScoyLjqBLF0HUJYE+sv91Xks=
X-Received: by 2002:a67:fd07:0:b0:48f:b1c7:8834 with SMTP id
 ada2fe7eead31-48fee7eba13mr4050410137.30.1720153759511; Thu, 04 Jul 2024
 21:29:19 -0700 (PDT)
MIME-Version: 1.0
References: <201906241qp6wj092208.9b02920b2...@maili7-ha3.dkrz.de>
In-Reply-To: <201906241qp6wj092208.9b02920b2...@maili7-ha3.dkrz.de>
From: =?UTF-8?B?4Lih4LiZ4LiR4LiB4Liy4LiZ4LiV4LmMIOC4quC4suC4h+C4p+C4h+C4qOC5jA==?= 

Date: Fri, 5 Jul 2024 05:29:06 +0100
Message-ID: 
Subject: Re: CoG Account Creation
To: e...@dkrz.de
Content-Type: multipart/alternative; boundary="cb7bec061c78816f"
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 
(mailin3.dkrz.de [127.0.0.1]); Fri, 05 Jul 2024 06:29:21 +0200 (CEST)


Is there any better place to report this kind of flooding to google then 
the web report form?


I am also puzzled how and why this is happening.

Any suggestions or advice is welcome.

Thanks,

Gerald
--
Gerald Vogt
Energiemanagement
Abteilung Systeme

Deutsches Klimarechenzentrum GmbH (DKRZ)
Bundesstrasse 45a • D-20146 Hamburg • Germany

Phone:  +49 40 460094-127
Fax:+49 40 460094-270
Email:  v...@dkrz.de
URL:https://www.dkrz.de/

Geschäftsführer: Prof. Dr. Thomas Ludwig
Sitz der Gesellschaft: Hamburg
Amtsgericht Hamburg HRB 39784
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop