Re: [mailop] Cyren

[Michael Grant via mailop]

I don't see any changes in our use of Cyren yet, but the writing is on
the wall and we are forced to move on.  I don't see anything like all
Swiss messages blocked or marked as spam.

All of our contacts at Cyren are no longer there.


signature.asc
Description: PGP signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Mike Hillyer via mailop]

I could see someone programming their filters to add points if they get no 
response from Cyren, just to prevent things from slipping through in case the 
service was temporarily down. Not how I'd do it, but I could imagine such a 
scenario.

Mike

-Original Message-
From: mailop  On Behalf Of Benoit Panizzon via mailop
Sent: Monday, February 13, 2023 11:18 AM
To: Al Iverson 
Cc: Carsten Schiefner via mailop 
Subject: Re: [mailop] Cyren

> This is a good hypothesis but so far I have not seen any absolute 
> confirmation that they are "listing the world." I guess we will see...

I fear this is the case. I have contacted the ISP in question whose ctasd 
instance was adding 6 SpamAssassin Points to every email sent by their customer.

They immediately disabled the ctasd check.

Mit freundlichen Grüssen

-Benoît Panizzon-
-- 
I m p r o W a r e   A G-Leiter Commerce Kunden
__

Zurlindenstrasse 29 Tel  +41 61 826 93 00
CH-4133 PrattelnFax  +41 61 826 93 01
Schweiz Web  http://www.imp.ch
__
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Ken Simpson via mailop]

Hi Benoit

We aren't hearing any specific reports of failure like this; however, for
anyone concerned, we have an SSL-secured ctasd endpoint that implements the
ctasd protocol but is backed by a different filter.

Reach out to me for details.

Regards,
Ken

On Mon, Feb 13, 2023 at 8:21 AM Benoit Panizzon via mailop <
mailop@mailop.org> wrote:

> > This is a good hypothesis but so far I have not seen any absolute
> > confirmation that they are "listing the world." I guess we will see...
>
> I fear this is the case. I have contacted the ISP in question whose
> ctasd instance was adding 6 SpamAssassin Points to every email sent by
> their customer.
>
> They immediately disabled the ctasd check.
>
> Mit freundlichen Grüssen
>
> -Benoît Panizzon-
> --
> I m p r o W a r e   A G-Leiter Commerce Kunden
> __
>
> Zurlindenstrasse 29 Tel  +41 61 826 93 00
> CH-4133 PrattelnFax  +41 61 826 93 01
> Schweiz Web  http://www.imp.ch
> __
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>


-- 

Ken Simpson

CEO, MailChannels



Facebook   |  Twitter   |
LinkedIn  |  Help Center


Our latest case study video: watch here!

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Benoit Panizzon via mailop]

> This is a good hypothesis but so far I have not seen any absolute
> confirmation that they are "listing the world." I guess we will see...

I fear this is the case. I have contacted the ISP in question whose
ctasd instance was adding 6 SpamAssassin Points to every email sent by
their customer.

They immediately disabled the ctasd check.

Mit freundlichen Grüssen

-Benoît Panizzon-
-- 
I m p r o W a r e   A G-Leiter Commerce Kunden
__

Zurlindenstrasse 29 Tel  +41 61 826 93 00
CH-4133 PrattelnFax  +41 61 826 93 01
Schweiz Web  http://www.imp.ch
__
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Al Iverson via mailop]

This is a good hypothesis but so far I have not seen any absolute
confirmation that they are "listing the world." I guess we will see...

Cheers,
Al Iverson

On Mon, Feb 13, 2023 at 2:53 AM Benoit Panizzon via mailop
 wrote:
>
> Hi All
>
> I have started seeing a lot of emails sent via one Swiss ISP flagged as
> spam by the SpamAssassin CTASD, which according to Google, is Cyren's
> anti spam service.
>
> Have they started flagging all emails as spam to tell their customer to
> stop using their service?
>
> Mit freundlichen Grüssen
>
> -Benoît Panizzon-
> --
> I m p r o W a r e   A G-Leiter Commerce Kunden
> __
>
> Zurlindenstrasse 29 Tel  +41 61 826 93 00
> CH-4133 PrattelnFax  +41 61 826 93 01
> Schweiz Web  http://www.imp.ch
> __
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop



-- 

Al Iverson / Deliverability blogging at www.spamresource.com
Subscribe to the weekly newsletter at wombatmail.com/sr.cgi
DNS Tools at xnnd.com / (312) 725-0130 / Chicago (Central Time)
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Suresh Ramasubramanian via mailop]

It has shut down and laid off all its employees

I don’t know what poor soul is still using them to filter spam but it won’t 
work any longer

--srs

From: mailop  on behalf of Benoit Panizzon via 
mailop 
Sent: Monday, February 13, 2023 2:13:30 PM
To: Carsten Schiefner via mailop 
Subject: Re: [mailop] Cyren

Hi All

I have started seeing a lot of emails sent via one Swiss ISP flagged as
spam by the SpamAssassin CTASD, which according to Google, is Cyren's
anti spam service.

Have they started flagging all emails as spam to tell their customer to
stop using their service?

Mit freundlichen Grüssen

-Benoît Panizzon-
--
I m p r o W a r e   A G-Leiter Commerce Kunden
__

Zurlindenstrasse 29 Tel  +41 61 826 93 00
CH-4133 PrattelnFax  +41 61 826 93 01
Schweiz Web  http://www.imp.ch
__
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Benoit Panizzon via mailop]

Hi All

I have started seeing a lot of emails sent via one Swiss ISP flagged as
spam by the SpamAssassin CTASD, which according to Google, is Cyren's
anti spam service.

Have they started flagging all emails as spam to tell their customer to
stop using their service?

Mit freundlichen Grüssen

-Benoît Panizzon-
-- 
I m p r o W a r e   A G-Leiter Commerce Kunden
__

Zurlindenstrasse 29 Tel  +41 61 826 93 00
CH-4133 PrattelnFax  +41 61 826 93 01
Schweiz Web  http://www.imp.ch
__
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Ken Simpson via mailop]

Hi everyone,

To help Cyren customers, MailChannels is offering free access to the
MailChannels content filter API, which accurately filters billions of
messages for tens of millions of users and millions of domains within our
transactional email service. 43% of the domains

that use a transactional email service send their email via our SMTP
service.

We have no plans to charge for access; however, commercial support plans
will be available if you need an SLA. We can accommodate any size of
client; however, we are prioritizing Cyren customers who handle at least 1
million messages per month. If you are a very small user, this API is
probably not for you; however, as a mailop user you are welcome to contact
me for free access to our SMTP relay services for personal use.

If you have an interest in using the MailChannels content filter API,
please contact us here: https://info.mailchannels.com/cyren

Regards,
Ken Simpson
CEO, MailChannels

On Fri, Feb 3, 2023 at 5:56 AM Carsten Schiefner via mailop <
mailop@mailop.org> wrote:

> All -
>
> for those amongst you who have no real clue what Matthew's email is
> about, please be referred to:
>
> Cyren Announces Global Reduction in Force; Liquidity Challenges
>
> https://ir.cyren.com/websites/cyren/English/5015/press-release.html?airportNewsID=631c3a77-555f-4a78-be5b-ec30c5cdaaac
>
> Best,
>
> -C.
>
> On 03.02.2023 13:45, Matthew Stith via mailop wrote:
> > All,
> >
> > Spamhaus is offering our data query service for free for 90 days for
> > users impacted by Cyren's sudden liquidation. No strings attached just
> > an effort to get those that are impacted by the news this week protected
> > as quickly as possible. Our hopes is that this gives users protection
> > against abuse while they figure out their next steps.
> >
> https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account/
> >
> > And any Cyren employees that may be on this list. Know that you have the
> > support of the community behind you.
> >
> > Thanks,
> > Matt Stith
> > Spamhaus
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>


-- 

Ken Simpson

CEO, MailChannels



Facebook   |  Twitter   |
LinkedIn  |  Help Center


Our latest case study video: watch here!

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren

[Carsten Schiefner via mailop]

All -

for those amongst you who have no real clue what Matthew's email is 
about, please be referred to:


Cyren Announces Global Reduction in Force; Liquidity Challenges
https://ir.cyren.com/websites/cyren/English/5015/press-release.html?airportNewsID=631c3a77-555f-4a78-be5b-ec30c5cdaaac

Best,

-C.

On 03.02.2023 13:45, Matthew Stith via mailop wrote:

All,

Spamhaus is offering our data query service for free for 90 days for 
users impacted by Cyren's sudden liquidation. No strings attached just 
an effort to get those that are impacted by the news this week protected 
as quickly as possible. Our hopes is that this gives users protection 
against abuse while they figure out their next steps.

https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account/

And any Cyren employees that may be on this list. Know that you have the 
support of the community behind you.


Thanks,
Matt Stith
Spamhaus

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] Cyren

[Matthew Stith via mailop]

All,

Spamhaus is offering our data query service for free for 90 days for 
users impacted by Cyren's sudden liquidation. No strings attached just 
an effort to get those that are impacted by the news this week protected 
as quickly as possible. Our hopes is that this gives users protection 
against abuse while they figure out their next steps.
https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account/ 



And any Cyren employees that may be on this list. Know that you have the 
support of the community behind you.


Thanks,
Matt Stith
Spamhaus

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren status regularly flapping back to Suspicious

[Florian Effenberger via mailop]

Hello,

Alessandro Vesely via mailop wrote on 07.07.21 at 13:27:

So it's IPv4.  Talos[*] reports low email activity on it.  Do you send 
out DMARC reports and similar stuff?  I found that doing so increases my 
footprint and hence stabilizes reputation, albeit some point out that 
reports can be classified as spam...


indeed, the activity on the various IPs of mine is not that high. It's a 
bit higher on some, but in any case I'm not one of the big players with 
a large mail volume. :-)


I don't send out DMARC reports (yet), but the quality of the traffic 
should be good, i.e. the bounce ratio rather low. All are individual 
mailboxes from the educational sector, no newsletters or the like.


Luckily, thanks to this list, a kind person from Cyren poked me directly 
(thanks so much!) and in parallel, the recipient was excluding these IPs 
from their Cyren checking, so my current case at hand seems solved for 
the moment.


I'm trying to understand if the Cyren behaviour is expected and the 
recipient is just wrongly blocking the yellow IPs, or if actually the 
flapping back is due to "spammy neighbours" and can be mitigated. I'll 
report back if I have more insight.


That being said - thanks indeed, I appreciate how helpful and 
cooperative this list has been to me so far, although I'm fairly new here!


Florian
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren status regularly flapping back to Suspicious

[Alessandro Vesely via mailop]

On Tue 06/Jul/2021 20:28:16 +0200 Florian Effenberger via mailop wrote:

Alessandro Vesely via mailop wrote on 06.07.21 at 18:38:

I tried https://www.cyren.com/security-center/cyren-ip-reputation-check-gate 
and it says "No Risk" for 188.34.176.133 and "Please enter a valid IP" for 
2a01:4f8:c010:587c::1.  Is it the latter the one that gives you problems?


The IPv4 is one of the several IPs affected, indeed. I unblocked it again last 
week, but it likely will switch back after a while. Not sure if CYREN supports 
IPv6 - but the recipient's MX doesn't in any case, so it's not a workaround to 
deliver the mails either.



So it's IPv4.  Talos[*] reports low email activity on it.  Do you send out 
DMARC reports and similar stuff?  I found that doing so increases my footprint 
and hence stabilizes reputation, albeit some point out that reports can be 
classified as spam...


Best
Ale
--

[*] https://talosintelligence.com/reputation_center/lookup?search=188.34.176.133











___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren status regularly flapping back to Suspicious

[Florian Effenberger via mailop]

Hello,

thanks for the replies!

John Levine via mailop wrote on 05.07.21 at 18:59:


I believe the recipient's mail system is misconfigured.  If Cyren tags an IP
as yellow, they should soft fail with 450 so it can retry later.


That could be indeed helpful. I was reaching out to their postmaster 
already (recipient is a larger German city) to see if they can do 
something - a greylisting would be "fine", but the hard reject is an issue.


Alessandro Vesely via mailop wrote on 06.07.21 at 18:38:


I tried https://www.cyren.com/security-center/cyren-ip-reputation-check-gate and it says "No 
Risk" for 188.34.176.133 and "Please enter a valid IP" for 2a01:4f8:c010:587c::1.  
Is it the latter the one that gives you problems?


The IPv4 is one of the several IPs affected, indeed. I unblocked it 
again last week, but it likely will switch back after a while. Not sure 
if CYREN supports IPv6 - but the recipient's MX doesn't in any case, so 
it's not a workaround to deliver the mails either.


Florian
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren status regularly flapping back to Suspicious

[Alessandro Vesely via mailop]

On Mon 05/Jul/2021 14:45:30 +0200 Florian Effenberger via mailop wrote:


Their website lists the IP as yellow ("Suspicious"), with an explanation of 
"The IP has only recently started sending mails, and therefore still has an 
Unknown reputation".



I tried https://www.cyren.com/security-center/cyren-ip-reputation-check-gate 
and it says "No Risk" for 188.34.176.133 and "Please enter a valid IP" for 
2a01:4f8:c010:587c::1.  Is it the latter the one that gives you problems?



Best
Ale
--








___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren status regularly flapping back to Suspicious

[John Levine via mailop]

It appears that Florian Effenberger via mailop  said:
>Hello,
>
>I have some issues with the Cyren blocklist - one recipient's server is 
>bouncing mails back with
>
>550-5.7.1 This email was rejected because it violates our security policy
>550 5.7.1 CYREN IP reputation determined a medium risk associated with
>the sender address X.X.X.X. (in reply to DATA command)
>
>Their website lists the IP as yellow ("Suspicious"), with an explanation 
>of "The IP has only recently started sending mails, and therefore still 
>has an Unknown reputation".

I believe the recipient's mail system is misconfigured.  If Cyren tags an IP
as yellow, they should soft fail with 450 so it can retry later.



___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Cyren status regularly flapping back to Suspicious

[Renaud Allard via mailop]

On 05/07/2021 14:45, Florian Effenberger via mailop wrote:

Hello,

I have some issues with the Cyren blocklist - one recipient's server is 
bouncing mails back with


550-5.7.1 This email was rejected because it violates our security policy
550 5.7.1 CYREN IP reputation determined a medium risk associated with
the sender address X.X.X.X. (in reply to DATA command)

Their website lists the IP as yellow ("Suspicious"), with an explanation 
of "The IP has only recently started sending mails, and therefore still 
has an Unknown reputation".




I am also getting the same thing, it seems I never get a reputation, 
while also being on many whitelists and being blacklisted nowhere. 
However, my mails are not being rejected but greylisted. So I am also 
interested in knowing how to get on their reputation list.




smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

[mailop] Cyren status regularly flapping back to Suspicious

[Florian Effenberger via mailop]

Hello,

I have some issues with the Cyren blocklist - one recipient's server is 
bouncing mails back with


550-5.7.1 This email was rejected because it violates our security policy
550 5.7.1 CYREN IP reputation determined a medium risk associated with
the sender address X.X.X.X. (in reply to DATA command)

Their website lists the IP as yellow ("Suspicious"), with an explanation 
of "The IP has only recently started sending mails, and therefore still 
has an Unknown reputation".


Unblocking on their website works like a charm and is effective within 
minutes. The status turns green ("No Risk"), with an explanation of 
"This IP address has not been used for sending Spam".


Some time ago, usually 2-3 weeks later, the status however flaps back to 
"Unknown", effectively blocking mails again. I then unblock again, just 
to get blocked again 2-3 weeks later.


I'd say the mail server is configured properly - PTR, A, , SPF, 
DKIM, DMARC all in place. Active DNSWL (!) listing, and no other 
listings anywhere. postmaster@ and abuse@ are reachable.


I have this effect on a few machines (mine and also colleagues under a 
different domain, but same hoster), including some without any outgoing 
mails, and one box where I'm the only user currently. Given the IP is 
from a big provider's netblock, I tend to assume that actually too few 
mail samples are with Cyren, and they therefore block again. Chicken and 
egg problem in the end, if I can't send mails, they can't get good 
samples...


Anyone has experiences with this, any way to contact them?

Thanks a lot,
Florian
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop