Re: [mailop] too many bad IP blocked

2024-06-20 Thread Marco Moock via mailop
Am 21.06.2024 um 07:20:17 Uhr schrieb Jeff Pang via mailop: > postfix/smtps/smtpd[451948]: warning: unknown[211.184.190.87]: SASL > LOGIN authentication failed: UGFzc3dvcmQ6 > > I am afraid too many iptables will slow down the performance of > systems. do you have any suggestion for handling

Re: [mailop] too many bad IP blocked

2024-06-20 Thread Ralph Seichter via mailop
* Jeff Pang via mailop: > postfix/smtps/smtpd[451948]: warning: unknown[211.184.190.87]: SASL > LOGIN authentication failed: UGFzc3dvcmQ6 > > I am afraid too many iptables will slow down the performance of systems. Are you worried about iptables slowing systems down compared to Postfix (and

Re: [mailop] too many bad IP blocked

2024-06-20 Thread Viktor Dukhovni via mailop
On Fri, Jun 21, 2024 at 07:20:17AM +0800, Jeff Pang via mailop wrote: > It seems the black ips are coming endlessly. Most of the bad actions > are like this one: > > postfix/smtps/smtpd[451948]: warning: unknown[211.184.190.87]: SASL LOGIN > authentication failed: UGFzc3dvcmQ6 > > I am afraid

Re: [mailop] too many bad IP blocked

2024-06-20 Thread Niels Kobschätzki via mailop
> > On 21. Jun 2024, at 05:15, Raymond Burkholder via mailop > wrote: > > On 2024-06-20 17:20, Jeff Pang via mailop wrote: >> today I clear up iptables rules, and run fail2ban again. >> in half of an hour, it blocked 1400+ IPs. >> >> $ sudo iptables -L -n|grep DROP|wc -l >> 1407 >> >> I am

Re: [mailop] too many bad IP blocked

2024-06-20 Thread Raymond Burkholder via mailop
On 2024-06-20 17:20, Jeff Pang via mailop wrote: today I clear up iptables rules, and run fail2ban again. in half of an hour, it blocked 1400+ IPs. $ sudo iptables -L -n|grep DROP|wc -l 1407 I am afraid too many iptables will slow down the performance of systems. do you have any suggestion for

Re: [mailop] too many bad IP blocked

2024-06-20 Thread Ferris, Rhys (SCC) via mailop
I guess my mentality is a large IPTables is still less of a load than letting them establish a connection and attempt to authenticate, but I'm certainly open to better ideas. Rhys (R-ee-s) Ferris Internet Mail Team | SMAS Support Team U.S. Senate Sent from my mobile device On Jun 20, 2024

Re: [mailop] too many bad IP blocked

2024-06-20 Thread Jeff Pang via mailop
And in an hour it gets double IPs blocked. $ sudo iptables -L -n|grep DROP|wc -l 2805 any idea? Thanks today I clear up iptables rules, and run fail2ban again. in half of an hour, it blocked 1400+ IPs. $ sudo iptables -L -n|grep DROP|wc -l 1407 it seems the black ips are coming endlessly.

[mailop] too many bad IP blocked

2024-06-20 Thread Jeff Pang via mailop
today I clear up iptables rules, and run fail2ban again. in half of an hour, it blocked 1400+ IPs. $ sudo iptables -L -n|grep DROP|wc -l 1407 it seems the black ips are coming endlessly. most of the bad actions are like this one: postfix/smtps/smtpd[451948]: warning: unknown[211.184.190.87]:

Re: [mailop] Anyone from TIM Brazil on the list regarding fake NFe (Electronic Invoices Emails)?

2024-06-20 Thread Jeff Pang via mailop
Maybe give a try on this one? admin.exter...@timbrasil.com.br But I doubt they will answer you. Does anyone have any contact to TIM Brazil and could either forward this email to them or tell me who to contact? -- Jeff Pang jeffp...@aol.com ___

Re: [mailop] Cloudmark Blocklist

2024-06-20 Thread Scott Undercofler via mailop
Replied off list. > On Jun 20, 2024, at 8:38 AM, Scott Mutter via mailop > wrote: > > Anyone from Cloudmark able to assist with why the IP address: > > 67.222.148.107 > > is listed in their blacklist? > > I filled out the form > > https://csi.cloudmark.com/en/reset > > two days ago. I

[mailop] Anyone from TIM Brazil on the list regarding fake NFe (Electronic Invoices Emails)?

2024-06-20 Thread Benoit Panizzon via mailop
Hi Brazil uses a system of electronic invoices called NFe. I was in contact with oobj.com.br one of the companies running that system after more and more of those NFe emails started hitting recipients here. This attracts scammer which send spoofed electronic invoices to companies in the hope

[mailop] Cloudmark Blocklist

2024-06-20 Thread Scott Mutter via mailop
Anyone from Cloudmark able to assist with why the IP address: 67.222.148.107 is listed in their blacklist? I filled out the form https://csi.cloudmark.com/en/reset two days ago. I got the Confirm CSI IP Address Statistics Reset Request email and responded to it. But the IP still appears to

Re: [mailop] how to stop this spam

2024-06-20 Thread Benny Pedersen via mailop
Jeff Pang via mailop skrev den 2024-06-20 04:13: Recently i got a lot of spams like this one: https://cloud.hostcache.com/spam.eml Content Domains: gmail.com google.com googlegroups.com Content analysis details: (13.6 points, 5.0 required) pts rule name description

Re: [mailop] how to stop this spam

2024-06-20 Thread Benny Pedersen via mailop
Jeff Pang via mailop skrev den 2024-06-20 04:13: Hello Recently i got a lot of spams like this one: https://cloud.hostcache.com/spam.eml They have two features: 1. arabic language 2. from google groups (though i never joined those groups) how can i stop them effectively? (block arabic and

Re: [mailop] how to stop this spam

2024-06-20 Thread Vsevolod Stakhov via mailop
On 20/06/2024 10:33, Jeff Peng via mailop wrote: BTW, What’s the good way to block messages based on languages? https://rspamd.com/doc/developers/examples.html#languages-filter Or use multimap plugin with selector type and `languages` selector. Rspamd language detector is pretty good and

Re: [mailop] how to stop this spam

2024-06-20 Thread Edgaras | SENDER via mailop
A much more performant way would be matching UTF code points with regex: https://regex101.com/r/yF7gV6/2 [image: Sender] Edgar Vaitkevičius, founder / CEO ed...@sender.net On Thu, Jun 20, 2024 at 12:53 PM Atro Tossavainen via mailop < mailop@mailop.org> wrote: > On Thu, Jun 20, 2024 at

Re: [mailop] how to stop this spam

2024-06-20 Thread Atro Tossavainen via mailop
On Thu, Jun 20, 2024 at 05:33:47PM +0800, Jeff Peng via mailop wrote: > BTW, What’s the good way to block messages based on languages? Analyzing messages for language content first, then being able to decide based on results. There are multiple libraries for multiple programming languages that

Re: [mailop] how to stop this spam

2024-06-20 Thread Jeff Peng via mailop
BTW, What’s the good way to block messages based on languages? On 2024-06-20 15:49, Stuart Henderson via mailop wrote: On 2024/06/20 10:13, Jeff Pang via mailop wrote: Hello Recently i got a lot of spams like this one: https://cloud.hostcache.com/spam.eml They have two features: 1. arabic

Re: [mailop] how to stop this spam

2024-06-20 Thread Stuart Henderson via mailop
On 2024/06/20 10:13, Jeff Pang via mailop wrote: > Hello > > Recently i got a lot of spams like this one: > https://cloud.hostcache.com/spam.eml > > They have two features: > 1. arabic language > 2. from google groups (though i never joined those groups) I've reported a bunch of these over the