Re: [mailop] How to respond to a subscription attack

2024-06-28 Thread Grant Taylor via mailop
On 6/28/24 11:00 AM, Al Iverson via mailop wrote: If you want to trust me with the person's email address, I'll pass it to a bunch of ESP deliverability/compliance people and ask them to unsub it en masse, if they can. Some will and it might help. We've done it before for others. Thank you

Re: [mailop] How to respond to a subscription attack

2024-06-28 Thread Al Iverson via mailop
If you want to trust me with the person's email address, I'll pass it to a bunch of ESP deliverability/compliance people and ask them to unsub it en masse, if they can. Some will and it might help. We've done it before for others. Cheers, Al -- Al Iverson // 312-725-0130 // Chicago

Re: [mailop] How to respond to a subscription attack

2024-06-28 Thread Mark Alley via mailop
Adding to Taavi's List-Unsub condition - I've had similar success with List-unsubscribe identification for transactional-volume attacks, and also with a few additional indicators for transactional mail that are below. These are Proofpoint-specific conditions, but can be (mostly) translated to

Re: [mailop] How to respond to a subscription attack

2024-06-28 Thread Taavi Eomäe via mailop
The best method we've found was to reject all letters with List-Unsubscribe header (or similar) sent to that victim. This obviously has side-effects, but they're tolerable compared to the flood of letters. I should note that these letters are usually sent in order to cover up something like

Re: [mailop] How to respond to a subscription attack

2024-06-27 Thread Marco Moock via mailop
Am Fri, 28 Jun 2024 02:35:16 +0100 schrieb Richard Clayton via mailop : > this is "list bombing" and is done to simply annoy, And also to attack other services, either by targeting the mailbox itself (filling it to avoid receiving further mails) or their MX with many, many messages. Often, many

Re: [mailop] How to respond to a subscription attack

2024-06-27 Thread Grant Taylor via mailop
On 6/27/24 20:35, Richard Clayton via mailop wrote: this is "list bombing" and is done to simply annoy, or more often to hide some other message (about an unusual login, or money (or domain!) transfer) ACK I didn't want to open a new thread with "bomb" in it. some simple advice to a

Re: [mailop] How to respond to a subscription attack

2024-06-27 Thread Richard Clayton via mailop
In message <484dfe5a-71e7-4851-8de0-fe35342cff97@spamtrap.tnetconsulting .net>, Grant Taylor via mailop writes >Is there any value in contacting postmaster@ / abuse@ for senders that >participated in a mass subscription bomb attack? this is "list bombing" and is done to simply annoy, or more

Re: [mailop] How to respond to a subscription attack

2024-06-27 Thread Marco Moock via mailop
Am Thu, 27 Jun 2024 19:43:11 -0500 schrieb Grant Taylor via mailop : > Is there any value in contacting postmaster@ / abuse@ for senders > that participated in a mass subscription bomb attack? Of course. They must be aware of that to implement countermeasures. Some mailing list software has no

[mailop] How to respond to a subscription attack

2024-06-27 Thread Grant Taylor via mailop
Hi, Is there any value in contacting postmaster@ / abuse@ for senders that participated in a mass subscription bomb attack? I've got a user that received almost 1k subscription / welcome / confirmation messages over a period of about 30 minutes before I disabled the account (hopefully