<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Hallo zusammen,</div><div class=""><br class=""></div><div class="">ich habe vor zwei Wochen schon einmal geschrieben das SenderBase bzw. Cisco/Talos (<a href="https://www.talosintelligence.com" class="">https://www.talosintelligence.com</a>) den versandt von E-Mails eines Kunden über unseren MTA verhindert.</div><div class=""><br class=""></div><div class="">Unser Kunde ist ein öffentliche Organisation (Wirtschaftsförderung) die nun mal einen großen Newsletter (> 10.000 Empfänger alle 14 Tage) verschickt.</div><div class="">Über Jahre hinweg gab es auch keine Probleme bis Talos nun die Systeme (inzwischen mehrere getestet) als „poor“ einstufen und die Nachricht garnicht mehr annehmen. </div><div class=""><br class=""></div><div class="">Es liegt wohl daran das wir nur alle 14 Tage so viele Nachrichten versenden und deshalb auffallen.</div><div class="">Bisher gab es keinen „menschlichen" Kontakt zu Talos / Cisco / SenderBase um das Problem zu erklären.</div><div class=""><br class=""></div><div class="">Hat jemand eine Idee wie ich das Problem lösen kann ohne dem Kunden zu sagen er soll den Newsletter sein lassen?</div><div class="">Gibt es mit Postfix eine Möglichkeit den E-Mail Versand eines konkreten Absenders zu verlangsamen? Über mehrere Tage hinweg?</div><div class="">Gibt es reine SMTPsServices wie z.B. die von AWS / SES die hier helfen können oder passiert dann das gleiche -> "poor"?</div><div class=""><br class=""></div><div class="">Wie macht ihr sowas?</div><div class=""><br class=""></div><div class="">Hier eine Darstellung wie wir von Talos / Cisco / SenderBase wahrgenommen werden.</div><div class="">Allerdings haben quasi nur große Konzerne sowie der Bund, die IHKs, Hochschulen, diverse Zeitungen/Medien usw. Talos im Einsatz, nur diese werden dann geblockt.</div><div class=""><br class=""></div><div class=""><div class="">Danke und Gruß Frank.</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><img apple-inline="yes" id="25EC90C4-75A9-4BD5-8D24-FF42F94DDC83" src="cid:74B83CDF-A8F8-4BB9-880D-228563787B5A@condero.cnd" class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><blockquote type="cite" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">Dear Frank,</span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">Our worldwide sensor network indicates that spam originated from IP xx.xx.xx.xx as recently as 2/16/2018 (approximately 48.8 hours ago).</span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">In some cases we are authorized to share headers of the received spam, but for these particular sensors we have non-disclosure agreements that prevent us from providing anything but the date the last spam was received. </span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class=""> </span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">In addition, our sensors indicate server access attempts from this IP to mail servers within our Sensor Network. This behavior is indicative of email directory harvesting attempts and also results in reputation impact to the IP. Directory harvest detection fires when you are sending to invalid email addresses.</span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class=""> </span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">It is possible that your network or a system in your network may be compromised by a trojan spam virus, or perhaps there is an open port 25 through which a spammer may be gaining access and sending out spam. The last possibility is that one of your users is sending spam through the IP. We suggest checking these possibilities to help isolate the root cause of the spam and mail server access attempts originating from your IP.</span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">In general, once all issues have been addressed (fixed), reputation recovery can take anywhere from a few hours to just over one week to improve, depending on the specifics of the situation, and how much email volume the IP sends. Complaint ratios determine the amount of risk for receiving mail from an IP, so logically, reputation improves as the ratio of legitimate mails increases with respect to the number of complaints. Speeding up the process is not really possible. Talos Intelligence Reputation is an automated system over which we have very little manual influence.</span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">In the meantime, if there are recipients whom you cannot contact, we would recommend contacting the ISP involved to request temporary whitelisting or you can always arrange to contact the recipient via alternative means.</span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">You will need to vet your mailing lists more if this keeps happening. </span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">Regards,</span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">Debra H </span><br style="font-family: Menlo-Regular; font-size: 11px;" class=""><span style="font-family: Menlo-Regular; font-size: 11px;" class="">SenderBase Support</span></blockquote><div class=""><font face="Menlo-Regular" class=""><span style="font-size: 11px;" class=""><br class=""></span></font></div><div class=""><br class=""></div></body></html>