Hi Benoît, >> How about blocking the Amazon AWS IP ranges? Are there any legitimate >> emails being send by them? We see less than 1 clean between 1 million (or 1 billion?) emails from there, so guess what :-) Our fast reacting abuse desk whitelists single IPs on demand from those ranges.
Olaf Petry Hornetsecurity GmbH -----Original Message----- From: mailop <[email protected]> On Behalf Of Benoit Panizzon Sent: Monday, October 29, 2018 12:02 PM To: [email protected] Subject: [mailop] Amazon AWS as 'spam sending farm' via phished account? Hi List We increasingly notice, that when an account got phished, it is being abused to send spam from usually one or two Amazon AWS US IP Addresses simultaneously, staying below our account auto-block thereshold. Quite some time in the past, when I first observed this, contacted the Amazon Abuse Desk, including the infos they provide in their WHOIS entry in the past, but newer ever got any kind of reaction. Now I am curious, do others also make this observation? How about blocking the Amazon AWS IP ranges? Are there any legitimate emails being send by them? Well I could try to block them only for Authenticated SMTP submission, not for MX operation. Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://atpscan.global.hornetsecurity.com/index.php?atp_str=07zaR0I5KHZHSQhtydYdX1oYKg72Ia9jsYDDP9_dXJo-pQdIAARnuUIbfQtvKEAuvwT1W6bOub-guncDQACzPQ5h_YRQMIPEaxble352w6fj28OGRSl4OGqLTNcjoBbkenql71mWjJy9ZlzK3PLgYLv_FIuNxNjrchqOYqRotss8XdluF2bd9cFQkfUgO38BoRQZRakoDxxYriEg1Jqbicaio6c7gISqaV-l0VTj3XlsZZ0-2dM03FpqbkDy0sfDBarAu4eyE4XBCuPrxZFBiQtF1O6asZcL2yM6OiM2NTA2ODczYTcxNWMjOjoj0JzzuvgNKYlkBICLfYtu6w ______________________________________________________ _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop _______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
