DKIMWL_WL_MED spams

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

Hello,

I have recently noticed spams spreading via amasonses.com and outlook.com.
hitting DKIMWL_WL_MED that pushed score below threshold.

especially amazonses.com mail seemed to be amazon cloud servers.

Has anyone noticed this too?

I have disabled DKIMWL_WL_MED for now.

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Remember half the people you know are below average. 

Re: DKIMWL_WL_MED spams

[Matthias Leisi <ma...@leisi.net>]

> Amazon has either loosened up their security or they have some customers 
> that weren't properly vetted.  I have noticed an uptick in SES spam 
> lately too.  I report them to SpamCop which reports them to Amazon's 

We’ve also noticed this on our dnswl.org <http://dnswl.org/> spamtraps. Reporting to us also helps a lot :) 

> The type of spam that is coming from Amazon SES lately is mostly people 
> trying to sell contact lists.  I take it as a challenge to enhance my

Also a lot of Mainsleaze. 

— Matthias

Re: DKIMWL_WL_MED spams

[David Jones <dj...@ena.com>]

On 11/21/18 12:13 PM, Matus UHLAR - fantomas wrote:
> Hello,
> 
> I have recently noticed spams spreading via amasonses.com and outlook.com.
> hitting DKIMWL_WL_MED that pushed score below threshold.
> 
> especially amazonses.com mail seemed to be amazon cloud servers.
> 
> Has anyone noticed this too?
> 
> I have disabled DKIMWL_WL_MED for now.
> 

Amazon has either loosened up their security or they have some customers 
that weren't properly vetted.  I have noticed an uptick in SES spam 
lately too.  I report them to SpamCop which reports them to Amazon's 
email abuse.  Please report them to Amazon to help all of us out. Just 
blocking them locally doesn't really help anyone because the spammer 
will use another throwaway domain via SES to spam again soon.
The fact that Amazon will handle abuse reports properly means they 
should get some trust points subtracted.  Users should be able to 
unsubscribe and give feedback that "I never signed up for this email" 
for the ones that get through.
The type of spam that is coming from Amazon SES lately is mostly people 
trying to sell contact lists.  I take it as a challenge to enhance my 
regex that blocks these types of emails not just from SES.

-- 
David Jones