You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michael Scheidell <mi...@secnap.com> on 2011/08/20 03:27:41 UTC
Re: Caution - access to Spamhaus data-feed may be improperly
configured: 204.89.241.253
Bullshit 3.
There isn't even a dns server on this host.
--
Michael Scheidell, CTO
SECNAP Network Security
-----Original message-----
From: MXTools Spamhaus Team <ms...@mxtools.com>
To: Michael Scheidell <mi...@secnap.com>
Sent: Sat, Aug 20, 2011 01:20:11 GMT+00:00
Subject: Caution - access to Spamhaus data-feed may be improperly configured: 204.89.241.253
Dear Spamhaus User,
I am writing to you on behalf of MXtools.com, an authorized Spamhaus reseller. Our automated server monitoring tools have detected that your organization is querying Spamhaus public servers with an unusually high volume from the following IP address: 204.89.241.253 .
Many users are unaware that the public service is provided free of charge only for low volume mail servers (non-commercial) or for small organizations with no other means to protect themselves against spam (non-profits, charities). This usage policy is well explained at: http://www.spamhaus.org/organization/dnsblusage.html.
Since millions of users across organizations of all sizes now depend on Spamhaus to keep email flowing, they encourage high volume users and other commercial services to move to our sponsored service. This prevents overloading of the public mirrors and keeps response times snappy. Pricing for the sponsored data-feed is approximately less than $1/user (much less for Service Providers & Schools) - which is clearly the most affordable way to protect your organization against spam and malware. As a full subscriber you are also entitled to unlimited free technical support and free pro-active monitoring of your email server.
Thank you for using the DNSBL data-feed to protect your users from the daily deluge of spam. Through your continued use of the sponsored service, Spamhaus can ensure sustained funding of the free public mirrors that are used by millions of home users and non-commercial or charitable organizations. Your contribution also helps support our research efforts to fight spammers and other cyber-miscreants.
Please consider registering now using this link: http://www.spamhaus.org/ma
Sincerely, Spamhaus Technology & MXTools
Melanie Smith
msmith@mxtools.com<ma...@mxtools.com>
+1-866-931-9228 ext. 217
+1-778-330-1074 ext. 217
http://www.mxtools.com<http://www.mxtools.com/Spamhaus/Datafeed/tabid/95/Default.aspx>
http://www.spamhaustech.com<http://www.spamhaustech.com/registration/ma>
P.S. If you are already a Spamhaus Datafeed client, thank you we truly appreciate your support! However, it would appear that one of your servers (perhaps forgotten from the trial period) needs to be re-configured. Please contact us at support@mxtools.com<ma...@mxtools.com> so that we may help make the required changes and avoid any service interruptions.
Re: Caution - access to Spamhaus data-feed may be improperly configured:
204.89.241.253
Posted by Michael Scheidell <mi...@secnap.com>.
On 8/19/11 9:27 PM, Michael Scheidell wrote:
> Bullshit 3.
> There isn't even a dns server on this host.
>
>
noop, no dns server here on this ip.
sockstat -4p53
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
mx1# ps -ax | grep named
37956 p0 S+J 0:00.00 grep named
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
>*| *SECNAP Network Security Corporation
* Best Mobile Solutions Product of 2011
* Best Intrusion Prevention Product
* Hot Company Finalist 2011
* Best Email Security Product
* Certified SNORT Integrator
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: Caution - access to Spamhaus data-feed may be improperly configured:
204.89.241.253
Posted by Michael Scheidell <mi...@secnap.com>.
On 8/19/11 9:27 PM, Michael Scheidell wrote:
> Bullshit 3.
> There isn't even a dns server on this host.
>
>
and, checking to see if this is a joe job: considering spf failed:
they can't even get THEIR DNS right, and they think I have my DNS set wrong?
lusers.
Received: from smtp.mxtools.com (smtp.mxtools.com [68.71.38.2]) by
mx1.secnap.com.ionspam.net (Postfix) with ESMTP id 4F4F3622141 for
<dn...@secnap.net>; Fri, 19 Aug 2011 21:20:09 -0400 (EDT)
mxtools.com descriptive text "v=spf1 ip4:68.71.38.3 ip4:209.44.121.50 mx
~all"
host -t mx mxtools.com
mxtools.com mail is handled by 10 mail.mxtools.com.
host -t a mail.mxtools.com
mail.mxtools.com has address 209.44.121.50
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
>*| *SECNAP Network Security Corporation
* Best Mobile Solutions Product of 2011
* Best Intrusion Prevention Product
* Hot Company Finalist 2011
* Best Email Security Product
* Certified SNORT Integrator
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: Caution - access to Spamhaus data-feed may be improperly
configured: 204.89.241.253
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Mon, 22 Aug 2011 14:01:20 -0400
darxus@chaosreigns.com wrote:
> What reason do you have to believe it's a legitimate email from
> spamhaus? Have you tried contacting spamhaus or mxtools about it?
The mail might have been legitimate. We've seen a few of these messages
from MX Tools and they have been legit. Spamhaus outsources its sales and
marketing to MX Tools. MX Tools may not be as techincally savvy as Spamhaus
and is quite likely to mess up SPF records, etc.
The simplest thing is to phone MX Tools and ask if it's legit. If so,
you then decide whether or not Spamhaus is worth paying for. (I don't
think it is; it's overpriced IMO, but YMMV.)
Regards,
David.
Re: Caution - access to Spamhaus data-feed may be improperly configured:
204.89.241.253
Posted by Michael Scheidell <mi...@secnap.com>.
On 8/20/11 9:38 AM, Benny Pedersen wrote:
> you still did not post the envelope sender :(
>
one clue rule.
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
>*| *SECNAP Network Security Corporation
* Best Mobile Solutions Product of 2011
* Best Intrusion Prevention Product
* Hot Company Finalist 2011
* Best Email Security Product
* Certified SNORT Integrator
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: Caution - access to Spamhaus data-feed may be improperly
configured: 204.89.241.253
Posted by Benny Pedersen <me...@junc.org>.
On Sat, 20 Aug 2011 06:30:01 -0400, Michael Scheidell wrote:
> so, what are you suggesting, someone HACKED into mxtools and is
> sending spam?
spamhaus team testing mxtools mail secuirty :=)
would a mxtools member send From: line ? "< without space
if mxtools sends mails on behalf of spamhaus then mxtools would be
blacklisted in spamhaus, call it cyber war :=)
you still did not post the envelope sender :(
Re: Caution - access to Spamhaus data-feed may be improperly configured:
204.89.241.253
Posted by Michael Scheidell <mi...@secnap.com>.
On 8/20/11 2:35 AM, Benny Pedersen wrote:
>
> Resolved mxtools.com to 209.44.121.50
> [mxtools.com has 1 MX record mail.mxtools.com.(10)]
>
> is mxtools.com the envelope sender domain ?
Received: from mx1.secnap.com.ionspam.net ([204.89.241.253])
by mx1.secnap.com.ionspam.net (mx1.secnap.com.ionspam.net [10.70.1.253]) (SpammerTrap(r) VPS-1500, port 10024)
with LMTP id mPxFFvk9MOgM for<x>;
Fri, 19 Aug 2011 21:20:09 -0400 (EDT)
Received: from smtp.mxtools.com (smtp.mxtools.com [68.71.38.2])
by mx1.secnap.com.ionspam.net (Postfix) with ESMTP id D94B5621D4C
for<x>; Fri, 19 Aug 2011 21:20:08 -0400 (EDT)
domainkey-signature: a=rsa-sha1; c=nofws; s=key1; d=mxtools.com; q=dns;
h=mime-version:from:to:reply-to:date:subject:content-type:content-transfer-encoding;
b=P9z1xKNeJT4cpJLtz2CgjBn749ClSpSdS3+k1dOdKbsJwhyF4zA9dQ2vdgmwXFJwWLislTxVAlWTt3qnabRJgkBk4IpwfjjIO7ZeNtEENZCNwkvyx3h1Ee9tUVDKjJzPTmPSmh5w7XRgz96Qm3WfeEGq9xps3jrv3VhjSvTM0ik=;
X-FBL: M2VkLjEyLmM2MDAwMDAwMDEzMmUzLmRucy1hZG1pbj1zZWNuYXAubmV0
MIME-Version: 1.0
From: "MXTools Spamhaus Team"<ms...@mxtools.com>
Reply-To: msmith@mxtools.com
and, like I said in earlier email, they even have the spf dns records wrong.
host -t txt mxtools.com
mxtools.com descriptive text "v=spf1 ip4:68.71.38.3 ip4:209.44.121.50 mx ~all"
so, what are you suggesting, someone HACKED into mxtools and is sending spam?
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
>*| *SECNAP Network Security Corporation
* Best Mobile Solutions Product of 2011
* Best Intrusion Prevention Product
* Hot Company Finalist 2011
* Best Email Security Product
* Certified SNORT Integrator
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: Caution - access to Spamhaus data-feed may be improperly
configured: 204.89.241.253
Posted by Benny Pedersen <me...@junc.org>.
On Sat, 20 Aug 2011 01:27:41 +0000, Michael Scheidell wrote:
> Bullshit 3.
> There isn't even a dns server on this host.
Resolved mxtools.com to 209.44.121.50
[mxtools.com has 1 MX record mail.mxtools.com.(10)]
is mxtools.com the envelope sender domain ?
>
>
> --
> Michael Scheidell, CTO
> SECNAP Network Security
>
>
> -----Original message-----
> From: MXTools Spamhaus Team <ms...@mxtools.com>
> To: Michael Scheidell <mi...@secnap.com>
> Sent: Sat, Aug 20, 2011 01:20:11 GMT+00:00
> Subject: Caution - access to Spamhaus data-feed may be improperly
> configured: 204.89.241.253
>
> Dear Spamhaus User,
>
> I am writing to you on behalf of MXtools.com, an authorized Spamhaus
> reseller. Our automated server monitoring tools have detected that
> your organization is querying Spamhaus public servers with an
> unusually high volume from the following IP address: 204.89.241.253 .
>
> Many users are unaware that the public service is provided free of
> charge only for low volume mail servers (non-commercial) or for small
> organizations with no other means to protect themselves against spam
> (non-profits, charities). This usage policy is well explained at:
> http://www.spamhaus.org/organization/dnsblusage.html.
>
> Since millions of users across organizations of all sizes now depend
> on Spamhaus to keep email flowing, they encourage high volume users
> and other commercial services to move to our sponsored service. This
> prevents overloading of the public mirrors and keeps response times
> snappy. Pricing for the sponsored data-feed is approximately less
> than
> $1/user (much less for Service Providers & Schools) - which is
> clearly
> the most affordable way to protect your organization against spam and
> malware. As a full subscriber you are also entitled to unlimited free
> technical support and free pro-active monitoring of your email
> server.
>
> Thank you for using the DNSBL data-feed to protect your users from
> the daily deluge of spam. Through your continued use of the sponsored
> service, Spamhaus can ensure sustained funding of the free public
> mirrors that are used by millions of home users and non-commercial or
> charitable organizations. Your contribution also helps support our
> research efforts to fight spammers and other cyber-miscreants.
>
> Please consider registering now using this link:
> http://www.spamhaus.org/ma
>
> Sincerely, Spamhaus Technology & MXTools
>
> Melanie Smith
> msmith@mxtools.com<ma...@mxtools.com>
> +1-866-931-9228 ext. 217
> +1-778-330-1074 ext. 217
>
>
> http://www.mxtools.com<http://www.mxtools.com/Spamhaus/Datafeed/tabid/95/Default.aspx>
>
> http://www.spamhaustech.com<http://www.spamhaustech.com/registration/ma>
>
> P.S. If you are already a Spamhaus Datafeed client, thank you we
> truly appreciate your support! However, it would appear that one of
> your servers (perhaps forgotten from the trial period) needs to be
> re-configured. Please contact us at
> support@mxtools.com<ma...@mxtools.com> so that we may help
> make the required changes and avoid any service interruptions.