Re: docusign fraud using docusign

>> >Time to remove docusign from RCVD_IN_DNSWL_MED and others that subtract
>> >points? This is not cool at all.
>>
>> correct, have you reported it?

On 10.11.24 10:06, Alex wrote:
>How do I do that? To the DNSWL group?

I think there was link on their website and IIRC they already 
delisted/lowered rating of IP I reported some time ago.  Not sure if the 
list is proper place.

>There also appears to be a reference to an automated script using a
>key/token, but no information on how to do that. I can't spend time feeding
>these into some webform.


>>Even without having these rules, there isn't much in the body to catch a
>> >docusign phish that uses docusign directly.
>>
>> >https://pastebin.com/ij2MXi6c
>>
>> BAYES_00 also says something
>>
>
>It's unreasonable to think docusign or Paypal can be trusted? If so, why
>would it be DNSWL listed (and others) in the first place?

BAYES_00 says that the content of message was detected as (wanted) ham by 
your local BAYES database. I guess you need to train these messages.

And I guess, you reasoning is just the reason it was DNSWL listed. Perhaps 
that listing needs to be lowered or removed, if the service gets abused and 
does nothing against that.

>On 08.11.24 16:48, MX wrote:
>> >I would just score anything DNSWL at 0. I mean no disrespect to the
>> maintainer of DNSWL but I just don’t find it useful these days. Spam is too
>> complex now.
>>
>> I'd give them small score so I can see they hit
>> - unless you want stop using that at all.
>>
>
>A small score seems reasonable, but aren't these part of masschecks?

All tests are, perhaps except *(black|block|white|welcome)list

>Are docusign/paypal/microsoft/etc scam emails part of masschecks or only
>the trusted ones? I just keep hearing about DNS/SPF and other problems with
>these domains, but they remain mostly trusted?

afaik the masschecks run over spam/ham corpora. So it would make sense to 
include this kind of spam in that.


-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
If Barbie is so popular, why do you have to buy her friends?