Re: mailchip and negative points - new phish?

On 2026-01-21 at 10:50:51 UTC-0500 (Wed, 21 Jan 2026 10:50:51 -0500)
Greg Troxel <[email protected]>
is rumored to have said:

> I just got an email from (last name replaced by doe in case this is
> legit:
>
>   From: Netcom <[email protected]>

It's not, and the supposed name is 'cooper' in my copy.

It was apparently sent via MailChimp (apparently now an Intuit company?) 
to everyone on this mailing list. e.g. it was sent to the unique address 
I use for this list.


> with new Ts&Cs and that my services are going to be migrated.  I'm not
> in the UK and I'm not a netcom customer.  That makes it spam.  But it
> looks okish, were I a customer.

It also looks like a confirmation pass by a spammer who wants to look 
legit.

> Further searching for this content to find a legit source was really
> hard, so it feels like phish.  It arrived
>   Received: from mail47.us4.mcsv.net (mail47.us4.mcsv.net 
> [205.201.128.47])...
> and I've complained to mailchip.  That's all normal and it would not
> cause mme to write.
>
> I'm writing because this spam got a ton of negative points: -5.9!
> It seems that mailchimp in general, or this emitter, is registered as
> only sending opt-in mail.  Which is pretty clearly not true.
>
> Has anyone else been seeing spam via mailchimp, that is wrongly 
> getting
> lots of negative points?

Not a lot, which is likely because I have custom local rules and score 
adjustments which result in rejection of most MC mail, including ALL of 
their garbage not sent to a tagged address.

> I'll write to isipp.com support and see how that goes.

Seems like the right choice.

> -2.1 RCVD_IN_IADB_OPTIN     RBL: IADB: All mailing list mail is opt-in
>                             [205.201.128.47 listed in iadb.isipp.com]
> -1.2 RCVD_IN_IADB_OPTIN_GT50 RBL: IADB: Opt-in used more than 50% of 
> the
>                             time
>                             [205.201.128.47 listed in iadb.isipp.com]
> -0.4 RCVD_IN_IADB_LISTED    RBL: Participates in the IADB system
>                             [205.201.128.47 listed in iadb.isipp.com]
> -2.2 RCVD_IN_IADB_VOUCHED   RBL: ISIPP IADB lists as vouched-for 
> sender
>                             [205.201.128.47 listed in iadb.isipp.com]

You may wish to weaken the IADB "OPTIN" and "VOUCHED" rules, as they 
really are not very accurate.


-- 
  Bill Cole
  [email protected] or [email protected]
  (AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
  Not Currently Available For Hire