Spam passing through.

[JasonS]

Hello all, I am getting some email passing right through MagicSpam even though it is confirmed as spam by the BMS. At the minimum at least it should be tagged but it just goes right through, the offending IP is 144.76.148.184/24 based out of Germany, Multirbl has it listed on 22 blacklists, Cisco/Talos Reputation has it as "Poor" with a volume increase of 2500%, it is on Spamhaus SBLCSS, and the Barracuda List as "Poor". I have a lot of this email coming through it is advertisements, this particular one is "Never have cold hands again while you enjoy time outside this winter" from "Keep Warm this Winter". Can you please tell me why this email is passing through, is there a config that I am missing? I have attached some screenshots.

Thank you,
JasonS

magic1.png (57.17 KiB) Viewed 58496 times

magic2.png (64.13 KiB) Viewed 58496 times

[magicspam]

Hello JasonS,

Thank you for your post.

Can you please confirm that you are still receiving emails from IP: 144.76.148.184?

It is possible that these emails have been received from the moment IP started sending spam to the moment it was listed on any of the BMS lists enabled in your server.

Just to make sure that BMS lists are successfully updated in your system, could you please send us listing of the following directories:

C:\magicspam\bms\
and
C:\magicspam\bms\incoming

Lastly, just to make sure that the protection is not disabled for any of the recipients, can you please check and see if there are any entries under:

Settings / Exemptions / "Mailboxes with Protection Disabled"

Thank you.

[JasonS]

Thank you for the reply, sorry but I realized after I made my post that it was in the wrong forum, I was supposed to post in the "Plus" page. I have blacklisted that IP but I am still getting a ton of spam passing through. Image 1 is a screenshot of my inbox.

Image 1

one.png (37.89 KiB) Viewed 43988 times

Now here is the BMS folder
C:\magicspam\bms\

bms1.png (33.63 KiB) Viewed 43988 times

And here is the BMS/Incoming folder
C:\magicspam\bms\incoming

bms2.png (32.96 KiB) Viewed 43988 times

I checked the "Mailboxes with Protection Disabled" setting and there are no email boxes configured.
Let me know if there is anything else you need.

JasonS

[magicspam]

Hello JasonS,

Thank you for your post and for providing us additional information.

Based on the screenshots, we see that your BMS lists have been updating correctly. In this case we suspect that the spam emails in question have been received from the moment the new IP address was brought up for spamming to the moment it was listed on one of the BMS or RBL lists enabled in your MagicSpam.

To be able to better understand the nature of the uncaught spam you are receiving, and to assist us in making suggestions for how to improve your filtering, can you please send us the MagicSpam logs for examination? If able to provide us new set of logs, please send it to our support email address:

support@magicspam.com

To retrieve MagicSpam logs, you can use the MagicSpam interface and access the "Logs" tab.
In the log search result output, you have the option to export/save the log search results to a CSV file. Please Email the CSV file as an attachment to us.
Please also make sure that you remove entries where mua=yes and leave only HAM entries that are confirmed spam.

Also, can you please send us updated screenshots of the following two tabs in your MagicSpam control panel:

* Settings / Server Policies
* Settings / IP Reputation

In addition, in your email could you please provide us following details about your platform:

- MagicSpam License
- Operating System and Version
- Operating System Architecture (32 bit or 64 bit)
- MailEnable Version

Thank you JasonS.

[JasonS]

Hello,

I will have to wait a few days because it now seems to have stopped all of a sudden.

Jason

[magicspam]

Hello Jason,

We are happy to hear that the spamming issue has subdue.

If you encounter any further issues with uncaught spam, please contact us via email at support@magicspam.com, as instructed in our previous post.

Thank you Jason.