liquidweb cloud was used to send phishing

tommyluo

We catch a few phishing emails from liquidweb cloud,I check the website,it is hourly billing,maybe outgoing port 25 is open,spammer buy a low of vps and crazy sending out phising.

From: =?UTF-8?B?TdC1dGFN0LBzaw==?= metamask89788@2fa.eth
Reply-To: [email protected]
Subject: Last Reminder: Urgent Two-Factor Authentication Activation

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 173.249.144.20
X-SM_ReverseDNS: cloudhost-143970.us-west-1.nxcli.net

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 173.249.144.233
X-SM_ReverseDNS: cloudhost-79067.us-west-1.nxcli.net

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 185.145.13.59
X-SM_ReverseDNS: cloudhost-5941936.nl-west-1.nxcli.net

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 173.249.147.191
X-SM_ReverseDNS: cloudhost-3768768.us-west-1.nxcli.net

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 173.249.147.126
X-SM_ReverseDNS: cloudhost-2752191.us-west-1.nxcli.net

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 173.249.147.219
X-SM_ReverseDNS: cloudhost-4332335.us-west-1.nxcli.net

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 173.249.147.133
X-SM_ReverseDNS: cloudhost-4428397.us-west-1.nxcli.net

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 173.249.147.222
X-SM_ReverseDNS: cloudhost-3774536.us-west-1.nxcli.net

ScreenReader

This is an ad.

jar

Yup. I added them to my RBL. Likelihood of spam to ham from their ranges right now skews highly in favor of spam.

tommyluo

Some more are coming

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 207.246.254.16
X-SM_ReverseDNS: 207.246.254.16
From: =?UTF-8?Q?M=D0=B5taMask?= service63285@2factor.io
Reply-To: [email protected]

X-SM_EnvelopeFrom: [email protected]
X-SM_SENDER_IP: 199.189.225.250
X-SM_ReverseDNS: cloudhost-10747626.us-midwest-2.nxcli.net
From: =?UTF-8?Q?M=D0=B5taMask?= service89170@2factor.io
Reply-To: [email protected]

tommyluo

Kill them

/.*@[a-z0-9]{10}.nxcli.io$/ REJECT Go fuck away,it is 100% sure spams!

tommyluo

@jar use regex to block them at smtpd_sender_restrictions or smtpd_recipient_restrictions

totally_not_banned

@tommyluo said:
@jar use regex to block them at smtpd_sender_restrictions or smtpd_recipient_restrictions

No, the given reason is absolutely unacceptable. It's needs to go into way more details in regards to their ancestors and their various orifices.