The Science mailservice used Spamhaus for decades as one of the blocklists to filter spam in mail. When we were notified that we would need a commercial license that would cost ca. 5kEUR/y, we investigated how much more spam would come through without the Spamhaus service. This showed that users would get more spam, but most of it would be delivered in the Spam folder. Next to that, we expect that the spam filtering of the also used Exchange Online Protection will improve....

After migrating to a new mailbox server on Sunday, March 31, we noticed different behaviour in the processing of mailbox filters (by the Sieve software). Firstly, the ‘include’ of global spam+virus filtering rules had a side-effect which has been fixed using a newer version of the software. Secondly, the default behaviour of the ‘fileinto’ statement underwent a change: previously, it featured an implicit ‘stop’ statement, but now it requires an explicit ‘stop’ statement after the ‘fileinto’ to achieve the same effect....

The RU contract with the anti-SPAM/anti-phishing service Proofpoint expired September 21, 2023, which means that ‘Proofpoint End User Digest’ mails are not sent anymore after that date. C&CZ is migrating Science mailboxes to the anti-SPAM/anti-phishing service of Microsoft Exchange Online Protection. There is an increased chance of receiving SPAM/phishing mails in the Science mailbox during this migration period. P.S. the RU central mailboxes (with addresses ending in @ru.nl) have already been migrated to Microsoft Exchange Online Protection....

Last friday, a change in the mailman configuration has been rolled out which had the inadvertent effect that mails were not delivered to external addresses anymore. However, these mailman posts were sent successfully to internal Science mail addresses. The change has been rolled back for the moment but is a necessity meaning that we’re looking for another solution.

The last few days three Science users have supplied their Science password to phishers. We notice that because Internet criminals use these passwords to get into the Science mail servers (horde webmail, smtp) in order to send spam. This time they even used a fake copy of the horde Science webmail website. The big differences with the real horde Science webmail website are: the URL is not within science.ru.nl the connection is not a secure https connection, there is no lock the username and password do not arrive at C&CZ servers, but in the hands of Internet criminals....

Horde webmail again appeared to be misused for sending spam. This could happen because a naive user gave the Science password to phishers/spammers. After first stopping horde, early Friday morning we disabled the account of the naive user and restarted horde. Saturday morning it appeared that this short spam-outbreak had caused administrators of hotmail.com to add our mail server to their blacklist. Therefore we switched the IP-number of this mail server Saturday morning....