SPAM: Delivery Notification: 5 messages to contact@<club>toastmasters.org delaye

And ...they tried again from a different source. And the (not included) button is via goggleapis
Subject: [17] Clustered Mails Detected

---

Return-Path: server@toastmastersclubs.org
Delivered-To: dave@mitton.com
X-FDA: 77017247286.25.wound79_0b15b9526ec2
Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251])
by smtpin25.hostedemail.com (Postfix) with ESMTP id 619B01804E3A1
for <dave@mitton.com>; Thu, 9 Jul 2020 04:25:03 +0000 (UTC)
X-Spam-Summary: 30,2,0,9e3b8c81797f0ff8,d41d8cd98f00b204,server@toastmastersclubs.org,,RULES_HIT:1:2:41:72:355:375:379:455:496:962:966:967:973:978:983:988:989:1189:1208:1224:1260:1261:1311:1313:1314:1345:1381:1431:1432:1433:1434:1436:1437:1513:1515:1516:1517:1521:1588:1589:1593:1594:1685:1714:1730:1747:1777:1792:2194:2196:2198:2199:2200:2201:2393:2525:2538:2553:2559:2565:2682:2685:2737:2828:2859:2890:2894:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3148:3350:3586:3865:3867:3870:3871:3873:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4042:4052:4180:4181:4321:4385:5007:6261:6653:6669:6671:6674:6678:6688:7688:7775:8518:8603:8957:9025:9059:9080:9149:9394:9416:9908:10004:10346:11473:11658:11914:12043:12295:12324:12438:12555:12740:12895:12956:12958:12959:12986:13007:13139:13198:13211:13229:13439:14096:14877:21080:21325:21347:21433:21450:21451:21483:21524:21627:21660:21810:21819:21851:21881:21889:21939:21966:21985:21987:30001:30003:30022:30054:30070:30090,
X-HE-Tag: wound79_0b15b9526ec2
X-Filterd-Recvd-Size: 11860
Received: from toastmastersclubs.org (toastmastersclubs.org [50.19.253.65])
by imf37.hostedemail.com (Postfix) with ESMTP
for <dave@mitton.com>; Thu, 9 Jul 2020 04:25:02 +0000 (UTC)
Received: from localhost.localdomain (toastmastersclubs.org [127.0.0.1])
by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 0694P16J016221
for <dave@mitton.com>; Thu, 9 Jul 2020 04:25:02 GMT
Message-Id: <202007090425.0694P16J016221@toastmastersclubs.org>
Received: from kia0.blockkeykeychain.net (kia0.blockkeykeychain.net [37.235.48.52])
by toastmastersclubs.org (8.14.4/8.14.4) with ESMTP id 0694OxTV016208
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)
for <contact@merrimack-toastmasters.org>; Thu, 9 Jul 2020 04:25:00 GMT
Subject: [17] Clustered Mails Detected
Date: 08 Jul 2020 21:24:58 -0700
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: No, score=0.1 required=5.0 tests=HTML_MESSAGE,MIME_HTML_ONLY,
SPF_HELO_NONE,SPF_NONE autolearn=no autolearn_force=no version=3.4.3
X-Spam-Checker-Version: SpamAssassin 3.4.3 (2019-12-06) on
toastmastersclubs.org
From: "Toastmasters Club 508 on behalf of " <server@toastmastersclubs.org>
X-Loop: server@toastmastersclubs.org
Sender: account-security-noreply@e9412.b.akamaiedge.net
Reply-To: account-security-noreply@e9412.b.akamaiedge.net
To: "contact@merrimack-toastmasters.org"
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=toastmastersclubs.org;
h=content-transfer-encoding:content-type:date:from:mime-version
:reply-to:sender:subject:to; s=default; bh=P9dUt3RMsKurdPZ6GjHv5
dPOn4tw+jv6gchJIwObdD0=; b=wwp7xZKLE+uLLl68sKrvKHwZkkmKGkxnKLukh
nXMrHGJB3gp28pFqfZvbSdQiogdoNBy8REGUFFe3jCN7G2dkvMt6ZtkozG3Tldhc
4GthwF61FxmtxM/CdWkSd2Do4HmkEU15iHkykOFfWdvwA88YOg4Ruw0FPfsc28RT
mqJlDY=
X-Rspamd-Queue-Id: 619B01804E3A1
X-Spamd-Result: default: False [0.00 / 100.00]
X-Rspamd-Server: rspam03

Spammers spam, not to much we can do to stop every spam email, we do have in place several anti-spam tools they just can't catch every one.

Please add the domain @e9412.b.akamaiedge.net to your black list.

Yes I get many more than this on my other mailboxes. I thought this was more tailored than most, but after thinking a bit, its' just a variation on fake email admin mails taking advantage of the open contacts@club address.

One of the things I also notice is that you are not using the Crowd-Sourced Blacklist feature. It is certainly your choice either way. However, when I implemented that feature in the past, I anticipated that clubs might unfortunately be targeted with much more spam in the future. (It is the trend.) If you are leveraging the black lists of other clubs, it should result in less work for you preventing spam. (It is the "strength in numbers" approach.)

The only reason I mention this is the number of email addresses I notice in your club email black list. (quite a few) I wonder how many of those were also caught by other clubs.

Originally, this feature had some issues that had led to us telling clubs to shut it off in some cases. However, those issues have long since been resolved.

Thanks, was just reading your notice about that feature this morning, and thought I had it on already. Do now.
I suspect that most in my list were one-timers and I should prune it in the future.

One thing you might try if you want to investigate this a bit more is to cut and paste each entry from your club black list into the Search Crowd Sourced Black List pop-up, then paste each back into your club black list. That would let you know if another club has the respective emails / domains on their club black list. If some other club has it already, you don't need to include it in your black list if you are doing the crowd sourcing thing.

>>> You just have to make sure you remove each email addr / domain from your club black list before doing the search, since the search does also include your club's black list. (Thus, the reason I suggest cutting each entry before doing the search.)