User blacklist is automatically filled

[jo.chen]

Hello everyone,
I have the feeling that I'm missing something obvious here. We use PMG in the company and the user blacklist of some users is very well filled (several hundred entries), although they say they have never added an address to the blacklist. And I can confirm that they didn't even know how to do it.

I learnt from one user that he marks the spam mails that make it into the mailbox as junk by right-clicking in Outlook. But I doub't that this has any effect on the PMG blacklist.

Is there an automatic process for filling the user blacklists? I couldn't find anything like this in the processing rules nor in the documentation.

Kind regards,
Jochen

 

[Stoiko Ivanov]

The spamreport contains links that automatically add mails to the white/blacklists - maybe your users clicked there?

 

[jo.chen]

Hi Stoiko,
Thanks for your post. Do you mean the "Whitelist" and "Blacklist" at the right side of the spam report? I doubt it, because at least one of the users didn't even look the reports, because they were treated as junk from Outlook and were automatically moved to the Junk-Folder. At least from what this user told me, he didn't know the reports at all.

Best regards,
jo.chen

 

[DavidD]

Hi,
same problem here: hundreds of user blacklists are filled.
Users do not receive any reports (and are not aware of PMG filtering).
Regards.

 

[Stoiko Ivanov]

Some E-mail scanning solutions do click on links inside e-mails (to see if they're dangerous) - maybe something like that happens for your users?

 

[jo.chen]

I wouldn't know of a scanning solution like this. We're only using Outlook on the workstations.
How could such a solution trigger a blacklist entry on the mail gateway, anyway?

 

[Stoiko Ivanov]

How could such a solution trigger a blacklist entry on the mail gateway, anyway?

because the spamreport sent to the users has links to directly blacklist/whitelist/accept/delete the mails in quarantine....

 

[DavidD]

No it cannot be a user side triggering.
Most of the user blacklists are filed with 2 entries:
xxxxxxx@arastell.de
yyyyyyy@nikosales.de
with left random part (xxxxxxx and yyyyyyy)
I don't remember having doing something concerning these 2 domains addresses.

Regards.

 

[DavidD]

We can reproduce the "problem" with selecting several spams and click blacklist in the Administration / Spam Quarantine.
In the postgresql table userprefs, i can see that for rows with the column name=BL, the mtime is the same,
so it confirms we may have done this...