SPAM (confirmed) - Problems with Cyren Database or bad pattern?

This has started again on May. 6th.

On three UTM 9.509-3 appliances in Norway. A large amount of emails from senders on Office 365 is rejected with "SPAM Confirmed" these are obviously false positives. And it is causing huge problems. Businesses are stopping up because of emails not being received. It has already had a cost of delayed shipments and lost orders. 

I had to add an exeption where SPAM check was bypassed on all emails coming from Office 365 Outbound Security. This is a horrible solution but was necessary. Now I have to manually all day long scavenge the logs for emails that should not have passed and manually delete these.

What is going on?

Stig

Guys, if this is being blocked as "spam" (the exact reason will be in the logs as Sachin mentioned) then there is an issue with the Cyren anti-spam system.  Most are not familiar with how this works; there is no pattern db, etc. referenced on the UTM when doing the spam check; instead an algorithm is run against the email, and a "signature" is generated.  This is compared with a real-time lookup on Cyren's (maybe Sophos hosts some mirrors, but I can't recall, been a while) spam database.  Cyren uses a number of methods to update their spam DB constantly... I have at times noted issues with their system (as happens with any anti-spam system), and pointing it out to Sophos (or in some cases, I've taken it direct to Cyren... back when they were known as Commtouch).  They will need to work with Cyren to resolve the issue.

The most likely reason for this is I am now seeing spammers leveraging Office 365 and other cloud mail services to spam folks (most likely via hijacked accounts) and so that's probably why this is happening.   I would open a case with Sophos Support instead of posting on this forum to get this issue moving.

Guys, if this is being blocked as "spam" (the exact reason will be in the logs as Sachin mentioned) then there is an issue with the Cyren anti-spam system.  Most are not familiar with how this works; there is no pattern db, etc. referenced on the UTM when doing the spam check; instead an algorithm is run against the email, and a "signature" is generated.  This is compared with a real-time lookup on Cyren's (maybe Sophos hosts some mirrors, but I can't recall, been a while) spam database.  Cyren uses a number of methods to update their spam DB constantly... I have at times noted issues with their system (as happens with any anti-spam system), and pointing it out to Sophos (or in some cases, I've taken it direct to Cyren... back when they were known as Commtouch).  They will need to work with Cyren to resolve the issue.

The most likely reason for this is I am now seeing spammers leveraging Office 365 and other cloud mail services to spam folks (most likely via hijacked accounts) and so that's probably why this is happening.   I would open a case with Sophos Support instead of posting on this forum to get this issue moving.

Just hoping someone would know anything and hopefully that it will be solved soon.

I really don't want to open a support case. Every time I do it takes forever to get resolved.

<rant>

First time after buying and using Sandstorm only to find out after 6 months that it was not working at all, I opened a support case. It took 3 months for support to solve the case.

Then later when an email with cryptovirus got by they used another two months to solve that.
Then with all these bad firmware pathes last months creating all sorts of hell.

Also Sophos recommended some of my customers to Upgrade to XG from SG and replace UTM Endpoint with Sophos Cloud only to discover after that actual license cost went up with several hundred percent. One Case Sophos UTM Endpoint Protection cost 1500$, Sophos Cloud Ended up costing 5600$ Customers were furious. Greedy licensing and repeated serious issues is getting on the customers and my nerves.

Bought some XG firewalls for site-to-site IPsec to branch offices in China, USA, Lithuania and Thailand. Needed Network Protection only to discover after buying that Support and firmware updates was not included anymore on XG like it was on SG. Sales representative did not mention this.
Ended up losing money on this sale.

I will recommend to replace Sophos with other brand in near future. Getting tired of all these problems.

</rant>

Stig