Results 1 to 1 of 1

Thread: Receiving SPAM

  1. #1
    Join Date
    Apr 2012
    Posts
    43
    Rep Power
    3

    Default [Solved]Receiving SPAM

    EDIT: I have fixed this problem by rasing the score for BAYES_99 from 4.3 to 6.5, this way it will exceed the minimum score required to be classified as spam and is not too invasive for other messages too.

    Hello Everyone,

    I have enabled Pyzor, Razor and SPF into spamassassin by following the wiki (however I don't know how to look to see if they are indeed configured and working) and everything is all good until yesterday I am receiving spam from my domain emails. When I look into logs it seems a clear spam however zimbra doesn't mark it as a spam.

    Here is a message:

    Code:
    Return-Path: bastillea64@financial-tracking.com
    Received: from email.mydomain.com (LHLO email.mydomain.com) (88.34.111.131)
     by email.mydomain.com with LMTP; Mon, 30 Jul 2012 17:21:29 +0200 (CEST)
    Received: from localhost (localhost [127.0.0.1])
    	by email.mydomain.com (Postfix) with ESMTP id 766A92A22C8
    	for <admin@mydomain.com>; Mon, 30 Jul 2012 17:21:29 +0200 (CEST)
    X-Virus-Scanned: amavisd-new at email.mydomain.com
    X-Spam-Flag: NO
    X-Spam-Score: 6.551
    X-Spam-Level: ******
    X-Spam-Status: No, score=6.551 tagged_above=-10 required=6.6
    	tests=[BAYES_99=4.3, RCVD_IN_BRBL_LASTEXT=1.449, RDNS_NONE=0.793,
    	SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01] autolearn=no
    Received: from email.mydomain.com ([127.0.0.1])
    	by localhost (email.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id 6wdqRzHitSrg for <admin@mydomain.com>;
    	Mon, 30 Jul 2012 17:21:28 +0200 (CEST)
    Received: from [186.182.162.196] (unknown [186.182.162.196])
    	by email.mydomain.com (Postfix) with ESMTP id D22F32A19B4
    	for <admin@mydomain.com>; Mon, 30 Jul 2012 17:21:27 +0200 (CEST)
    Message-ID: <5016A274.502020@mydomain.com>
    Date: Mon, 30 Jul 2012 12:21:23 -0300
    From: <admin@mydomain.com>
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6
    MIME-Version: 1.0
    To: <admin@mydomain.com>
    Subject: Manager Customer Service
    Content-Type: text/plain; charset=UTF-8; format=flowed
    Content-Transfer-Encoding: 7bit
    
    Hello
    
    Large American company which engaged in IT development and investment, looking for representatives in Europe to
    cooperate with international holdings and distribution of investment in IT.
    Since intercontinental bank transfers take a lot of time company needs staff to handle the funds of the company,
     it is assumed either part time or full time.
    
    Salary - 4000 EUR monthly for 3 - 4 working hours a day.
    However, your earnings may increase depending on the time you'll spend on quests, severity and loyalty to the company.
    
    If you are interested in the prospect of a possible employment is presented below the job description
    - Receive payments from our customers all over the world and treat them with banking schemes and cash transfers
    - When processing each payment you receive an immediate bonus of 5% of the payment amount
    - Maintain reporting and any necessary preparations to receive payments
    - Be confident in the accuracy of the correctness and delivering them on time.
    
    This position does not involve a change of residence,
    and you will be able to work in the city and even in my area and you do not need to move anywhere.
    
    This listing does not include fixed working hours and absolutely suitable for all sectors and age groups in our society.
    You do not need to invest or spend their money, all the costs come at the expense of the company.
    
    Requirements:
    1. Elementary knowledge of the banking system and money transfer systems.
    2. Ability to accept payments on your bank account at your bank.
    3. Speed of processing tasks (send and receive payments) for a given system of money transfers.
    4. Ability to check your email on the Internet at least once a day.
    
    It is forbidden:
    1. Breach of confidentiality and corporate ethics of our customers.
    2. Deliberate delay in payment processing (already immediately after the receipt of funds in the account, in most cases, the company requires the fulfillment of tasks on the same day when you received a bank transfer to the account).
    3. The statement about the impossibility to process the payment after receiving it.
    
    If you breach any of the above paragraph will cease our cooperation.
    If you are interested in this proposal, we suggest that you go through a trial period. For this purpose send your information to us.
    
    These are:
    1. Your full name
    2. Your Age
    3. Contact phone number with international format
    4. Contact email address:
    
    Send the data to the email address of company Derrick@top10jobbs.com,and before sending check address. (Do not click button to answer.)
    
    Sincerely
    Hr department
    Server logs:

    Code:
    Jul 30 17:21:29 email postfix/qmgr[8497]: 766A92A22C8: from=<bastillea64@financial-tracking.com>, size=3891, nrcpt=1 (queue active)
    Jul 30 17:21:29 email amavis[28167]: (28167-01) FWD via SMTP: <bastillea64@financial-tracking.com> -> <admin@mydomain.com>,BODY=7BIT 250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 766A92A22C8
    Jul 30 17:21:29 email amavis[28167]: (28167-01) Passed CLEAN, [186.182.162.196] [186.182.162.196] <bastillea64@financial-tracking.com> -> <admin@mydomain.com>, Message-ID: <5016A274.502020@mydomain.com>, mail_id: 6wdqRzHitSrg, Hits: 6.551, size: 3189, queued_as: 766A92A22C8, 1183 ms
    Jul 30 17:21:29 email postfix/smtp[27578]: D22F32A19B4: to=<admin@mydomain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.7, delays=0.49/0/0.01/1.2, dsn=2.0.0, status=sent (250 2.0.0 from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 766A92A22C8)
    Jul 30 17:21:29 email postfix/qmgr[8497]: D22F32A19B4: removed
    Jul 30 17:21:29 email amavis[28167]: (28167-01) extra modules loaded: /opt/zimbra/zimbramon/lib/x86_64-linux-thread-multi/auto/Net/SSLeay/autosplit.ix, /opt/zimbra/zimbramon/lib/x86_64-linux-thread-multi/auto/Net/SSLeay/randomize.al, IO/Socket/SSL.pm, Net/LDAP/Extension.pm, Net/SSLeay.pm, unicore/lib/gc_sc/Alnum.pl, unicore/lib/gc_sc/Alpha.pl
    Jul 30 17:21:29 email postfix/lmtp[28771]: 766A92A22C8: to=<admin@mydomain.com>, relay=email.mydomain.com[88.34.111.131]:7025, delay=0.25, delays=0.04/0/0.03/0.17, dsn=2.1.5, status=sent (250 2.1.5 Delivery OK)
    Jul 30 17:21:29 email postfix/qmgr[8497]: 766A92A22C8: removed
    The emails are not only targetting my admin account, a part of the message changes with each email, and it's never coming back from the same IP address. Any ideas how to put an end to this?

    Thank You,
    Paul Csiki.
    Last edited by Paul Csiki; 08-03-2012 at 01:11 AM. Reason: Added a solution

Similar Threads

  1. Problem receiving spam with invalid "FROM"
    By mickier in forum Administrators
    Replies: 1
    Last Post: 01-12-2011, 01:20 AM
  2. Outgoing mail blocked as spam at receiving server
    By techhelp in forum Installation
    Replies: 4
    Last Post: 03-19-2010, 11:09 PM
  3. Receiving spam email from myself
    By dougz in forum Administrators
    Replies: 6
    Last Post: 10-15-2009, 11:37 PM
  4. Users receiving copies of other user's spam?
    By thunder04 in forum Administrators
    Replies: 5
    Last Post: 07-30-2008, 12:50 AM
  5. Users receiving copies of other user's spam?
    By thunder04 in forum General Questions
    Replies: 4
    Last Post: 07-29-2008, 10:13 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •