Help filtering Spam - Still receiving spams after config spamassassin

[Phantro]

Hi there.

Sorry to ask for that, anyway for me using this spamassassin is something like "new" for me because i'm coming from cpanel.

Over cpanel, you just click in the options like this:
Enable Spamhaus? X yes / X no
Enable Spamcop? X yes / X no
Enable Spamxxxlist? X yes / X no
and so on..

I'm using vesta cp for maybe 20 days, and I'm receiving some spam emails.

Today I got 2 emails:

Code: Select all

Received: from mega.vcenter1.info ([93.190.139.54])

When I go to dnsstuff and ask for spamlist for this IP, its listed in a lot of lists:

Code: Select all

BARRACUDA	IP detected as	SPAM
SBL-ZEN	IP detected as	IP detected; no further information. Check site URL for more information
SORBS-DNSBL	IP detected as	SPAM
SORBS-SPAM	IP detected as	SPAM
SPAMHAUS SBL	IP detected as	IP detected; no further information. Check site URL for more information

Now the main question. How do I receive this type of emails, if sender is listed in a lot of spamlists?

If someone can help, ill be glad! Thank you for your time!

[dpeca]

Please copy a header of spam message.

[Phantro]

Wow, sorry, i have deleted this message.

Anyway, the line above with "From", is the most important part not?

Thank you for try to help!

[dpeca]

You can mask hostnames and email address, I just want to see spamassassin output from mail header...

[Phantro]

Sorry to don't reply before. I got some personal problems and then cant work at computer.

I'm back now and there is a LOT of messages like this.
Almost all messages has a zip file inside.
I have a lot of domains and all domains is receiving this type of emails:

Code: Select all

From - Tue Sep 06 09:42:29 2016
X-Account-Key: account1
X-UIDL: 000000ab57cbf275
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:                                                                                 
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Tue, 06 Sep 2016 13:37:04 +0100
Received: from dynamic-222.120.142.202.sitibroadband.in ([202.142.120.222])
	by srv.domain.tdl with esmtp (Exim 4.84_2)
	(envelope-from <[email protected]>)
	id 1bhFcc-0005Fr-1L
	for [email protected]; Tue, 06 Sep 2016 13:37:04 +0100
Content-type: multipart/mixed;
 boundary=Apple-Mail-15C5B8B593-85478-3E685A-C1075425-AAC704102C80483BB5A94
Content-transfer-encoding: 7bit
From: "Arnold casteltown" <[email protected]>
MIME-version: 1.0 (1.0)
Date: Tue, 06 Sep 2016 18:06:51 +0530
Subject: Invoice INV00005429
Message-id: <[email protected]>
To: [email protected]
X-Mailer: iPhone Mail (13G35)
X-Spam-Score: 29
X-Spam-Bar: ++
X-Spam-Report: Spam detection software, running on the system "srv.domain.tdl",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 @@CONTACT_ADDRESS@@ for details.
 
 Content preview:  Please find our invoice attached. [...] 
 
 Content analysis details:   (2.9 points, 5.0 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.2 CK_HELO_GENERIC        Relay used name indicative of a Dynamic Pool or
                             Generic rPTR
  1.6 RCVD_IN_BRBL_LASTEXT   RBL: No description available.
                            [202.142.120.222 listed in bb.barracudacentral.org]
  0.7 SPF_NEUTRAL            SPF: sender does not match SPF record (neutral)
  0.4 RDNS_DYNAMIC           Delivered to internal network by host with
                             dynamic-looking rDNS


--Apple-Mail-15C5B8B593-85478-3E685A-C1075425-AAC704102C80483BB5A94
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: 7bit

Please find our invoice attached.



--Apple-Mail-15C5B8B593-85478-3E685A-C1075425-AAC704102C80483BB5A94
Content-Type: text/x-moz-deleted; name="Deleted: Invoice_INV00005429.zip"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline; filename="Deleted: Invoice_INV00005429.zip"
X-Mozilla-Altered: AttachmentDeleted; date="Tue Sep 06 11:37:06 2016"

You deleted an attachment from this message. The original MIME headers for the attachment were:
Content-Type: application/zip;
	name=Invoice_INV00005429.zip;
	x-apple-part-url=E19DAE4-E3A0924-0490753E-E8BD998-7FEE344A56729028E
Content-Disposition: attachment;
	filename=Invoice_INV00005429.zip
Content-Transfer-Encoding: base64


--Apple-Mail-15C5B8B593-85478-3E685A-C1075425-AAC704102C80483BB5A94--

I have deleted zip file inside email.

Like our friend said above... "check all the blacklists" <--- No, its original installation from vestacp.
I'm gonna check this now. Anyway, as I remember, exim don't have this file with only exim.conf, it has so many config files, inside so many folders. What is the correct file to select blacklists?

Thank you for your time!

[Phantro]

Ok.

I have it fixed.

First problem:

1) When I restart the server, spamassassim is not starting with the server, then after restart I should go control panel and start in the "server" session.

2) For some IP's of that was not in the bl.spamcop.net and not in zen.spamhaus.org (exemple... I got 4 spams, 2 of then are not in that 2 lists. I just added to /etc/exim4/dnsbl.conf b.barracudacentral.org and cbl.abuseat.org.

No spams anymore.

Thank you for who tried to help, when XoXiLhJ0mn told: "did you configure exim.conf to check all blacklists", it is not over exim.conf but in dnsbl.conf, anyway he put my eyes there.

Thank you all guys!

I hope that topic can help other peoples with having the same problem.
For who is reading this as help, don't forget to take a look at this:
viewtopic.php?f=12&t=11953&p=46604

Debian 8.5 + VestaCP makes perfect install of apache, nginx and PhP 5.6 (by system default).

[dpeca]

1) When I restart the server, spamassassim is not starting with the server, then after restart I should go control panel and start in the "server" session.

That 'bug' I fixed last night... I think it's Debian bug.
I reported it as bug here - https://bugs.vestacp.com/issues/346
Here is the fix: https://github.com/serghey-rodin/vesta/ ... 6e95f15823

Existent Vesta servers can fix this bug by running:

Code: Select all

systemctl enable spamassassin

[Phantro]

Thank you... Fixed!