exim левые письма

Garcia · Post by **Garcia** » Wed Jul 12, 2017 3:39 pm

недавно в почтовой очереди начали забиваться странные письма, например

1dVGhm-0007Yc-UQ-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  [email protected]
    (ultimately generated from [email protected])
    SMTP error from remote mail server after end of data:
    host gmail-smtp-in.l.google.com [64.233.191.27]:
    550-5.7.1 [1.2.3.4       7] Our system has detected that this message is
    550-5.7.1 likely unsolicited mail. To reduce the amount of spam sent to Gmail,
    550-5.7.1 this message has been blocked. Please visit
    550-5.7.1  https://support.google.com/mail/?p=UnsolicitedMessageError
    550 5.7.1  for more information. q7si2227627itc.102 - gsmtp

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from static.232.158.46.78.clients.your-server.de ([78.46.158.232] helo=mailer-daemon)
        by domain.com with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128)
        (Exim 4.82)
        (envelope-from <[email protected]>)
        id 1dVGhX-0007Uq-OB
        for [email protected]; Wed, 12 Jul 2017 15:25:16 +0300
Received: from [179.211.85.36] (helo=b3d35524.virtua.com.br)
        by mailer-daemon with smtp (Exim 4.80)
        (envelope-from <[email protected]>)
        id 1dVGhU-0004IJ-RH
        for [email protected]; Wed, 12 Jul 2017 14:25:06 +0200
Message-ID: <[email protected]>
From: "Trudy Kent" <[email protected]>
Subject: Don't slow your life down! Use Viagra Capsules.
To: [email protected]
Date: Wed, 12 Jul 2017 12:17:03 -0100
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="_av-2096603544953141"
X-Spam-Score: 76
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "domain.com",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 @@CONTACT_ADDRESS@@ for details.

 Content preview:  Don't slow your life down! Use Viagra Capsules. = A man can
    do more when he uses Viagra Super Active. Buy it in our online store and
   become Super Active! = The best price here! *SALE2017 *Use this code and get
    ADDITIONAL discount 5% for all our product.* [...]

 Content analysis details:   (7.6 points, 5.0 required)

  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: uploadhouse.com]
  1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                [Blocked - see <http://www.spamcop.net/bl.shtml?179.211.85.36>]
  0.8 RCVD_IN_SORBS_WEB      RBL: SORBS: sender is an abusable web server
                             [179.211.85.36 listed in dnsbl.sorbs.net]
  3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                             [score: 1.0000]
  0.0 FSL_HELO_NON_FQDN_1    No description available.
  0.0 T_HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                             domains are different
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76 chars
  2.0 DRUGS_ERECTILE         Refers to an erectile drug
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam (from [email protected] to [email protected]).

--_av-2096603544953141
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

в vestacp заведена почта [email protected], которая перенаправляет письма на [email protected], это просто спам или с моего сервера рассылают спам?

yariksat · Post by **yariksat** » Wed Jul 12, 2017 6:04 pm

Вам прислали письмо с рекламой Виагры от [email protected] к [email protected] в котором SpamAssassin распознал спам и прихлопнул его.И отослал на почту уведомление об этом.
Текст рекламы Виагры перевести? :)

Garcia · Post by **Garcia** » Wed Jul 12, 2017 7:05 pm

спасибо за ответ, переводить текст не надо :-)
как-то можно обезопасить себя от такого спама?

Garcia · Post by **Garcia** » Wed Jul 12, 2017 7:17 pm

вот например еще одно такое письмо

Code: Select all

1dVMGA-0001sf-DK-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  [email protected]
    (ultimately generated from [email protected])
    SMTP error from remote mail server after end of data:
    host gmail-smtp-in.l.google.com [64.233.191.27]:
    550-5.7.1 [1.2.3.4       7] Our system has detected that this message is
    550-5.7.1 likely unsolicited mail. To reduce the amount of spam sent to Gmail,
    550-5.7.1 this message has been blocked. Please visit
    550-5.7.1  https://support.google.com/mail/?p=UnsolicitedMessageError
    550 5.7.1  for more information. w194si3124440ith.57 - gsmtp

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from static.232.158.46.78.clients.your-server.de ([78.46.158.232] helo=mailer-daemon)
        by domain.com with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128)
        (Exim 4.82)
        (envelope-from <[email protected]>)
        id 1dVMG8-0001s8-3e
        for [email protected]; Wed, 12 Jul 2017 21:21:12 +0300
Received: from [187.181.148.112] (helo=bbb59470.virtua.com.br)
        by mailer-daemon with smtp (Exim 4.80)
        (envelope-from <[email protected]>)
        id 1dVMFy-0006fD-8m
        for [email protected]; Wed, 12 Jul 2017 20:21:10 +0200
Message-ID: <578393427940236-ZCRMAEHEGXRCBSCIPKNR@gzhfn.mailman.siteprotect.com>
From: "Tiffany Skinner" <[email protected]>
Subject: Re: Time for immodest proposals. Buy Viagra Soft now!
To: [email protected]
Date: Wed, 12 Jul 2017 22:17:00 +0300
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="_av-7813179968303522"
X-Spam-Score: 87
X-Spam-Bar: ++++++++
X-Spam-Report: Spam detection software, running on the system "domain.com",
 has identified this incoming email as possible spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 @@CONTACT_ADDRESS@@ for details.

 Content preview:  Time for immodest proposals. Buy Viagra Soft now! = No longer
    exciting nights? We know how to help with Viagra Super Active at our online
    shop! = Click Here To View! *SALE2017 *Use this code and get ADDITIONAL discount
    5% for all our product.* [...]

 Content analysis details:   (8.7 points, 5.0 required)

  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: wishing.com.tw]
  1.2 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
                             [URIs: wishing.com.tw]
  3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                             [score: 1.0000]
  0.6 DRUG_ED_ONLINE         BODY: Fast Viagra Delivery
  0.0 HK_RANDOM_ENVFROM      Envelope sender username looks random
  0.0 FSL_HELO_NON_FQDN_1    No description available.
  0.0 T_HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
                             domains are different
  1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
              [Blocked - see <http://www.spamcop.net/bl.shtml?187.181.148.112>]
  0.0 SPF_FAIL               SPF: sender does not match SPF record (fail)
 [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=zqvzvkwr%40axismg.com;ip=78.46.158.232;r=domain.com]
  0.0 HTML_MESSAGE           BODY: HTML included in message
  0.0 MIME_QP_LONG_LINE      RAW: Quoted-printable line longer than 76 chars
  2.0 DRUGS_ERECTILE         Refers to an erectile drug
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam (from [email protected] to [email protected]).

в логах

Code: Select all

2017-07-12 21:21:14 1dVMGA-0001sf-DK <= <> R=1dVMG8-0001s8-3e U=Debian-exim P=local S=45948
2017-07-12 21:21:55 1dVMGA-0001sf-DK ** [email protected] R=dnslookup T=remote_smtp: SMTP error from remote mail server after RCPT TO:<[email protected]>: host mail.axismg.com [23.239.15.169]: 550 No such person at this address"

и

Code: Select all

1dVMGA-0001sf-DK <> *** frozen ***

как же так получается?

yariksat · Post by **yariksat** » Thu Jul 13, 2017 3:52 am

Garcia wrote:как-то можно обезопасить себя от такого спама?

Застрелить всех спамеров :)

Vesta Control Panel - Forum