[postfix-users] massiver spam Anstieg

Christian Boltz postfix-users at cboltz.de
Fr Mai 22 00:06:10 CEST 2009

Hallo Patrick, hallo Leute,

Am Donnerstag, 21. Mai 2009 schrieb Patrick Ben Koetter:
> * Christian Boltz <postfix-users at de.postfix.org>:
> > # die folgende body-Regel (für Bounces) funktioniert leider nicht - warum?
> > body      CB_BODY_COMES_WITH_SPAMSCORE  /X-VA-Spam-Flag:[   ]*YES/i
> > describe  CB_BODY_COMES_WITH_SPAMSCORE  Contains X-VA-Spam-Flag: YES in body (bounce?)
> > score     CB_BODY_COMES_WITH_SPAMSCORE  0.001

> > Hat jemand eine Idee, warum meine body-Regel nicht greift? (Nein,
> > es liegt nicht an der geringen Punktzahl - die Regel trifft
> > wirklich nicht.)
> Du meinst die CB_BODY_COMES_WITH_SPAMSCORE-Regel? Weil
> "X-VA-Spam-Flag:" ein Header- und kein Body-Element ist?

Es geht mir in diesem Fall speziell um _Bounces_. Und da steht 
X-VA-Spam-Flag dann wirklich im Body.

Der komplette Bounce sieht dann folgendermaßen aus: (meine Mailadressen
sind maskiert)


Return-Path: <MAILER-DAEMON>
Delivered-To: main at cboltz.de
Received: from localhost (localhost [])
	by server.sprachakt.com (Postfix) with ESMTP id B55D8388229
	for <... at cboltz.de>; Tue, 19 May 2009 02:48:11 +0200 (CEST)
X-Virus-Scanned: amavisd-new at sprachakt.com
X-Spam-Flag: NO
X-Spam-Score: 4.291
X-Spam-Level: ****
X-Spam-Status: No, score=4.291 tagged_above=-999 required=7
	tests=[ALL_TRUSTED=-1.8, AWL=1.228, BAYES_50=0.001,
Received: from mail.cboltz.de ([])
	by localhost (mail.sprachakt.com []) (amavisd-new, port 10024)
	with ESMTP id sb3BpfM9EPjx for <... at cboltz.de>;
	Tue, 19 May 2009 02:48:05 +0200 (CEST)
X-Greylist: from auto-whitelisted by SQLgrey-1.6.8
Received: from mx.sourceforge.net (mx.sourceforge.net [])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client did not present a certificate)
	by mail.cboltz.de (Postfix) with ESMTPS
	for <... at cboltz.de>; Tue, 19 May 2009 02:48:05 +0200 (CEST)
Received: from exim by 3b2kzd1.ch3.sourceforge.com with local 
	(Exim 4.69)
	id 1M6DUy-0006Mx-Ot
	for USERNAME at users.sourceforge.net; Tue, 19 May 2009 00:48:04 +0000
X-Failed-Recipients: ... at cboltz.de
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon at sourceforge.net>
To: USERNAME at users.sourceforge.net
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1M6DUy-0006Mx-Ot at 3b2kzd1.ch3.sourceforge.com>
Date: Tue, 19 May 2009 00:48:04 +0000
Status: R
X-Status: NPC

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  ... at cboltz.de
    (generated from USERNAME at users.sourceforge.net)
    SMTP error from remote mail server after end of data:
    host mailtest.cboltz.de []: 554 5.7.0 Reject, id=06334-06 - SPAM

------ This is a copy of the message, including all the headers. ------

Return-path: <USERNAME at users.sourceforge.net>
Received: from []
	by 3b2kzd1.ch3.sourceforge.com with esmtp 
	(Exim 4.69)
	id 1M6DUK-0005me-Vm
	for USERNAME at users.sourceforge.net; Tue, 19 May 2009 00:47:58 +0000
Message-Id: <200905197492.3B24D4A59DE98A@[]>
From: "Sentz Seymour" <USERNAME at users.sourceforge.net>
To: USERNAME at users.sourceforge.net
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-Spam-Score: 17.9 (+++++++++++++++++)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
	See http://spamassassin.org/tag/ for more details.
	2.0 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
	[URIs: prolivate.ru]
	0.0 MISSING_DATE           Missing Date: header
	0.0 HTML_IMAGE_RATIO_08    BODY: HTML has a low ratio of text to image area
	0.0 HTML_MESSAGE           BODY: HTML included in message
	1.7 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
	1.5 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level
	above 50%
	[cf: 100]
	1.5 RAZOR2_CF_RANGE_E4_51_100 Razor2 gives engine 4 confidence level
	above 50%
	[cf: 100]
	2.0 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
	0.5 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%
	[cf: 100]
	0.5 RCVD_IN_PBL            RBL: Received via a relay in Spamhaus PBL
	[ listed in zen.spamhaus.org]
	2.9 RCVD_IN_XBL            RBL: Received via a relay in Spamhaus XBL
	2.0 URIBL_AB_SURBL         Contains an URL listed in the AB SURBL blocklist
	[URIs: prolivate.ru]
	0.5 URIBL_WS_SURBL         Contains an URL listed in the WS SURBL blocklist
	[URIs: prolivate.ru]
	2.9 URIBL_JP_SURBL         Contains an URL listed in the JP SURBL blocklist
	[URIs: prolivate.ru]
X-VA-Spam-Flag: YES
X-Spam-Flag: YES
X-Headers-End: 1M6DUK-0005me-Vm
Subject: [SPAM] Scientists' mass-suicide

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


Falls jemand einen Vorschlag für eine funktionierende SA-Regel hat -
immer her damit ;-)


Christian Boltz
[ Yes ] [ No ]
... used for harmless errors or simple questions: "It's high time you
had your cup of coffee! Would you like your KDE to prepare one for you?"
[Lukas Ocilka in opensuse-factory - YaST2 button styleguide]

Mehr Informationen über die Mailingliste postfix-users