I have a couple of problems that had shown up about a month ago and now
are showing up again yesterday and today in our domain. Many of my
users are reporting quite a few duplicate emails and many are receiving
a great number of spam emails that they were not receiving before.
We are running Qmailtoaster 1.3 with spamassassin 3.1.5 running Perl
version 5.8.0 on a Redhat OS.
Most of the new spam is very raw adult sex spam emails some with
pictures in the body of the text. None of this type of spam was making
it through the filters until this recent incident and the incident a
month ago. Not only is the highly offensive spam making its way through
but there is a large increase in the overall number of spams that are
getting to the user mailboxes.
The duplicate emails tend to be for the most part from legitimate emails
the users normally see email from.
I have checked the disk space capacity on this server as that has been a
problem in the past but I do not see that as a problem currently. Here
are the usage numbers for this server:
Filesystem Size Used Avail Use% Mount on
/dev/sda7 1.5G 1.1G 356M 76% /
/dev/sda3 710M 48M 626M 8% /boot
none 501M 0 501M 0%
/dev/shm
/dev/sda9 496M 26M 445M 6% /tmp
/dev/sda5 16G 3.1G 12G 21% /usr
/dev/sda8 496M 238M 233M 51% /var
/dev/sda2 7.5G 5.3G 1.8G 75% /home
Below is the header information of one of the emails that was being
duplicated. Below that is the header and content of one of the spams
that this same user recieved. The spam email does not appear to have
any spamassassin score information in the header at all. Are these two
problems related? Is there some specific things with qmail or with
spamassassin I should be looking at for either or both of these issues?
I appreciate any input that can be offered to help resolve this problem.
Steve
Microsoft Mail Internet Headers Version 2.0
Received: from mxi.occa.state.ok.us ([172.16.255.12]) by
mxi2.occa.state.ok.us with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 2 Oct 2007 08:11:23 -0500
Received: from dellapp02.occa.state.ok.us ([204.87.111.225]) by
mxi.occa.state.ok.us with Microsoft SMTPSVC(5.0.2195.6713);
Tue, 2 Oct 2007 08:12:07 -0500
Received: (qmail 19008 invoked by uid 507); 2 Oct 2007 13:16:22
-0000
Received: by simscan 1.2.0 ppid: 18755, pid: 18756, t: 215.0297s
scanners: attach: 1.2.0 clamav: 0.88.4/m:40/d:2106
spam: 3.1.5
Received: from unknown (HELO smtp160.iad.emailsrvr.com)
(207.97.245.160)
by dellapp02.occa.state.ok.us with SMTP; 2 Oct 2007 13:12:47
-0000
Received-SPF: none (dellapp02.occa.state.ok.us: domain at
longwall.com does not designate permitted sender hosts)
Received: by relay6.relay.iad.emailsrvr.com (Authenticated
sender: dclemens-AT-longwall.com) with ESMTP id 3BB94661470;
Mon, 1 Oct 2007 11:11:53 -0400 (EDT)
Message-ID: <[EMAIL PROTECTED]>
Reply-To: "Dave Clemens" <[EMAIL PROTECTED]>
From: "Dave Clemens" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>,
<[EMAIL PROTECTED]>,
"Andi Holmes" <[EMAIL PROTECTED]>
Subject: Fw: Dressed in Black
Date: Mon, 1 Oct 2007 11:09:25 -0500
Organization: Longwall Associates, Inc.
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_037B_01C8041B.8717EF60"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3138
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 02 Oct 2007 13:12:07.0234 (UTC)
FILETIME=[D54FE220:01C804F5]
------=_NextPart_000_037B_01C8041B.8717EF60
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_000_037B_01C8041B.8717EF60
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
------=_NextPart_000_037B_01C8041B.8717EF60--
________________________________
Microsoft Mail Internet Headers Version 2.0
Received: from mxi.occa.state.ok.us ([172.16.255.12]) by
mxi2.occa.state.ok.us with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 2 Oct 2007 12:18:10 -0500
Received: from dellapp02.occa.state.ok.us ([204.87.111.225]) by
mxi.occa.state.ok.us with Microsoft SMTPSVC(5.0.2195.6713);
Tue, 2 Oct 2007 12:18:53 -0500
Received: (qmail 594 invoked by uid 507); 2 Oct 2007 17:23:08 -0000
Received: by simscan 1.2.0 ppid: 399, pid: 401, t: 214.9277s
scanners: attach: 1.2.0 clamav: 0.88.4/m:40/d:2106 spam: 3.1.5
Received: from unknown (HELO LC03.reefwalk.com) (216.188.169.48)
by dellapp02.occa.state.ok.us with SMTP; 2 Oct 2007 17:19:33 -0000
Received-SPF: softfail (dellapp02.occa.state.ok.us: transitioning SPF
record at planetstarpic.com does not designate 216.188.169.48 as
permitted sender)
Received: by LC03.reefwalk.com id h09uac07blkd for <[EMAIL PROTECTED]>;
Tue, 2 Oct 2007 10:15:10 -0700 (envelope-from
<[EMAIL PROTECTED]>)
Message-Id: <[EMAIL PROTECTED]>
Reply-To: <[EMAIL PROTECTED]>
From: BoostMyCreditNow <[EMAIL PROTECTED]>
Subject: Donna, Raise Your Credit Score Quickly and Legally
Date: Tue, 02 Oct 2007 18:15:34 GMT
X-Complaints-To: <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 02 Oct 2007 17:18:53.0703 (UTC)
FILETIME=[4EA7C170:01C80518]
-----Original Message-----
From: BoostMyCreditNow [mailto:[EMAIL PROTECTED]
<mailto:[EMAIL PROTECTED]> ]
Sent: Tuesday, October 02, 2007 1:16 PM
To: Donna Way
Subject: Donna, Raise Your Credit Score Quickly and Legally
Restore Your Credit Report Rating Quickly and Legally!
http://MBbejifafbmfeJL.planetstarpic.com/link.asp?a=c&u=58411513&e=14985
051
<http://mbbejifafbmfejl.planetstarpic.com/link.asp?a=c&u=58411513&e=1498
5051>
* Save tens of thousands of dollars off your home or car loan
* Get approved for new, low interest loans and credit cards
* Lower the finance charges on all your debt
We tell you the secrets the credit bureaus don't want you to know!
Learn More at:
http://MBbejifafbmfeJL.planetstarpic.com/link.asp?a=c&u=58411513&e=14985
051
<http://mbbejifafbmfejl.planetstarpic.com/link.asp?a=c&u=58411513&e=1498
5051>
-----------------------------------------------------------
If you would no longer like to receive ads from BMCN please click below:
http://MBbejifafbmfeJL.planetstarpic.com/link.asp?a=c&u=58411514&e=14985
051
<http://mbbejifafbmfejl.planetstarpic.com/link.asp?a=c&u=58411514&e=1498
5051>
Removal Requests, 716 N Ventura Rd #374, Oxnard, CA 93030-4404
If you think you received this email in error or would prefer not to
receive emails from us, click here:
http://MBbejifafbmfeJL.planetstarpic.com/link.asp?a=r&m=22199062&e=14985
051
<http://mbbejifafbmfejl.planetstarpic.com/link.asp?a=r&m=22199062&e=1498
5051>
Data Services List 5, 941 Orange Ave #207, Coronado, CA 92118
