Am 20.05.2016 um 10:32 schrieb Reindl Harald:
Am 20.05.2016 um 08:31 schrieb Emin Akbulut:I tried to train SA with tons of spam messages which contains zip file (includes .js) The max spam score was lesser than 5 so I did set 4 to delete messsages. Then same kind of spam messages appear with the score of lesser than 2. In short; training the SA seems not helpful. What do you suggest to fight these spams? Raw message: http://pastebin.com/gPREh54Ljust get a proper clamav setup the real good question is why the hell that message does not get bayes classified at all here when pipe your download through spamc/spmad while other messages are also a good question is why your header don't contain a single DNSBL and if that happens all the time - without blacklists you have no good chances for proper reject (for the trolls - YES a FULL SETUP rejects) many junk
well, and another good question is why a mail listed on so many blacklists makes it to your contenfilter at all
get a proper MTA setup (containing a local dns-resolver doing recursion and NOT forwarding) and your inbound MX runs with zero load most of the time, facing a spam attack the last two days on a domain previously had 10000 valid rcpt triggering 150 rejects per minute and much more not pass the 12 sconds pregreet-phase, 100 Mhz loda on the VM running postfix/spamassassin/clamav hust because nothing of this crap makes it to a smtpd proess
postscreen_dnsbl_action = enforce postscreen_greet_action = enforce postscreen_dnsbl_sites = dnsbl.sorbs.net=127.0.0.10*9 dnsbl.sorbs.net=127.0.0.14*9 zen.spamhaus.org=127.0.0.[10;11]*8 dnsbl.sorbs.net=127.0.0.5*7 zen.spamhaus.org=127.0.0.[4..7]*7 b.barracudacentral.org=127.0.0.2*7 zen.spamhaus.org=127.0.0.3*7 dnsbl.inps.de=127.0.0.2*7 dnsbl.sorbs.net=127.0.0.7*4 hostkarma.junkemailfilter.com=127.0.0.2*4 bl.spamcop.net=127.0.0.2*4 bl.spameatingmonkey.net=127.0.0.[2;3]*4 dnsrbl.swinog.ch=127.0.0.3*4 ix.dnsbl.manitu.net=127.0.0.2*4 psbl.surriel.com=127.0.0.2*4 bl.mailspike.net=127.0.0.[10;11;12]*4 bl.mailspike.net=127.0.0.2*4 bl.spamcannibal.org=127.0.0.2*3 zen.spamhaus.org=127.0.0.2*3 score.senderscore.com=127.0.4.[0..20]*3 dnsbl.sorbs.net=127.0.0.6*3 dnsbl.sorbs.net=127.0.0.8*2 hostkarma.junkemailfilter.com=127.0.0.4*2 dnsbl.sorbs.net=127.0.0.9*2 dnsbl-1.uceprotect.net=127.0.0.2*2 all.spamrats.com=127.0.0.38*2 bl.nszones.com=127.0.0.[2;3]*1 dnsbl-2.uceprotect.net=127.0.0.2*1 dnsbl.sorbs.net=127.0.0.2*1 dnsbl.sorbs.net=127.0.0.4*1 score.senderscore.com=127.0.4.[0..69]*1 dnsbl.sorbs.net=127.0.0.3*1 hostkarma.junkemailfilter.com=127.0.1.2*1 dnsbl.sorbs.net=127.0.0.15*1 ips.backscatterer.org=127.0.0.2*1 bl.nszones.com=127.0.0.5*-1 score.senderscore.com=127.0.4.[90..100]*-1 wl.mailspike.net=127.0.0.[18;19;20]*-2 hostkarma.junkemailfilter.com=127.0.0.1*-2 ips.whitelisted.org=127.0.0.2*-2 list.dnswl.org=127.0.[0..255].0*-2 dnswl.inps.de=127.0.[0;1].[2..10]*-2 list.dnswl.org=127.0.[0..255].1*-3 list.dnswl.org=127.0.[0..255].2*-4 list.dnswl.org=127.0.[0..255].3*-5
X-Spam-Status: No, score=1.6 required=4.0 tests=BAYES_50,RDNS_NONE
autolearn=no autolearn_force=no version=3.4.1
_________________________________
/var/www/uploadtemp/5633d7b4bafd01d72635e8496c9a781a4efa94d8.eml:
Sanesecurity.Foxhole.Zip_fs223.UNOFFICIAL FOUND
/var/www/uploadtemp/5633d7b4bafd01d72635e8496c9a781a4efa94d8.eml:
Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL FOUND
----------- VIRUS-SCAN SUMMARY -----------
Infected files: 1
Time: 0.005 sec (0 m 0 s)
Content analysis details: (37.6 points, 5.5 required)
pts rule name description
---- ----------------------
--------------------------------------------------
4.5 CUST_DNSBL_10_SORBS_WEB RBL: dnsbl.sorbs.net (web.dnsbl.sorbs.net)
[213.252.170.66 listed in dnsbl.sorbs.net]
0.5 CUST_DNSBL_33_SORBS_VIRUS RBL: dnsbl.sorbs.net
(virus.dnsbl.sorbs.net)
1.5 CUST_DNSBL_20_SORBS_SPAM RBL: dnsbl.sorbs.net (spam.dnsbl.sorbs.net)
0.1 CUST_DNSBL_34_BACKSCATTER RBL: dnsbl-backscatterer.thelounge.net
(ips.backscatterer.org)
[213.252.170.66 listed in
dnsbl-backscatterer.thelounge.net]
3.5 CUST_DNSBL_11_JEF_BLACK RBL: hostkarma.junkemailfilter.com
[213.252.170.66 listed in
hostkarma.junkemailfilter.com]
1.0 CUST_DNSBL_24_UCE1 RBL: dnsbl-uce.thelounge.net
(dnsbl-1.uceprotect.net)
[213.252.170.66 listed in
dnsbl-uce.thelounge.net]
2.5 CUST_DNSBL_16_PSBL RBL: dnsbl-surriel.thelounge.net
(psbl.surriel.com)
[213.252.170.66 listed in
dnsbl-surriel.thelounge.net]
2.5 CUST_DNSBL_12_SPAMCOP RBL: bl.spamcop.net
[213.252.170.66 listed in bl.spamcop.net]
3.0 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
[213.252.170.66 listed in bl.mailspike.net]
5.5 CUST_DNSBL_6_ZEN_XBL RBL: zen.spamhaus.org (xbl.spamhaus.org)
[213.252.170.66 listed in zen.spamhaus.org]
1.5 CUST_DNSBL_19_SENDERSC_HIGH RBL: score.senderscore.com
(senderscore.com High)
[213.252.170.66 listed in
score.senderscore.com]
1.0 CUST_DNSBL_30_SENDERSC_MED RBL: score.senderscore.com
(senderscore.com Medium)
5.0 CUST_DNSBL_7_CUDA RBL: b.barracudacentral.org
[213.252.170.66 listed in
b.barracudacentral.org]
2.5 CUST_DNSBL_13_SEM RBL: bl.spameatingmonkey.net
[213.252.170.66 listed in
bl.spameatingmonkey.net]
2.5 RDNS_NONE Delivered to internal network by a host with
no rDNS
0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
0.5 HELO_MISC_IP Looking for more Dynamic IP Relays
signature.asc
Description: OpenPGP digital signature
