Andy, > So this guy is trying to send email to us and it's getting caught. He > sent from 2 different addresses/domains. I found on the same day another > user from the second domain who was able to get through. I realize that > some of this is related to sa but the first one got caught by amavisd. > I guess I mainly want to know what he is doing to cause this.
> Nov 8 09:52:02 mta amavis[9479]: (09479-09) BAD HEADER from > <[EMAIL PROTECTED]>: Non-encoded 8-bit data (char D4 hex) in > message header 'Received': Received: ...nsintercon.gr > (10.0.2.3);\\n\\t > \\324\\361\\351, 08 \\315\\357\\335\\354\\342\\361\\351\\357... ISO 8859-7: Tau rho iota 08 Nu omicron eps mu beta rho iota omicron it looks like a Greek date in a non-encoded Greek character set in the Received header field. Both of which is violating RFC2822. > Second one: > > Nov 8 11:43:20 mta amavis[10237]: (10237-01) Checking: > <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]> > Nov 8 11:43:23 mta amavis[10237]: (10237-01) SPAM, > <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]>, Yes, > hits=6.15 tag=2 tag2=5 kill=5 tests=DATE_IN_FUTURE_06_12, > FORGED_MUA_IMS, MISSING_SUBJECT, MSGID_FROM_MTA_ID, X_PRIORITY_HIGH, > quarantine > spam/spam-4102a51e6602f0608564f41b00dbb3a6-20051108-114320-10237-01 To see how SA got to its conclusion, take a quarantined message and feed it into a command-line SA in test/debug mode: # su vscan -c 'spamassassin -t -D' \ </var/virusmails/spam/spam-4102a51e6602f0608564f41b00dbb3a6-20051108-114320-10237-01 Mark ------------------------------------------------------- SF.Net email is sponsored by: Tame your development challenges with Apache's Geronimo App Server. Download it for free - -and be entered to win a 42" plasma tv or your very own Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
