Dengan hormat,
Pak Syafril
Mohon analisanya terkait dengan email dari domain @jakarta.go.id yg
mengirim email kepada user kami terkait SIKM, tetapi user kami tidak
pernah submit SIKM dengan email yg digunakan, apakah ini termasuk email
phising? Jika ia dimana saya bisa meblocknya agar tidak masuk lagi.
Email ini sudah diterima oleh user sebanyak 3x
Berikut log smpt-in nya
Wed 2020-06-17 12:08:55.747: 01: ----------
Wed 2020-06-17 12:14:52.320: 05: [140259] Session 140259; child 0001
Wed 2020-06-17 12:14:52.320: 05: [140259] Accepting SMTP connection from
103.209.7.13:52477 to 103.101.224.40:25
Wed 2020-06-17 12:14:52.327: 03: [140259] --> 220 mail.thaplantation.com
ESMTP MDaemon 19.5.3; Wed, 17 Jun 2020 12:14:52 +0700
Wed 2020-06-17 12:14:52.363: 02: [140259] <-- EHLO mail.jakarta.go.id
Wed 2020-06-17 12:14:52.370: 03: [140259] --> 250-mail.thaplantation.com
Hello mail.jakarta.go.id [103.209.7.13], pleased to meet you
Wed 2020-06-17 12:14:52.370: 03: [140259] --> 250-ETRN
Wed 2020-06-17 12:14:52.370: 03: [140259] --> 250-AUTH LOGIN PLAIN
Wed 2020-06-17 12:14:52.370: 03: [140259] --> 250-8BITMIME
Wed 2020-06-17 12:14:52.370: 03: [140259] --> 250-ENHANCEDSTATUSCODES
Wed 2020-06-17 12:14:52.370: 03: [140259] --> 250 SIZE 36700160
Wed 2020-06-17 12:14:52.703: 02: [140259] <-- MAIL
FROM:<[email protected]> SIZE=1764
Wed 2020-06-17 12:14:52.721: 09: [140259] Performing SPF lookup
(mail.jakarta.go.id / 103.209.7.13)
Wed 2020-06-17 12:14:52.734: 09: [140259] * Policy: v=spf1 a mx
ip4:103.209.7.13 include:_spf.google.com ~all
Wed 2020-06-17 12:14:52.757: 09: [140259] * Evaluating a: match
Wed 2020-06-17 12:14:52.757: 09: [140259] * Result: pass
Wed 2020-06-17 12:14:52.757: 09: [140259] ---- End SPF results
Wed 2020-06-17 12:14:52.757: 09: [140259] Performing SPF lookup
(jakarta.go.id / 103.209.7.13)
Wed 2020-06-17 12:14:52.771: 09: [140259] * Policy: v=spf1
ip4:103.209.7.50 ip4:103.209.7.13 include:_spf.google.com ~all
Wed 2020-06-17 12:14:52.771: 09: [140259] * Evaluating
ip4:103.209.7.50: no match
Wed 2020-06-17 12:14:52.771: 09: [140259] * Evaluating
ip4:103.209.7.13: match
Wed 2020-06-17 12:14:52.771: 09: [140259] * Result: pass
Wed 2020-06-17 12:14:52.771: 09: [140259] ---- End SPF results
Wed 2020-06-17 12:14:52.771: 03: [140259] --> 250 2.1.0 Sender OK
Wed 2020-06-17 12:14:52.790: 02: [140259] <-- RCPT
TO:<[email protected]>
Wed 2020-06-17 12:14:52.798: 05: [140259] Performing DNS-BL lookup
(103.209.7.13 - connecting IP)
Wed 2020-06-17 12:14:52.817: 05: [140259] * zen.spamhaus.org - passed
Wed 2020-06-17 12:14:52.817: 05: [140259] ---- End DNS-BL results
Wed 2020-06-17 12:14:52.821: 03: [140259] --> 250 2.1.5 Recipient OK
Wed 2020-06-17 12:14:52.841: 02: [140259] <-- DATA
Wed 2020-06-17 12:14:52.842: 01: [140259] Creating temp file (SMTP):
d:\mdaemon\queues\temp\04\md50000000410.tmp
Wed 2020-06-17 12:14:52.845: 03: [140259] --> 354 Enter mail, end with
<CRLF>.<CRLF>
Wed 2020-06-17 12:14:52.934: 01: [140259] Message size: 3116 bytes
Wed 2020-06-17 12:14:52.935: 10: [140259] Performing DKIM lookup
Wed 2020-06-17 12:14:52.935: 10: [140259] * File:
d:\mdaemon\queues\temp\04\md50000000410.tmp
Wed 2020-06-17 12:14:52.935: 10: [140259] * Message-ID:
<[email protected]>
Wed 2020-06-17 12:14:52.935: 10: [140259] * Result: neutral
Wed 2020-06-17 12:14:52.935: 10: [140259] ---- End DKIM results
Wed 2020-06-17 12:14:53.173: 11: [140259] Passing message through
Outbreak Protection...
Wed 2020-06-17 12:14:53.173: 11: [140259] * Message-ID:
<[email protected]>
Wed 2020-06-17 12:14:53.173: 11: [140259] * Reference-ID:
str=0001.0A15020C.5EE9A6CD.0010:SCGSTAT2556160,ss=1,re=-4.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=1024
Wed 2020-06-17 12:14:53.173: 11: [140259] * Virus result: 0 - Clean
Wed 2020-06-17 12:14:53.173: 11: [140259] * Spam result: 1 - Clean
Wed 2020-06-17 12:14:53.173: 11: [140259] * IWF result: 0 - Clean
Wed 2020-06-17 12:14:53.173: 11: [140259] ---- End Outbreak Protection
results
Wed 2020-06-17 12:14:53.173: 07: [140259] Passing message through Spam
Filter (Size: 3116)...
Wed 2020-06-17 12:14:54.222: 07: [140259] * 0.5 FROM_LOCAL_NOVOWEL
From: localpart has series of non-vowel
Wed 2020-06-17 12:14:54.222: 07: [140259] * letters
Wed 2020-06-17 12:14:54.222: 07: [140259] * 0.0 HTML_MESSAGE BODY: HTML
included in message
Wed 2020-06-17 12:14:54.222: 07: [140259] * 0.0 HTML_FONT_LOW_CONTRAST
BODY: HTML font color similar or
Wed 2020-06-17 12:14:54.222: 07: [140259] * identical to background
Wed 2020-06-17 12:14:54.222: 07: [140259] * 0.1 MIME_HTML_ONLY BODY:
Message only has text/html MIME parts
Wed 2020-06-17 12:14:54.222: 07: [140259] * 0.6 HTML_MIME_NO_HTML_TAG
HTML-only message, but there is no HTML
Wed 2020-06-17 12:14:54.222: 07: [140259] * tag
Wed 2020-06-17 12:14:54.223: 07: [140259] * 1.3 RDNS_NONE Delivered to
internal network by a host with no rDNS
Wed 2020-06-17 12:14:54.223: 07: [140259] * 2.5 NORDNS_LOW_CONTRAST No
rDNS + hidden text
Wed 2020-06-17 12:14:54.223: 07: [140259] ---- End SpamAssassin results
Wed 2020-06-17 12:14:54.223: 07: [140259] Spam Filter score/req: 5.00/12.0
Wed 2020-06-17 12:14:54.264: 01: [140259] Message creation successful:
d:\mdaemon\queues\inbound\47\md50000001770.msg
Wed 2020-06-17 12:14:54.264: 03: [140259] --> 250 2.6.0 Ok, message
saved <Message-ID: <[email protected]>>
Wed 2020-06-17 12:14:59.278: 02: [140259] <-- QUIT
Wed 2020-06-17 12:14:59.278: 03: [140259] --> 221 2.0.0 See ya in cyberspace
Wed 2020-06-17 12:14:59.278: 01: [140259] SMTP session successful (Bytes
in/out: 3268/477)
Wed 2020-06-17 12:14:59.278: 01: ----------
--
--[mdaemon-l]----------------------------------------------------------
Milis ini untuk Diskusi antar pengguna MDaemon Mail Server di Indonesia
Netiket: https://wiki.openstack.org/wiki/MailingListEtiquette
Arsip: http://mdaemon-l.dutaint.com
Dokumentasi : http://mdaemon.dutaint.co.id
Berlangganan: Kirim mail ke [email protected]
Henti Langgan: Kirim mail ke [email protected]
Versi terakhir: MDaemon 20.0.0, SecurityGateway 6.5.2
