Received a message with the following received header:
Received: from twitter.com (unknown [152.157.207.191])
by mail.covisp.net (Postfix) with ESMTP id 3D796118B753
for <[email protected]>; Mon, 22 Jun 2009 10:46:37 -0600 (MDT)
It was a virus payload containing a zip file with a .exe inside it
(made to look like a pdf).
I got another nearly identical one claiming to be from hallmark ecards
within a few minutes.
postfix/smtpd[31572]: 94E84118B80D: client=unknown[152.157.207.191]
postfix/cleanup[33547]: 94E84118B80D: message-id=<[email protected]
>
postfix/qmgr[1043]: 94E84118B80D: from=<[email protected]>,
size=684311, nrcpt=1 (queue active)
postfix/local[33558]: 94E84118B80D: to=<[email protected]>, orig_to=<[email protected]
>, relay=local, delay=70, delays=70/0/0/0.31, dsn=2.0.0, status=sent
(delivered to command: /usr/local/bin/procmail -t -a $EXTENSION)
postfix/qmgr[1043]: 94E84118B80D: removed
postfix/smtpd[32918]: 3D796118B753: client=unknown[152.157.207.191]
postfix/cleanup[33397]: 3D796118B753: message-id=<[email protected]
>
postfix/qmgr[1043]: 3D796118B753: from=<[email protected]>,
size=688383, nrcpt=1 (queue active)
postfix/local[33558]: 3D796118B753: to=<[email protected]>, orig_to=<[email protected]
>, relay=local, delay=65, delays=64/0.01/0/0.44, dsn=2.0.0,
status=sent (delivered to command: /usr/local/bin/procmail -t -a
$EXTENSION)
postfix/qmgr[1043]: 3D796118B753: removed
I know they aren't hitting the various unknown checks because they are
claiming a valid looking name in the EHLO, but is there something I
can do to drop these at the transaction phase? I searched my mailspool
for all the IDs for "client=unknown" and then searched the maillog for
those IDs grepping on the 'from=' line, printing them out and sorting
them. I don't see anything in the maillogs for the last 31 days that
is a legitimate email.
Is there anyway to, if not outright reject anyone whose DNS shows up
as unknown to at least tempfail them with a "Ooops, your DNS is not
resolving, try back later" or something?
Seems at least half the spam that gets by zen shows up as client=unknown
--
Ah we're lonely, we're romantic / and the cider's laced with acid /
and the Holy Spirit's crying, Where's the beef? / And the moon
is swimming naked / and the summer night is fragrant /
with a mighty expectation of relief
