Russian Spam

1. offizieller Beitrag

    Hallo, in letzter Zeit bekomme ich SPAM mit Kyrillischem Zeichensatz. Beispiel: Return-Path: Received: from static.vdc.vn (222.253.30.207) by knecht (Axigen) with ESMTP id 169214; Wed, 13 Oct 2010 09:10:23 +0200 Received: from [181.166.2.177] (helo=cgyvzbiuqszju.ubywpxqmhg.net) by static.vdc.vn with esmtpa (Exim 4.69) (envelope-from ) id 1MM90X-9520va-81 for xxx@yyy.zz; Wed, 13 Oct 2010 14:10:23 +0700 From: =?koi8-r?B?IvPF0sXWwSD3xdPFzM/XIg==?= To: xxx@yyy.zz Subject: =?koi8-r?B?0NLFxNLFytPP19nKIM/Tz/U0iDOwSDXwdvFyiDUxdLSydTP0snJ?= Date: Wed, 13 Oct 2010 14:10:23 +0700 MIME-Version: 1.0 Content-Type: text/plain; charset="koi8-r" Content-Transfer-Encoding: 8bit X-Mailer: tdeuo_08 Message-ID: X-AxigenVirus-Level: 1 X-AxigenSpam-Level: 7 ���������� ������ ����������� ����� � �������������� ���������������� �� ���������� ������������ � ������������� �������� ��������� ������������ �������. ���������� �������� �������� ��� �� ���������� ���������, ��� � � ����������� ������ ������������� � ������� ����� "���������", "�����������" ���� ��� �������������� ���� �����������, �� ������ ��������� � ���� �� ��������:8-903-578-28-95 ��. �����: predreisosmotr@yandex.ru Skype: gureva_vlada Kann mir bitte jemand dabei helfen einen Filter dafür zu erstellen? Danke Gerd

    • Offizieller Beitrag

    AXIGEN bietet keine "1-Klick-Lösung" für dieses Problem. Möglich wäre:


    a) der von Ihnen eingesetzte Spamfilter bietet eine solche Option?


    b) Sperren der IP-Adressen aus Ostblock-Ländern:
    Security & Filtering => Additional AntiSpam Methods => Country Filtering


    c) Filtern des Inhalts => Security & Filtering => Incoming Message Rules =>
    Body => Contains => Hier könnte man versuchen, ein Kriterium, wie z.B.
    charset="koi8-r" zu finden.

    Ich habe unter der betroffenen Domain bei Account Defaults - Message Filters das hier eingetragen:



    Aber das funktioniert nicht. Keine Mail mit Kyrillischem Inhalt wird abgewiesen.


    Falscher Ort oder falscher Inhalt?


    Gerd

    Sorry,


    hier die Inhalt beider Zeilen:


    ((?i)charset=("){0,1}.*((windows-1251)|(koi8-r)|(2022-jp)))
    ((?i)subject:.*koi8-r)


    Die Regel basiert auf Body Text.


    Gerd

    Ich kann nicht erkennen, ob überhaupt ein Filter gefragt wird:


    Mein Filter trägt den Namen: russian-spam


    Eingetragen hab ich den unter Security & Filtering => Incoming Message Rules =>
    Body => Contains =>


    PROCESSING:000C8F12: Shepherd thread received signal for processing
    PROCESSING:000C8F12: Start processing mail
    PROCESSING:000C8F12: Start filter AV:AVG of type socket filter from server
    PROCESSING:000C8F12: Shepherd thread finished processing signal
    PROCESSING:000C8F12: << 220-AVG daemon mode scanner (AVG)
    PROCESSING:000C8F12: << 220-Program version 8.5.855
    PROCESSING:000C8F12: << 220-Virus Database: Version 271.1.1/3194 2010-10-13
    PROCESSING:000C8F12: << 220 Ready
    PROCESSING:000C8F12: >> SCAN
    PROCESSING:000C8F12: >> /var/opt/axigen/queue/0C/D8F12.00
    PROCESSING:000C8F12: << 200 ok
    PROCESSING:000C8F12: Filter AVG AntiVirus Filter(127.0.0.1:55555):[PASS]: ok
    PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: AV:AVG of type socket filter from server
    PROCESSING:000C8F12: Start filter ClamAV-local of type socket filter from server
    PROCESSING:000C8F12: >> SCAN
    PROCESSING:000C8F12: >> /var/opt/axigen/queue/0C/D8F12.00
    PROCESSING:000C8F12: << /var/opt/axigen/queue/0C/D8F12.00: OK
    PROCESSING:000C8F12: Filter ClamAV(/var/run/clamav/clamd.ctl):[PASS]: OK
    PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: ClamAV-local of type socket filter from server
    PROCESSING:000C8F12: Start filter AV:SpamAssassinBundled of type socket filter from server
    PROCESSING:000C8F12: >> CHECK SPAMC/1.2
    PROCESSING:000C8F12: >> Content-length:
    PROCESSING:000C8F12: >> 1098
    PROCESSING:000C8F12: >>
    PROCESSING:000C8F12: >> Send mail stream: 0C8F12
    PROCESSING:000C8F12: << SPAMD/1.1 0 EX_OK
    PROCESSING:000C8F12: << Spam: True ; 9.3 / 5.0
    PROCESSING:000C8F12: Filter SpamAssassin Filter(127.0.0.1:1987):[MATCH(P)]: Spam: True ; 9.3 / 5.0
    PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: AV:SpamAssassinBundled of type socket filter from server
    PROCESSING:000C8F12: Start filter WASieveServer of type script filter from server
    PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: WASieveServer of type script filter from server
    PROCESSING:000C8F12: Start filter WASieveAccountDefault of type script filter from domain object <user@domain.tld>
    PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: WASieveAccountDefault of type script filter from domain object <user@domain.tld>
    PROCESSING:000C8F12: Start filter wmFilter of type script filter from domain object <user@domain.tld>
    PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: wmFilter of type script filter from domain object <user@domain.tld>
    PROCESSING:000C8F12: Finish processing mail
    PROCESSING:000C8F12: Shepherd thread received signal for delivery
    PROCESSING:000C8F12: Shepherd thread finished processing signal
    PROCESSING:000C8F12: Start mail delivery
    PROCESSING:000C8F12: Mail delivered to mailbox 'SPAM' of <user@domain.tld> with id 8256
    PROCESSING:000C8F12: Shepherd thread received signal for cleanup
    PROCESSING:000C8F12: Start mail cleanup
    PROCESSING:000C8F12: Mail removed from queue
    PROCESSING:000C8F12: Shepherd thread finished processing signal

    • Offizieller Beitrag

    Ja, sie wurde durchlaufen:


    PROCESSING:000C8F12: Start filter WASieveAccountDefault of type script filter from domain object <user@domain.tld>
    PROCESSING:000C8F12: Finished filtering mail object 0C8F12 with filter: WASieveAccountDefault of type script filter from domain object <user@domain.tld>


    Die Filter sind Sieve-Filter und wenn die Regel unter den Account-Details der Domain domain.tld angelegt wurde, wurde sie geprüft.