analogic / MailServer / issues / #106 - Spam

SH repo owner

What type of spam is it? Is it simple text with zip attachment with only one Javascript file?

2016-08-08T11:51:56+00:00

André Schmidt reporter

Simple HTML. Sometime with zip and sometimes without.

Received-SPF: none (fuer-de.com: No applicable sender policy available) receiver=ca2af2a014f5; identity=mailfrom; envelope-from="antwort@fuer-de.com"; helo=s2.fuer-de.com; client-ip=185.145.232.132
Subject: Online-Einschreiben v. Samstag 06.08.2016 [#297.DD58.44126]
To: "Kunden-Nr. E-186243" <a.schmidt@intelligyscience.de>
From: "E-Post DE" <antwort@fuer-de.com>
Reply-To: <antwort@fuer-de.com>
Date: Sat, 06 Aug 2016 18:22:00 +0200
Message-Id: <ccac575c704374160c0cea0a9403d19c@localhost>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="iso-8859-1"

<html>
<head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3Diso=
-8859-1" />
    <title>Online-Einschreiben v. Samstag 06.08.2016 [#297.DD58.44126]</title>
</head>
<body>
<p><span style=3D"font-family:arial,helvetica,sans-serif">Sehr geehrte(r) &=
nbsp;Kunden-Nr. E-186243,</span></p>

<p><span style=3D"font-family:arial,helvetica,sans-serif">Sie erhalten folg=
endes Online-Einschreiben mit der Bitte um sofortigen Abruf:</span></p>

<table border=3D"2" cellpadding=3D"1" cellspacing=3D"1" style=3D"height:125=
px; width:545px">
=09
        <tr>
            <td><span style=3D"font-family:arial,helvetica,sans-serif"><strong>Absen=
der:</strong></span></td>
            <td><span style=3D"font-family:arial">Rechtsanwalt Maximilian Wagenbauer=
</span></td>
        </tr>
        <tr>
            <td><span style=3D"font-family:arial,helvetica,sans-serif"><strong>Betre=
ff:</strong></span></td>
            <td><span style=3D"font-family:arial,helvetica,sans-serif">Auszahlung am=
 08.08.2016</span></td>
        </tr>
        <tr>
            <td><span style=3D"font-family:arial,helvetica,sans-serif"><strong>Onlin=
e-Ansicht:</strong></span></td>
            <td><span style=3D"font-family:arial,helvetica,sans-serif"><a href=3D"ht=
tp://www.fuer-de.com/go/link.php?link=3D01_02_04_336_1_3949-3A-01-5FD14D389=
8F761503679B5A54461040A-4893872D4CA8E02F122&offer_id=3D277&amp;aff_id=3D502=
9">Hier klicken</a> ( Ablaufdatum 07.08.2016 )</span></td>
        </tr>
        <tr>
            <td><span style=3D"font-family:arial,helvetica,sans-serif"><strong>Viren=
-Pr&uuml;fung:</strong></span></td>
            <td><span style=3D"font-family:arial,helvetica,sans-serif"><span style=
=3D"background-color:#33ff99">Erfolgreich, keine Viren</span></span></td>
        </tr>
=09
</table>

<p><span style=3D"font-family:arial,helvetica,sans-serif">Mit freundlichen =
Gr&uuml;&szlig;en, </span></p>

<p><span style=3D"font-family:arial,helvetica,sans-serif">Ihre Post</span><=
/p>

<p>&nbsp;</p>

<p>&nbsp;</p>

<p>&nbsp;</p>

<p>&nbsp;</p>

<div>
<div>
<div>
<div><span style=3D"color:#646464; font-family:arial,helvetica,sans-serif; =
font-size:10px">Das Angebot ist eine kommerzielle Anzeige dieses Werbekunde=
n, der allein f&uuml;r den Inhalt verantwortlich ist.</span></div>

<div><span style=3D"color:#646464; font-family:arial,helvetica,sans-serif; =
font-size:10px">Sollten Sie zuk&uuml;nftig keine exklusiven Mitteilungen me=
hr von uns erhalten wollen, klicken Sie bitte <a href=3D"http://www.fuer-de=
=2Ecom/go/nlu.php?key=3D3949-3A-01-5FD14D3898F761503679B5A54461040A-4893872=
D4CA8E02F122&rid=3D01_02_04_336">hier</a>.</span></div>

<div><span style=3D"color:#646464; font-family:arial,helvetica,sans-serif; =
font-size:10px">Gem&auml;&szlig; aktueller Datenschutzgesetzte wird Ihre E-=
Mail Adresse bei Klick auf <a href=3D"http://www.fuer-de.com/go/nlu.php?key=
=3D3949-3A-01-5FD14D3898F761503679B5A54461040A-4893872D4CA8E02F122&rid=3D01=
_02_04_336">diesen Link</a> dauerhaft gel&ouml;scht.</span></div>
</div>
</div>
</div>
<img src=3D"http://www.fuer-de.com/go/ostat.php?link=3D01_02_04_336_3949-3A=
-01-5FD14D3898F761503679B5A54461040A-4893872D4CA8E02F122" border=3D"0" styl=
e=3D"width:1px;height:1px" /></body>
</html>

2016-08-08T12:02:46+00:00

n1try NA

I would appreciate the possibility to modify spamassassin config files, too. Similar to @IntelligyScience I receive quite a lot of spam that is only ranked with a score of around 1.5, all from the same sender and with the same subject. I wanted to install and configure the WhiteListSubjectPlugin, but there's no way to do so.

EDIT: Just discovered the option to configure the sieve. This pretty much solves my problems, so never mind.

2016-08-16T06:06:07+00:00

SH repo owner

There are two possibilities how modify configs in container: 1. use _override folder in your data directory - create directories with target file - it will overwrite it when container starts 2. extend docker image

2016-08-30T07:53:01+00:00

SH repo owner

changed status to resolved

For extending config please see: https://poste.io/doc/extending-mailserver

I am tuning spam filtering almost every rls, so i am closing this ticket as it is not specific issue which can be somehow solved. Please open new ticket if you would like to...

2016-10-01T12:45:50+00:00

Comments (5)