first received header forged

[Alex Handle <al...@funky.at>]

Hi,

recently i saw a lot of spam that didn't get catched by spamassassin.
All the messages have in common that the first received header ist forged.

Here an example:

Received: from 141.88.223.236 (HELO mx1.ihk.de)
     by mydomain.at with esmtp (08E71A-P)@7X K0'+V)
     id 76)4Y6-5>0O4:-+8
     for alex@mydomain.at; Mon, 4 Dec 2006 01:20:50 +0180
From: "Annmarie Esposito" <hy...@aachen.ihk.de>
To: <al...@mydomain.at>

They use the recipient domain (virtual domain on our mailcluster)
as the servername in the received line.

Is there a way to write a custom rule for this scenario?
I have set trusted and internal_networks to our public mailserver subnet.


Thanks!

Alex Handle

Re: first received header forged

[Matthias Leisi <ma...@leisi.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Alex Handle wrote:

> Received: from 141.88.223.236 (HELO mx1.ihk.de)
>      by mydomain.at with esmtp (08E71A-P)@7X K0'+V)
>      id 76)4Y6-5>0O4:-+8
>      for alex@mydomain.at; Mon, 4 Dec 2006 01:20:50 +0180
> [..]
>
> Is there a way to write a custom rule for this scenario?
> I have set trusted and internal_networks to our public mailserver subnet.

The following works for me (with the obvious replacement of the domain):

header ML_UPPERHELO_FAKE Received =~ /\(HELO .*by mydomain.at/

> 11'000 hits on overall 240'000 messages, no noticeable FP until now
(at least not that my users would have told me...).

- -- Matthias

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org

iD8DBQFFdVa4xbHw2nyi/okRAvkVAJ9yjcdHbHkgfmSDfbH/q5/jGJ3GxgCgjPUL
PXhiYIfOxkmhQoi+AyfijBA=
=1Jug
-----END PGP SIGNATURE-----

Re: first received header forged

[Loren Wilton <lw...@earthlink.net>]

> recently i saw a lot of spam that didn't get catched by spamassassin.
> All the messages have in common that the first received header ist forged.
>
> Here an example:
>
> Received: from 141.88.223.236 (HELO mx1.ihk.de)
>     by mydomain.at with esmtp (08E71A-P)@7X K0'+V)
>     id 76)4Y6-5>0O4:-+8
>     for alex@mydomain.at; Mon, 4 Dec 2006 01:20:50 +0180
> From: "Annmarie Esposito" <hy...@aachen.ihk.de>
> To: <al...@mydomain.at>
>
> They use the recipient domain (virtual domain on our mailcluster)
> as the servername in the received line.


You mean the "hi its me!" spams with headers like

Received: from 216.117.144.149 (HELO smtp.accadia.com)
     by earthlink.net with esmtp (0.U011UE BG391)
     id N6.'1.-2-26@J-ZC
     for lwitkowski2@earthlink.net; Tue, 5 Dec 2006 12:29:13 -0540

Around here those trigger

 2.8 RCVD_FORGED_WROTE      Forged 'Received' header found ('wrote:' spam)
 0.1 FORGED_RCVD_HELO       Received: contains a forged HELO

(This particular spam got 28 points between the above and a bunch of other 
rule hits.)

        Loren