You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rick Gutierrez <xs...@gmail.com> on 2018/11/27 16:42:18 UTC
spoofing mail
Hi , I have a situation a little complicated, I have emails from
spammers that come with the name of one of my users, but the email
address is not from my domain , they send it from a valid domain,
which complies with spf, DKIM etc etc, some idea that could help me to
adjust my spamassassin and stop this kind of post, someone has had
experience in this type of evasion?
my user is lvelasquez
attached the trace
Nov 27 03:21:07 scmspam postfix/smtpd[30321]: warning: hostname
cloud.casasponty.com does not resolve to address 206.189.74.145: Name
or service not known
Nov 27 03:21:07 scmspam postfix/smtpd[30321]: connect from
unknown[206.189.74.145]
Nov 27 03:21:07 scmspam policyd-spf[30325]: None; identity=helo;
client-ip=206.189.74.145; helo=cloud.casasponty.com;
envelope-from=achaire@casasponty.com; receiver=lvelasquez@mydomain.com
Nov 27 03:21:07 scmspam policyd-spf[30325]: Pass; identity=mailfrom;
client-ip=206.189.74.145; helo=cloud.casasponty.com;
envelope-from=achaire@casasponty.com; receiver=lvelasquez@mydomain.com
Nov 27 03:21:07 scmspam postfix/smtpd[30322]: warning: hostname
cloud.casasponty.com does not resolve to address 206.189.74.145: Name
or service not known
Nov 27 03:21:07 scmspam postfix/smtpd[30322]: connect from
unknown[206.189.74.145]
Nov 27 03:21:07 scmspam policyd-spf[30326]: None; identity=helo;
client-ip=206.189.74.145; helo=cloud.casasponty.com;
envelope-from=achaire@casasponty.com; receiver=yruiz@mydomain.com
Nov 27 03:21:07 scmspam policyd-spf[30326]: Pass; identity=mailfrom;
client-ip=206.189.74.145; helo=cloud.casasponty.com;
envelope-from=achaire@casasponty.com; receiver=yruiz@mydomain.com
Nov 27 03:21:08 scmspam postfix/smtpd[30321]: 2D19A1089D:
client=unknown[206.189.74.145]
Nov 27 03:21:08 scmspam postfix/smtpd[30322]: 32F15108A7:
client=unknown[206.189.74.145]
Nov 27 03:21:08 scmspam postfix/cleanup[30327]: 2D19A1089D:
message-id=<18...@mydomain.com>
Nov 27 03:21:08 scmspam postfix/cleanup[30351]: 32F15108A7:
message-id=<40...@mydomain.com>
Nov 27 03:21:08 scmspam postfix/qmgr[24718]: 2D19A1089D:
from=<ac...@casasponty.com>, size=127129, nrcpt=1 (queue active)
Nov 27 03:21:08 scmspam amavis[30276]: (30276-05)
LMTP:[127.0.0.1]:10024
/var/amavis/tmp/amavis-20181127T031602-30276-giUj8Gm1:
<ac...@casasponty.com> -> <lv...@mydomain.com> SIZE=127129
Received: from scmspam.mydomain.com ([127.0.0.1]) by localhost
(scmspam.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP
for <lv...@mydomain.com>; Tue, 27 Nov 2018 03:21:08 -0600 (CST)
Nov 27 03:21:08 scmspam postfix/qmgr[24718]: 32F15108A7:
from=<ac...@casasponty.com>, size=127113, nrcpt=1 (queue active)
Nov 27 03:21:08 scmspam postfix/smtpd[30321]: disconnect from
unknown[206.189.74.145] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Nov 27 03:21:08 scmspam amavis[30291]: (30291-04)
LMTP:[127.0.0.1]:10024
/var/amavis/tmp/amavis-20181127T031805-30291-C1blwKk0:
<ac...@casasponty.com> -> <yr...@mydomain.com> SIZE=127113 Received:
from scmspam.mydomain.com ([127.0.0.1]) by localhost
(scmspam.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP
for <yr...@mydomain.com>; Tue, 27 Nov 2018 03:21:08 -0600 (CST)
Nov 27 03:21:08 scmspam postfix/smtpd[30322]: disconnect from
unknown[206.189.74.145] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Nov 27 03:21:08 scmspam amavis[30276]: (30276-05) dkim: VALID
Author+Sender+MailFrom signature by d=casasponty.com, From:
<ac...@casasponty.com>, a=rsa-sha256, c=relaxed/relaxed, s=default,
i=@casasponty.com
Nov 27 03:21:08 scmspam amavis[30276]: (30276-05) Checking:
1SgjFC6nhGVK [206.189.74.145] <ac...@casasponty.com> ->
<lv...@mydomain.com>
Nov 27 03:21:08 scmspam amavis[30291]: (30291-04) dkim: VALID
Author+Sender+MailFrom signature by d=casasponty.com, From:
<ac...@casasponty.com>, a=rsa-sha256, c=relaxed/relaxed, s=default,
i=@casasponty.com
Nov 27 03:21:08 scmspam amavis[30276]: (30276-05) p003 1 Content-Type:
multipart/mixed
Nov 27 03:21:08 scmspam amavis[30276]: (30276-05) p001 1/1
Content-Type: text/plain, size: 162 B, name:
Nov 27 03:21:08 scmspam amavis[30291]: (30291-04) Checking:
22udI1Q-h9lr [206.189.74.145] <ac...@casasponty.com> ->
<yr...@mydomain.com>
Nov 27 03:21:08 scmspam amavis[30276]: (30276-05) p002 1/2
Content-Type: application/msword, size: 90752 B, name: Contrato.doc
Nov 27 03:21:08 scmspam amavis[30291]: (30291-04) p003 1 Content-Type:
multipart/mixed
Nov 27 03:21:08 scmspam amavis[30291]: (30291-04) p001 1/1
Content-Type: text/plain, size: 162 B, name:
Nov 27 03:21:08 scmspam amavis[30291]: (30291-04) p002 1/2
Content-Type: application/msword, size: 90752 B, name: Contrato.doc
Nov 27 03:21:10 scmspam amavis[30291]: (30291-04) spam-tag,
<ac...@casasponty.com> -> <yr...@mydomain.com>, No, score=4.673
tagged_above=-990 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, RDNS_NONE=1.274, RELAYCOUNTRY_PK=3,
RELAYCOUNTRY_US=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Nov 27 03:21:10 scmspam postfix/smtpd[30334]: connect from localhost[127.0.0.1]
Nov 27 03:21:10 scmspam postfix/smtpd[30334]: B9B79108A8:
client=localhost[127.0.0.1]
Nov 27 03:21:10 scmspam postfix/cleanup[30327]: B9B79108A8:
message-id=<40...@mydomain.com>
Nov 27 03:21:10 scmspam amavis[30276]: (30276-05) spam-tag,
<ac...@casasponty.com> -> <lv...@mydomain.com>, No, score=4.673
tagged_above=-990 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, RDNS_NONE=1.274, RELAYCOUNTRY_PK=3,
RELAYCOUNTRY_US=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Nov 27 03:21:10 scmspam postfix/smtpd[30257]: connect from localhost[127.0.0.1]
Nov 27 03:21:10 scmspam postfix/smtpd[30257]: BF820108A9:
client=localhost[127.0.0.1]
Nov 27 03:21:10 scmspam postfix/smtpd[30334]: connect from localhost[127.0.0.1]
Nov 27 03:21:10 scmspam amavis[30276]: (30276-05) spam-tag,
<ac...@casasponty.com> -> <lv...@mydomain.com>, No, score=4.673
tagged_above=-990 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, RDNS_NONE=1.274, RELAYCOUNTRY_PK=3,
RELAYCOUNTRY_US=0.5, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Nov 27 03:21:10 scmspam postfix/smtpd[30257]: connect from localhost[127.0.0.1]
Nov 27 03:21:10 scmspam postfix/smtpd[30257]: BF820108A9:
client=localhost[127.0.0.1]
Nov 27 03:21:10 scmspam postfix/cleanup[30351]: BF820108A9:
message-id=<18...@mydomain.com>
Nov 27 03:21:10 scmspam postfix/qmgr[24718]: B9B79108A8:
from=<ac...@casasponty.com>, size=127970, nrcpt=1 (queue active)
Nov 27 03:21:10 scmspam postfix/smtpd[30334]: disconnect from
localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Nov 27 03:21:10 scmspam amavis[30291]: (30291-04) FWD from
<ac...@casasponty.com> -> <yr...@mydomain.com>,BODY=7BIT 250 2.0.0
from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as B9B79108A8
Nov 27 03:21:10 scmspam amavis[30291]: (30291-04) Passed CLEAN
{RelayedInbound}, [206.189.74.145]:50856 [117.20.31.98]
<ac...@casasponty.com> -> <yr...@mydomain.com>, Queue-ID:
32F15108A7, Message-ID:
<40...@mydomain.com>, mail_id:
22udI1Q-h9lr, Hits: 4.673, size: 127112, queued_as: B9B79108A8,
dkim_sd=default:casasponty.com, 2342 ms
Nov 27 03:21:10 scmspam amavis[30291]: (30291-04) TIMING-SA total 854
ms - parse: 18 (2.1%), extract_message_metadata: 62 (7.3%),
get_uri_detail_list: 4.2 (0.5%), tests_pri_-1000: 106 (12.5%),
tests_pri_-950: 4.5 (0.5%), tests_pri_-900: 2.1 (0.3%), tests_pri_-90:
4.3 (0.5%), tests_pri_0: 210 (24.6%), check_spf: 9 (1.1%),
poll_dns_idle: 5 (0.6%), tests_pri_20: 201 (23.6%), check_razor2: 200
(23.4%), tests_pri_30: 210 (24.7%), check_pyzor: 209 (24.5%),
tests_pri_500: 7 (0.8%), get_report: 0.47 (0.1%)
Nov 27 03:21:10 scmspam postfix/lmtp[30328]: 32F15108A7:
to=<yr...@mydomain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=2.9,
delays=0.55/0/0/2.3, dsn=2.0.0, status=sent (250 2.0.0 from
MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as B9B79108A8)
Nov 27 03:21:10 scmspam amavis[30291]: (30291-04) size: 127112, TIMING
[total 2352 ms] - SMTP greeting: 2 (0%)0, SMTP LHLO: 0 (0%)0, SMTP
pre-MAIL: 0 (0%)0, lookup_sql: 2 (0%)0, SMTP pre-DATA-flush: 1 (0%)0,
SMTP DATA: 82 (3%)4, check_init: 1 (0%)4, digest_hdr: 13 (1%)4,
digest_body_dkim: 24 (1%)5, gen_mail_id: 10 (0%)6, mime_decode: 38
(2%)7, get-file-type2: 28 (1%)9, parts_decode: 0 (0%)9, check_header:
1 (0%)9, AV-scan-1: 1193 (51%)59, spam-wb-list: 1 (0%)59, SA msg read:
1 (0%)59, SA parse: 18 (1%)60, SA check: 834 (35%)96, lookup_sql: 10
(0%)96, penpals_check: 9 (0%)96, decide_mail_destiny: 1 (0%)96,
notif-quar: 4 (0%)97, fwd-connect: 9 (0%)97, fwd-mail-pip: 2 (0%)97,
fwd-rcpt-pip: 0 (0%)97, fwd-data-chkpnt: 0 (0%)97, write-header: 1
(0%)97, fwd-data-contents: 7 (0%)97, fwd-end-chkpnt: 48 (2%)99,
prepare-dsn: 1 (0%)99, main_log_entry: 5 (0%)100, sql-update: 5
(0%)100, update_snmp: 2 (0%)100, SMTP pre-response: 1 (0%)100, SMTP
response: 0 (0%)100, unlink-3-files: 1 (0%)100, rundown: 1 (0%)100
Nov 27 03:21:10 scmspam postfix/qmgr[24718]: BF820108A9:
from=<ac...@casasponty.com>, size=127996, nrcpt=1 (queue active)
Nov 27 03:21:10 scmspam postfix/smtpd[30257]: disconnect from
localhost[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Nov 27 03:21:10 scmspam amavis[30276]: (30276-05) FWD from
<ac...@casasponty.com> -> <lv...@mydomain.com>,BODY=7BIT 250
2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as
BF820108A9
Nov 27 03:21:10 scmspam postfix/qmgr[24718]: 32F15108A7: removed
Nov 27 03:21:10 scmspam amavis[30276]: (30276-05) Passed CLEAN
{RelayedInbound}, [206.189.74.145]:50850 [117.20.31.98]
<ac...@casasponty.com> -> <lv...@mydomain.com>, Queue-ID:
2D19A1089D, Message-ID:
<18...@mydomain.com>, mail_id:
1SgjFC6nhGVK, Hits: 4.673, size: 127128, queued_as: BF820108A9,
dkim_sd=default:casasponty.com, 2416 ms
Nov 27 03:21:10 scmspam amavis[30276]: (30276-05) TIMING-SA total 894
ms - parse: 15 (1.7%), extract_message_metadata: 59 (6.5%),
get_uri_detail_list: 0.71 (0.1%), tests_pri_-1000: 107 (12.0%),
tests_pri_-950: 4.5 (0.5%), tests_pri_-900: 2.4 (0.3%), tests_pri_-90:
4.3 (0.5%), tests_pri_0: 212 (23.8%), check_spf: 7 (0.8%),
poll_dns_idle: 0.67 (0.1%), tests_pri_20: 225 (25.2%), check_razor2:
220 (24.6%), tests_pri_30: 213 (23.8%), check_pyzor: 211 (23.6%),
tests_pri_500: 10 (1.2%), get_report: 0.49 (0.1%)
Nov 27 03:21:10 scmspam postfix/lmtp[30331]: 2D19A1089D:
to=<lv...@mydomain.com>, relay=127.0.0.1[127.0.0.1]:10024,
delay=3.3, delays=0.89/0/0/2.4, dsn=2.0.0, status=sent (250 2.0.0 from
MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as BF820108A9)
regards.
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El mar., 27 nov. 2018 a las 11:54, Alan Hodgson
(<ah...@lists.simkin.ca>) escribió:
>
>
>
> Malware/phishes are usually either in an attachment or the message has a link. Personally I add a lot of points to either if they come through questionable countries. Users can dig them out of their Junk if they happen to be expecting a resume from Algeria.
Ok
> You'd probably have to write your own. I'm not even sure where you got that RELAY_PK rule from but I'd guess a download from Ironport or something.
>
> Personally I have one set of rules for classifying countries and a few metas on top of those.
>
> But you probably wouldn't want to use my rules; my servers are small with homegenous user bases and they don't get real mail from, say, Russia or Pakistan or the Sudan. You can tag a lot of real mail if you're not careful writing rules.
I have is a file where I have scores on the countries, including Pakistan
look the rule
header RELAYCOUNTRY_PK X-Relay-Countries =~/\bPK\b/
describe RELAYCOUNTRY_PK Relayed through Pakistan
score RELAYCOUNTRY_PK 3.0
you have some example of a rule, how to assign scores to doc , xls files, ppt
regards.
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Alan Hodgson <ah...@lists.simkin.ca>.
On Tue, 2018-11-27 at 11:22 -0600, Rick Gutierrez wrote:
> El mar., 27 nov. 2018 a las 11:14, Alan Hodgson
> (<ah...@lists.simkin.ca>) escribió:
>
> > Wow, that's hard to read.
> >
> > It was close to being tagged because of the Pakistan relay. Just
> > add a few points for Word docs and you should be good. Word docs
> > from spammy countries should really get a lot of points.
>
> Hi Alan , I think it's a valid point, except for one thing, what
> happens if you do not attach a document?
>
Malware/phishes are usually either in an attachment or the message has
a link. Personally I add a lot of points to either if they come through
questionable countries. Users can dig them out of their Junk if they
happen to be expecting a resume from Algeria.
> Something I want to ask you, where can I increase this score or in
> what rules?
>
>
You'd probably have to write your own. I'm not even sure where you got
that RELAY_PK rule from but I'd guess a download from Ironport or
something.
Personally I have one set of rules for classifying countries and a few
metas on top of those.
But you probably wouldn't want to use my rules; my servers are small
with homegenous user bases and they don't get real mail from, say,
Russia or Pakistan or the Sudan. You can tag a lot of real mail if
you're not careful writing rules.
Re: spoofing mail
Posted by Dominic Raferd <do...@timedicer.co.uk>.
On Wed, 28 Nov 2018 at 01:57, Rick Gutierrez <xs...@gmail.com> wrote:
> El mar., 27 nov. 2018 a las 16:22, David Jones (<dj...@ena.com>)
> escribió:
>
> >
> > Can you send a copy of the original email lightly redacted via pastebin
> > so I can run it through my filters to give some pointers?
> >
> > --
> > David Jones
>
> Hi David , the email is very simple, but I attach it in the following link
>
> https://pastebin.com/cYaLibt1
>
> and the trace for a better reading
>
> https://pastebin.com/8vpVejPc
>
> the name of one of my users is Ariana Molina and the valid mail of
> another of my users is lvasquez.
>
So the real user's name and email (Ariana Molina molina@domain.com) occurs
only in the body of the email, and not anywhere in the headers, nor in the
SMTP transaction? I think this is hard to catch because a real user's name
and email may legitimately be found in the body of an email from another
user.
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El jue., 29 nov. 2018 a las 7:47, David Jones (<dj...@ena.com>) escribió:
>
> Here's what my mail filters say. You can ignore the DKIM_INVALID
> because the body was intentionally modified (redacted) to post to pastbin.
>
> X-Spam-Status: Yes, score=11.0 required=5.0 tests=BAYES_99,DKIM_INVALID,
> DKIM_SIGNED,ENA_BAD_SPAM,ENA_RELAY_NOT_US,MSGID_BELONGS_RECIPIENT,
> RCVD_IN_IVMBL,UNPARSEABLE_RELAY shortcircuit=no autolearn=no
> autolearn_force=no version=3.4.1
> X-Spam-Report:
> * 5.2 BAYES_99 BODY: Bayes spam probability is 99 to 100%
> * [score: 0.9980]
> * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
> * valid
> * 1.2 RCVD_IN_IVMBL No description available.
> * 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
> * 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
> * 2.2 ENA_RELAY_NOT_US Relayed from outside the US and not on whitelists
> * 2.2 MSGID_BELONGS_RECIPIENT Message-ID domain belongs to recipient
> * 0.0 ENA_BAD_SPAM Spam hitting really bad rules.
>
> A well-trained Bayes helps a lot.
Yes, the problem is that on this server I only have it as a gateway,
everything is sent to my mail server.
>
> You could/should increase the score on MSGID_BELONGS_RECIPIENT in your
> /etc/mail/spamassassin local scores file.
I can not find that rule, I do not know if adding it to my local.cf works?
>
> Local overrides of scores and settings is typically done in
> /etc/mail/spamassassin/local.cf but feel free to make your own *.cf
> files in /etc/mail/spamassassin. Amavis can create it's own files to
> customize settings in /etc/mail/spamassassin so compare a vanilla SA
> installation to what you have to find the best place to put your local
> settings.
>
> --
> David Jones
regards!
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El jue., 29 nov. 2018 a las 10:18, David Jones (<dj...@ena.com>) escribió:
>
> On 11/29/18 9:44 AM, Paul Stead wrote:
> > I can't find MSGID_BELONGS_RECIPIENT in the standard distribution - I think this might be because my Plugin is installed.
> >
> > Another to get into branch?
> >
>
> I think this one is worthy of consideration to be included in the core
> SA ruleset.
>
> https://github.com/fmbla
>
> [root@server spamassassin]# pwd
> /etc/mail/spamassassin
> [root@server spamassassin]# cat 99_recipient_msgid.cf
> ifplugin Mail::SpamAssassin::Plugin::RecipientMsgID
>
> meta __PDS_MAILING_SOFTWARE (__VIA_ML || __DOS_HAS_MAILING_LIST ||
> __DOS_HAS_LIST_UNSUB || __HAS_LIST_ID || __DOS_HAS_LIST_ID ||
> __HAS_X_MAILING_LIST)
>
> meta MSGID_BELONGS_RECIPIENT __MSGID_BELONGS_RECIPIENT &&
> !__PDS_MAILING_SOFTWARE && !ENA_TRUSTED_LIST
> describe MSGID_BELONGS_RECIPIENT Message-ID domain belongs to recipient
> score MSGID_BELONGS_RECIPIENT 2.2
>
> meta MSGID_FAKE_FROM_2_EMAILS (__PLUGIN_FROMNAME_SPOOF &&
> __MSGID_BELONGS_RECIPIENT)
> describe MSGID_FAKE_FROM_2_EMAILS MSGID belongs to recipient and
> faked froms
> score MSGID_FAKE_FROM_2_EMAILS 4.2
>
> full __FROM_NAME_LAST_THING
> /From:\W*([\w+.-]+\@[\w.-]+\.\w\w++).*\1(?:\s*|<\/\w+>|--[\w_\-\.\=]{2,}--)+$/s
>
> meta SPOOF_NAME_LAST_THING (__PLUGIN_FROMNAME_SPOOF &&
> __FROM_NAME_LAST_THING)
> describe SPOOF_NAME_LAST_THING From 2 emails and fake from name as
> last thing
> score SPOOF_NAME_LAST_THING 2.2
>
> endif
>
> --
> David Jones
Thank David , that rule is not within the github repository, it has
certainly been removed , you could upload it to github, gmail puts an
ugly format.
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by David Jones <dj...@ena.com>.
On 11/29/18 9:44 AM, Paul Stead wrote:
> I can't find MSGID_BELONGS_RECIPIENT in the standard distribution - I think this might be because my Plugin is installed.
>
> Another to get into branch?
>
I think this one is worthy of consideration to be included in the core
SA ruleset.
https://github.com/fmbla
[root@server spamassassin]# pwd
/etc/mail/spamassassin
[root@server spamassassin]# cat 99_recipient_msgid.cf
ifplugin Mail::SpamAssassin::Plugin::RecipientMsgID
meta __PDS_MAILING_SOFTWARE (__VIA_ML || __DOS_HAS_MAILING_LIST ||
__DOS_HAS_LIST_UNSUB || __HAS_LIST_ID || __DOS_HAS_LIST_ID ||
__HAS_X_MAILING_LIST)
meta MSGID_BELONGS_RECIPIENT __MSGID_BELONGS_RECIPIENT &&
!__PDS_MAILING_SOFTWARE && !ENA_TRUSTED_LIST
describe MSGID_BELONGS_RECIPIENT Message-ID domain belongs to recipient
score MSGID_BELONGS_RECIPIENT 2.2
meta MSGID_FAKE_FROM_2_EMAILS (__PLUGIN_FROMNAME_SPOOF &&
__MSGID_BELONGS_RECIPIENT)
describe MSGID_FAKE_FROM_2_EMAILS MSGID belongs to recipient and
faked froms
score MSGID_FAKE_FROM_2_EMAILS 4.2
full __FROM_NAME_LAST_THING
/From:\W*([\w+.-]+\@[\w.-]+\.\w\w++).*\1(?:\s*|<\/\w+>|--[\w_\-\.\=]{2,}--)+$/s
meta SPOOF_NAME_LAST_THING (__PLUGIN_FROMNAME_SPOOF &&
__FROM_NAME_LAST_THING)
describe SPOOF_NAME_LAST_THING From 2 emails and fake from name as
last thing
score SPOOF_NAME_LAST_THING 2.2
endif
--
David Jones
Re: spoofing mail
Posted by Paul Stead <pa...@zeninternet.co.uk>.
I can't find MSGID_BELONGS_RECIPIENT in the standard distribution - I think this might be because my Plugin is installed.
Another to get into branch?
--
On 29/11/2018, 13:47, "David Jones" <dj...@ena.com> wrote:
On 11/29/18 3:30 AM, Rupert Gallagher wrote:
> Message-ID and To have the same domain, but From does not. You should
> have never received that mail.
>
Here's what my mail filters say. You can ignore the DKIM_INVALID
because the body was intentionally modified (redacted) to post to pastbin.
X-Spam-Status: Yes, score=11.0 required=5.0 tests=BAYES_99,DKIM_INVALID,
DKIM_SIGNED,ENA_BAD_SPAM,ENA_RELAY_NOT_US,MSGID_BELONGS_RECIPIENT,
RCVD_IN_IVMBL,UNPARSEABLE_RELAY shortcircuit=no autolearn=no
autolearn_force=no version=3.4.1
X-Spam-Report:
* 5.2 BAYES_99 BODY: Bayes spam probability is 99 to 100%
* [score: 0.9980]
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* 1.2 RCVD_IN_IVMBL No description available.
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
* 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
* 2.2 ENA_RELAY_NOT_US Relayed from outside the US and not on whitelists
* 2.2 MSGID_BELONGS_RECIPIENT Message-ID domain belongs to recipient
* 0.0 ENA_BAD_SPAM Spam hitting really bad rules.
A well-trained Bayes helps a lot.
You could/should increase the score on MSGID_BELONGS_RECIPIENT in your
/etc/mail/spamassassin local scores file.
Local overrides of scores and settings is typically done in
/etc/mail/spamassassin/local.cf but feel free to make your own *.cf
files in /etc/mail/spamassassin. Amavis can create it's own files to
customize settings in /etc/mail/spamassassin so compare a vanilla SA
installation to what you have to find the best place to put your local
settings.
--
David Jones
Paul Stead
Senior Engineer (Tools & Technology)
Zen Internet
Re: spoofing mail
Posted by David Jones <dj...@ena.com>.
On 11/29/18 3:30 AM, Rupert Gallagher wrote:
> Message-ID and To have the same domain, but From does not. You should
> have never received that mail.
>
Here's what my mail filters say. You can ignore the DKIM_INVALID
because the body was intentionally modified (redacted) to post to pastbin.
X-Spam-Status: Yes, score=11.0 required=5.0 tests=BAYES_99,DKIM_INVALID,
DKIM_SIGNED,ENA_BAD_SPAM,ENA_RELAY_NOT_US,MSGID_BELONGS_RECIPIENT,
RCVD_IN_IVMBL,UNPARSEABLE_RELAY shortcircuit=no autolearn=no
autolearn_force=no version=3.4.1
X-Spam-Report:
* 5.2 BAYES_99 BODY: Bayes spam probability is 99 to 100%
* [score: 0.9980]
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* 1.2 RCVD_IN_IVMBL No description available.
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
* 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
* 2.2 ENA_RELAY_NOT_US Relayed from outside the US and not on whitelists
* 2.2 MSGID_BELONGS_RECIPIENT Message-ID domain belongs to recipient
* 0.0 ENA_BAD_SPAM Spam hitting really bad rules.
A well-trained Bayes helps a lot.
You could/should increase the score on MSGID_BELONGS_RECIPIENT in your
/etc/mail/spamassassin local scores file.
Local overrides of scores and settings is typically done in
/etc/mail/spamassassin/local.cf but feel free to make your own *.cf
files in /etc/mail/spamassassin. Amavis can create it's own files to
customize settings in /etc/mail/spamassassin so compare a vanilla SA
installation to what you have to find the best place to put your local
settings.
--
David Jones
Re: spoofing mail
Posted by David Jones <dj...@ena.com>.
On 12/1/18 8:31 AM, Matus UHLAR - fantomas wrote:
>> El vie., 30 nov. 2018 a las 3:06, Matus UHLAR - fantomas
>> (<uh...@fantomas.sk>) escribió:
>>> And, yes, there could be rule that catches message-id added by internal
>>> server. Note that:
>>> - Message-ID is not required (has SHOULD in RFC)
>>> - many mailservers add message-id if it doesn't exist.
>
>>> >> https://pastebin.com/ktMUDLps
>
>>> not available anymore :-(
>
> On 30.11.18 10:55, Rick Gutierrez wrote:
>> Hi , here it is https://pastebin.com/3TtsjXSX
>>
>> last trace , after my gateway analyzes it
>>
>> https://pastebin.com/76rNVnnp
>
> - is "mydomain.com" your real domain?
>
> - funny that Message-Id is signed in DKIM and DKIM is valid.
>
> hmmm more to think about later.
>
DKIM_VALID only confirms it was signed correctly by any domain. Anyone
can generate keys and DNS records to sign an email with a domain for
which they control/manage the DNS. I can sign all emails leaving my
edge mail servers with an ena.net or ena.com key. That only means you
can be sure it is authentic (unmodified) and came from my servers. It
doesn't mean I am allowed to send for that domain.
DKIM_VALID_AU confirms the DKIM signature aligned with the author's
From: header domain and is authentic (unmodified). This means something
but is still not an indicator of ham or spam -- just that it came from
that domain unmodified. If you trust the domain like paypal.com to not
send UCE or spam from compromised accounts, then you can whitelist_auth
that domain.
--
David Jones
Re: spoofing mail
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>El vie., 30 nov. 2018 a las 3:06, Matus UHLAR - fantomas
>(<uh...@fantomas.sk>) escribió:
>> And, yes, there could be rule that catches message-id added by internal
>> server. Note that:
>> - Message-ID is not required (has SHOULD in RFC)
>> - many mailservers add message-id if it doesn't exist.
>> >> https://pastebin.com/ktMUDLps
>> not available anymore :-(
On 30.11.18 10:55, Rick Gutierrez wrote:
>Hi , here it is https://pastebin.com/3TtsjXSX
>
>last trace , after my gateway analyzes it
>
>https://pastebin.com/76rNVnnp
- is "mydomain.com" your real domain?
- funny that Message-Id is signed in DKIM and DKIM is valid.
hmmm more to think about later.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux is like a teepee: no Windows, no Gates and an apache inside...
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El vie., 30 nov. 2018 a las 3:06, Matus UHLAR - fantomas
(<uh...@fantomas.sk>) escribió:
> And, yes, there could be rule that catches message-id added by internal
> server. Note that:
> - Message-ID is not required (has SHOULD in RFC)
> - many mailservers add message-id if it doesn't exist.
>
> >>
> >> https://pastebin.com/ktMUDLps
>
> not available anymore :-(
> --
Hi , here it is https://pastebin.com/3TtsjXSX
last trace , after my gateway analyzes it
https://pastebin.com/76rNVnnp
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by John Hardin <jh...@impsec.org>.
On Fri, 30 Nov 2018, Rupert Gallagher wrote:
> Although the RFC allows muas not to include the mid, the same RFC does
> not mandate mtas to accept them. Since 100% of such emails on our
> records are spam, then we reject them upfront.
...and if you're adopting that policy, the configure your MTA to reject
messages missing a Message-ID during the SMTP phase before it ever touches
SA.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
610 days since the first commercial re-flight of an orbital booster (SpaceX)
Re: spoofing mail
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> On 29.11.18 09:30, Rupert Gallagher wrote:
>>>Message-ID and To have the same domain, but From does not. You should have
>>> never received that mail.
On 30.11.18 21:09, Rupert Gallagher wrote:
>Although the RFC allows muas not to include the mid, the same RFC does not
> mandate mtas to accept them. Since 100% of such emails on our records are
> spam, then we reject them upfront. I understand that spammers and
> scummers hate our policy, but hey, who cares, right? Our inbox, our
> rules.
you have mistaken "You should have never received that mail." with
"We would have never received that mail."
I am of course aware of such policies, but they differ site to a site, admin
to an admin and company to a company.
The fact that you refuse some kind of e-mail does not mean that others
should be doing the same.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux IS user friendly, it's just selective who its friends are...
Re: spoofing mail
Posted by Rupert Gallagher <ru...@protonmail.com>.
Although the RFC allows muas not to include the mid, the same RFC does not mandate mtas to accept them. Since 100% of such emails on our records are spam, then we reject them upfront. I understand that spammers and scummers hate our policy, but hey, who cares, right? Our inbox, our rules.
On Fri, Nov 30, 2018 at 10:06, Matus UHLAR - fantomas <uh...@fantomas.sk> wrote:
> On 29.11.18 09:30, Rupert Gallagher wrote:
>>Message-ID and To have the same domain, but From does not. You should have
>> never received that mail.
>
> this happens when message-id is added by mailserver of the recipient.
> Should hit MSGID_FROM_MTA_HEADER.
>
> And, yes, there could be rule that catches message-id added by internal
> server. Note that:
> - Message-ID is not required (has SHOULD in RFC)
> - many mailservers add message-id if it doesn't exist.
>
>>On Wed, Nov 28, 2018 at 19:15, Rick Gutierrez <xs...@gmail.com> wrote:
>>
>>> El mié., 28 nov. 2018 a las 6:03, Christian Grunfeld
>>> (<ch...@gmail.com>) escribió:
>>>>
>>>> Hi,
>>>>
>>>> this is a log....could you paste the email headers?
>>>>
>>>> cheers
>>>>
>>> I do not know if it is useful, the amavisd + spamassassin I have it in
>>> front of the mail server.
>>>
>>> https://pastebin.com/ktMUDLps
>
> not available anymore :-(
> --
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> The 3 biggets disasters: Hiroshima 45, Tschernobyl 86, Windows 95
Re: spoofing mail
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 29.11.18 09:30, Rupert Gallagher wrote:
>Message-ID and To have the same domain, but From does not. You should have
> never received that mail.
this happens when message-id is added by mailserver of the recipient.
Should hit MSGID_FROM_MTA_HEADER.
And, yes, there could be rule that catches message-id added by internal
server. Note that:
- Message-ID is not required (has SHOULD in RFC)
- many mailservers add message-id if it doesn't exist.
>On Wed, Nov 28, 2018 at 19:15, Rick Gutierrez <xs...@gmail.com> wrote:
>
>> El mié., 28 nov. 2018 a las 6:03, Christian Grunfeld
>> (<ch...@gmail.com>) escribió:
>>>
>>> Hi,
>>>
>>> this is a log....could you paste the email headers?
>>>
>>> cheers
>>>
>> I do not know if it is useful, the amavisd + spamassassin I have it in
>> front of the mail server.
>>
>> https://pastebin.com/ktMUDLps
not available anymore :-(
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The 3 biggets disasters: Hiroshima 45, Tschernobyl 86, Windows 95
Re: spoofing mail
Posted by Rupert Gallagher <ru...@protonmail.com>.
Message-ID and To have the same domain, but From does not. You should have never received that mail.
On Wed, Nov 28, 2018 at 19:15, Rick Gutierrez <xs...@gmail.com> wrote:
> El mié., 28 nov. 2018 a las 6:03, Christian Grunfeld
> (<ch...@gmail.com>) escribió:
>>
>> Hi,
>>
>> this is a log....could you paste the email headers?
>>
>> cheers
>>
> I do not know if it is useful, the amavisd + spamassassin I have it in
> front of the mail server.
>
> https://pastebin.com/ktMUDLps
>
> I appreciate any comments or help.
>
> --
> rickygm
>
> http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El mié., 28 nov. 2018 a las 19:08, Reindl Harald
(<h....@thelounge.net>) escribió:
>
> >
> > these are the files that increase the score of the rule , If I'm
> > missing someone, please someone guide me or update me if I'm doing it
> > wrong.
> >
> > /var/lib/spamassassin/3.004001/updates_spamassassin_org/72_scores.cf
> > /usr/share/spamassassin/72_scores.cf
>
> just don't touch the files
> they will be overwritten
>
> please learn basics how to and where write local overrides
>
> https://support.configserver.com/en/knowledgebase/article/how-do-i-change-the-score-for-a-specific-spamassassin-test
>
Ok , understood.
Thnk
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
in days past when I start this type of messages / spammer increase the
score of this rule HEADER_FROM_DIFFERENT_DOMAINS=0.001 , add the
score to 3, but keep the default 0.001 , update my spamassassin once a
day, I'm using version 3.4.1.
these are the files that increase the score of the rule , If I'm
missing someone, please someone guide me or update me if I'm doing it
wrong.
/var/lib/spamassassin/3.004001/updates_spamassassin_org/72_scores.cf
/usr/share/spamassassin/72_scores.cf
One doubt, is it a good idea to increase the score to that rule?
look , the last mail of today.
https://pastebin.com/9s2WaSmL
regards!
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El mié., 28 nov. 2018 a las 6:03, Christian Grunfeld
(<ch...@gmail.com>) escribió:
>
> Hi,
>
> this is a log....could you paste the email headers?
>
> cheers
>
I do not know if it is useful, the amavisd + spamassassin I have it in
front of the mail server.
https://pastebin.com/ktMUDLps
I appreciate any comments or help.
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Christian Grunfeld <ch...@gmail.com>.
Hi,
this is a log....could you paste the email headers?
cheers
El mar., 27 nov. 2018 a las 22:57, Rick Gutierrez (<xs...@gmail.com>)
escribió:
> El mar., 27 nov. 2018 a las 16:22, David Jones (<dj...@ena.com>)
> escribió:
>
> >
> > Can you send a copy of the original email lightly redacted via pastebin
> > so I can run it through my filters to give some pointers?
> >
> > --
> > David Jones
>
> Hi David , the email is very simple, but I attach it in the following link
>
> https://pastebin.com/cYaLibt1
>
> and the trace for a better reading
>
> https://pastebin.com/8vpVejPc
>
> the name of one of my users is Ariana Molina and the valid mail of
> another of my users is lvasquez.
>
> regards
>
> --
> rickygm
>
> http://gnuforever.homelinux.com
>
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El mar., 27 nov. 2018 a las 16:22, David Jones (<dj...@ena.com>) escribió:
>
> Can you send a copy of the original email lightly redacted via pastebin
> so I can run it through my filters to give some pointers?
>
> --
> David Jones
Hi David , the email is very simple, but I attach it in the following link
https://pastebin.com/cYaLibt1
and the trace for a better reading
https://pastebin.com/8vpVejPc
the name of one of my users is Ariana Molina and the valid mail of
another of my users is lvasquez.
regards
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by David Jones <dj...@ena.com>.
On 11/27/18 11:22 AM, Rick Gutierrez wrote:
> El mar., 27 nov. 2018 a las 11:14, Alan Hodgson
> (<ah...@lists.simkin.ca>) escribió:
>
>>
>> Wow, that's hard to read.
>>
>> It was close to being tagged because of the Pakistan relay. Just add a few points for Word docs and you should be good. Word docs from spammy countries should really get a lot of points.
>
> Hi Alan , I think it's a valid point, except for one thing, what
> happens if you do not attach a document?
>
> Something I want to ask you, where can I increase this score or in what rules?
>
>
Can you send a copy of the original email lightly redacted via pastebin
so I can run it through my filters to give some pointers?
--
David Jones
Re: spoofing mail
Posted by Rick Gutierrez <xs...@gmail.com>.
El mar., 27 nov. 2018 a las 11:14, Alan Hodgson
(<ah...@lists.simkin.ca>) escribió:
>
> Wow, that's hard to read.
>
> It was close to being tagged because of the Pakistan relay. Just add a few points for Word docs and you should be good. Word docs from spammy countries should really get a lot of points.
Hi Alan , I think it's a valid point, except for one thing, what
happens if you do not attach a document?
Something I want to ask you, where can I increase this score or in what rules?
--
rickygm
http://gnuforever.homelinux.com
Re: spoofing mail
Posted by Alan Hodgson <ah...@lists.simkin.ca>.
On Tue, 2018-11-27 at 10:42 -0600, Rick Gutierrez wrote:
> Hi , I have a situation a little complicated, I have emails from
> spammers that come with the name of one of my users, but the email
> address is not from my domain , they send it from a valid domain,
> which complies with spf, DKIM etc etc, some idea that could help me to
> adjust my spamassassin and stop this kind of post, someone has had
> experience in this type of evasion?
>
> my user is lvelasquez
>
Wow, that's hard to read.
It was close to being tagged because of the Pakistan relay. Just add a
few points for Word docs and you should be good. Word docs from spammy
countries should really get a lot of points.