You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Yousef Raffah <yr...@savola.com> on 2006/03/25 06:23:52 UTC
pager.icq.com spam storm :(
Hello Everyone,
I've been under a spam storm for the last two days and most of the
message I get are similar to the one below, message for
xxxx@pager.icq.com, I really don't understand how come I'm receiving
such messages! Can someone help me prevent these messages?
Return-Path: <>
Received: from 10.0.0.4 by ocs.savola.com with ESMTP id
50091021143204306; Fri, 24 Mar 2006 15:45:06 +0300
Received: from kansai.savoladns.com ([10.0.0.3]) by Savola_Proxy2 with
InterScan Messaging Security Suite; Fri, 24 Mar 2006 16:07:03 +0300
X-Envelope-From: <KE...@fen.com>
X-Envelope-To: <12...@pager.icq.com>, <37...@pager.icq.com>,
<48...@pager.icq.com>, <53...@pager.icq.com>
X-Quarantine-Id: <ieTYZkD94JBN>
Received: from 54156D58 (localhost [127.0.0.1]) by kansai.savoladns.com
(Postfix) with SMTP id 2AE131020D; Fri, 24 Mar 2006 15:56:34 +0300 (AST)
X-Apparently-To: KEELEY.GORMAN@fen.com via dress.prima.com; Fri, 24 Mar
2006 07:55:04 -0500
Received: from skin (HELO pencil.prima.com) by small.prima.com with
SMTP; Fri, 24 Mar 2006 18:47:04 +0600
Date: Fri, 24 Mar 2006 04:55:04 -0800 (15:55 AST)
From: ALI MATLOCK <KE...@fen.com>
Message-Id: <20...@connectium.com>
To: 3701601@pager.icq.com
Subject: Hey 3701601, tell me what you think?
X-Mailer: Mew version 3.2 on Emacs 21.3 / Mule 5.5 (SAKAKI)
X-Virus-Scanned: by AMaViS perl-14
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Spam-Status: Yes, score=16.8 tag=-100 tag2=6.3 kill=6.3
tests=[BAYES_99=3.5, DCC_CHECK=2.17, DIGEST_MULTIPLE=0.765,
DNS_FROM_AHBL_RHSBL=0.231, HTML_MESSAGE=0.001, HTML_TITLE_EMPTY=0.214,
MANY_EXCLAMATIONS=0.775, MIME_HTML_ONLY=0.001, PYZOR_CHECK=3.7,
RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5,
RAZOR2_CF_RANGE_E8_51_100=1.5, RAZOR2_CHECK=0.5,
SARE_HTML_USL_1CHAR2=0.129, SARE_HTML_USL_OBFU=0.7,
SARE_URI_NUM_SUBDOM=0.614]
X-Spam-Score: 16.8
X-Spam-Level: ****************
X-Spam-Flag: YES
Sincerely,
Yousef Raffah
Senior Systems Administrator
SSIS - The Savola Group
--
Aren't you using Firefox? Get it at getfirefox.com
yousef.raffah.com
Re: pager.icq.com spam storm :(
Posted by mouss <us...@free.fr>.
Yousef Raffah wrote:
> On Sat, 2006-03-25 at 11:35 +0100, mouss wrote:
>> Yousef Raffah wrote:
>>> Hello Everyone,
>>>
>>> I've been under a spam storm for the last two days and most of the
>>> message I get are similar to the one below, message for
>>> xxxx@pager.icq.com, I really don't understand how come I'm receiving
>>> such messages! Can someone help me prevent these messages?
>> you'll need to check in your postfix logs.
>>
>>> Return-Path: <>
>>> Received: from 10.0.0.4 by ocs.savola.com with ESMTP id
>>> 50091021143204306; Fri, 24 Mar 2006 15:45:06 +0300
>>> Received: from kansai.savoladns.com ([10.0.0.3]) by Savola_Proxy2 with
>>> InterScan Messaging Security Suite; Fri, 24 Mar 2006 16:07:03 +0300
>>> X-Envelope-From: <KE...@fen.com>
>>> X-Envelope-To: <12...@pager.icq.com>, <37...@pager.icq.com>,
>>> <48...@pager.icq.com>, <53...@pager.icq.com>
>>> X-Quarantine-Id: <ieTYZkD94JBN>
>>> Received: from 54156D58 (localhost [127.0.0.1]) by kansai.savoladns.com
>>> (Postfix) with SMTP id 2AE131020D; Fri, 24 Mar 2006 15:56:34 +0300 (AST)
>> so your postfix received it from localhost with an hello=54156D58 (not
>> very standard....).
>>
>>> X-Apparently-To: KEELEY.GORMAN@fen.com via dress.prima.com; Fri, 24 Mar
>>> 2006 07:55:04 -0500
>>> Received: from skin (HELO pencil.prima.com) by small.prima.com with
>> This is not generated by postfix. is prima.com your system? If so, what
>> is this skin? if not yours, configure your small.prima.com to reject the
>> forged hello (skin is helloing as pencil.prima.com)
>>
>> if small.prima.com isn't yours, then you have a problem on
>> kansasi.savoladns.com. it got the mail from localhost. vulnerable
>> cgi/web form? open proxy?
>>
> I guess you pointed it out correctly, I had a proxy server running for
> test purposes and I guess it allowed passing the messages "somehow" to
> the mailserver as I can see in the proxy logs something like:
>
> 1143268316.235 112970 209.172.32.52 TCP_MISS/200 39 CONNECT
> 206.16.192.227:25 - DIRECT/206.16.192.227 -
>
> Anyhow, the problem is solved now as I have shut the proxy server.
> Thanks for all your help :)
>
when using a proxy, always make sure it only accepts connections from as
few hosts as possible. also give them private IPs so that you can
configure your postfix not to trust them (so they are not in
mynetworks). This is not enough, but reduces the risks.
Re: pager.icq.com spam storm :(
Posted by Yousef Raffah <yr...@savola.com>.
On Sat, 2006-03-25 at 11:35 +0100, mouss wrote:
> Yousef Raffah wrote:
> > Hello Everyone,
> >
> > I've been under a spam storm for the last two days and most of the
> > message I get are similar to the one below, message for
> > xxxx@pager.icq.com, I really don't understand how come I'm receiving
> > such messages! Can someone help me prevent these messages?
>
> you'll need to check in your postfix logs.
>
> >
> > Return-Path: <>
> > Received: from 10.0.0.4 by ocs.savola.com with ESMTP id
> > 50091021143204306; Fri, 24 Mar 2006 15:45:06 +0300
> > Received: from kansai.savoladns.com ([10.0.0.3]) by Savola_Proxy2 with
> > InterScan Messaging Security Suite; Fri, 24 Mar 2006 16:07:03 +0300
> > X-Envelope-From: <KE...@fen.com>
> > X-Envelope-To: <12...@pager.icq.com>, <37...@pager.icq.com>,
> > <48...@pager.icq.com>, <53...@pager.icq.com>
> > X-Quarantine-Id: <ieTYZkD94JBN>
> > Received: from 54156D58 (localhost [127.0.0.1]) by kansai.savoladns.com
> > (Postfix) with SMTP id 2AE131020D; Fri, 24 Mar 2006 15:56:34 +0300 (AST)
>
> so your postfix received it from localhost with an hello=54156D58 (not
> very standard....).
>
> > X-Apparently-To: KEELEY.GORMAN@fen.com via dress.prima.com; Fri, 24 Mar
> > 2006 07:55:04 -0500
> > Received: from skin (HELO pencil.prima.com) by small.prima.com with
>
> This is not generated by postfix. is prima.com your system? If so, what
> is this skin? if not yours, configure your small.prima.com to reject the
> forged hello (skin is helloing as pencil.prima.com)
>
> if small.prima.com isn't yours, then you have a problem on
> kansasi.savoladns.com. it got the mail from localhost. vulnerable
> cgi/web form? open proxy?
>
I guess you pointed it out correctly, I had a proxy server running for
test purposes and I guess it allowed passing the messages "somehow" to
the mailserver as I can see in the proxy logs something like:
1143268316.235 112970 209.172.32.52 TCP_MISS/200 39 CONNECT
206.16.192.227:25 - DIRECT/206.16.192.227 -
Anyhow, the problem is solved now as I have shut the proxy server.
Thanks for all your help :)
Sincerely,
Yousef Raffah
Senior Systems Administrator
SSIS - The Savola Group
--
Aren't you using Firefox? Get it at getfirefox.com
yousef.raffah.com
Re: pager.icq.com spam storm :(
Posted by mouss <us...@free.fr>.
Yousef Raffah wrote:
> Hello Everyone,
>
> I've been under a spam storm for the last two days and most of the
> message I get are similar to the one below, message for
> xxxx@pager.icq.com, I really don't understand how come I'm receiving
> such messages! Can someone help me prevent these messages?
you'll need to check in your postfix logs.
>
> Return-Path: <>
> Received: from 10.0.0.4 by ocs.savola.com with ESMTP id
> 50091021143204306; Fri, 24 Mar 2006 15:45:06 +0300
> Received: from kansai.savoladns.com ([10.0.0.3]) by Savola_Proxy2 with
> InterScan Messaging Security Suite; Fri, 24 Mar 2006 16:07:03 +0300
> X-Envelope-From: <KE...@fen.com>
> X-Envelope-To: <12...@pager.icq.com>, <37...@pager.icq.com>,
> <48...@pager.icq.com>, <53...@pager.icq.com>
> X-Quarantine-Id: <ieTYZkD94JBN>
> Received: from 54156D58 (localhost [127.0.0.1]) by kansai.savoladns.com
> (Postfix) with SMTP id 2AE131020D; Fri, 24 Mar 2006 15:56:34 +0300 (AST)
so your postfix received it from localhost with an hello=54156D58 (not
very standard....).
> X-Apparently-To: KEELEY.GORMAN@fen.com via dress.prima.com; Fri, 24 Mar
> 2006 07:55:04 -0500
> Received: from skin (HELO pencil.prima.com) by small.prima.com with
This is not generated by postfix. is prima.com your system? If so, what
is this skin? if not yours, configure your small.prima.com to reject the
forged hello (skin is helloing as pencil.prima.com)
if small.prima.com isn't yours, then you have a problem on
kansasi.savoladns.com. it got the mail from localhost. vulnerable
cgi/web form? open proxy?
Re: pager.icq.com spam storm :(
Posted by Yousef Raffah <yr...@savola.com>.
On Sat, 2006-03-25 at 01:09 -0500, Matt Kettler wrote:
> Yousef Raffah wrote:
> > Hello Everyone,
> >
> > I've been under a spam storm for the last two days and most of the
> > message I get are similar to the one below, message for
> > xxxx@pager.icq.com, I really don't understand how come I'm receiving
> > such messages! Can someone help me prevent these messages?
> >
>
> Do you have an ICQ account?
>
No, I don't have an account, plus, I'm not supposed to receive ICQ
messages! I'm not familiar with ICQ these days but does this state that
I have some users using ICQ pagers and should do your "Spam Control"
settings in their ICQ client? On the other hand, how can I block these
messages on the MTA (Postfix 2.3) level?
> If so, fire up ICQ, and go to the "main"->"security and privacy
> permissions"->"Spam Control"
>
> Turn on "Do not accept World Wide Pager Messages". I'd also suggest
> turning on or considering turning on most things in this dialog.
>
Sincerely,
Yousef Raffah
Senior Systems Administrator
SSIS - The Savola Group
--
Aren't you using Firefox? Get it at getfirefox.com
yousef.raffah.com
Re: pager.icq.com spam storm :(
Posted by Matt Kettler <mk...@comcast.net>.
Yousef Raffah wrote:
> Hello Everyone,
>
> I've been under a spam storm for the last two days and most of the
> message I get are similar to the one below, message for
> xxxx@pager.icq.com, I really don't understand how come I'm receiving
> such messages! Can someone help me prevent these messages?
>
Do you have an ICQ account?
If so, fire up ICQ, and go to the "main"->"security and privacy
permissions"->"Spam Control"
Turn on "Do not accept World Wide Pager Messages". I'd also suggest
turning on or considering turning on most things in this dialog.