Quelltext Spammail

[lehm]

Hallo ihr beiden,
ihr der Quelltext der heute erhaltenen Spammail:

Return-Path: <dscott@pathcom.com>
Received: from paedml.kg-fds.de ([unix socket])
	 by paedml (Cyrus v2.4.12-Debian-2.4.12-2) with LMTPA;
	 Wed, 20 Oct 2021 11:03:37 +0200
X-Sieve: CMU Sieve 2.4
Received: from localhost (localhost.localdomain [127.0.0.1])
	by paedml.kg-fds.de (Postfix) with ESMTP id CDA1E4E0BA6
	for <lehm@kg-fds.de>; Wed, 20 Oct 2021 11:03:37 +0200 (CEST)
Received: from paedml.kg-fds.de ([127.0.0.1])
	by localhost (paedml.kg-fds.de [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 4yvL+hEv0LbJ for <lehm@kg-fds.de>;
	Wed, 20 Oct 2021 11:03:37 +0200 (CEST)
Received: from mail-hub01.belwue.de (mail-hub01.belwue.de [129.143.76.41])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by paedml.kg-fds.de (Postfix) with ESMTPS id A903E4E0A41
	for <lehm@kg-fds.de>; Wed, 20 Oct 2021 11:03:37 +0200 (CEST)
Received: from mail-in03.belwue.de (mail-in03.belwue.de [IPv6:2001:7c0:0:76::3])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client did not present a certificate)
	by mail-hub01.belwue.de (Postfix) with ESMTPS id 4HZ4Qx4PDXz528vL
	for <lehm@kg-fds.de>; Wed, 20 Oct 2021 11:03:37 +0200 (CEST)
Received: from smtp-out-b2-2.tor.pathcom.com (smtp-out-b2-129.tor.pathcom.com [207.188.95.129])
	(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mail-in03.belwue.de (Postfix) with ESMTPS id 4HZ4Qx093rz5Zn
	for <lehm@kg-fds.de>; Wed, 20 Oct 2021 11:03:37 +0200 (CEST)
Received: from smtp-auth08.tor.pathcom.com (localhost [127.0.0.1])
	by smtp-auth08.tor.pathcom.com (Postfix) with ESMTP id 33ECE540F60
	for <lehm@kg-fds.de>; Wed, 20 Oct 2021 04:58:53 -0400 (EDT)
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
	smtp-auth08.pathcom.com
X-Spam-Level: 
X-Spam-Status: No, score=-1.0 required=8.0 tests=ALL_TRUSTED=-1,HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001 autolearn=disabled version=3.4.1 ham HAM-Report
	* -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to
	*       background
Received: from V2 (unknown [154.16.192.91])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	(Authenticated sender: dscott@pathcom.com)
	by smtp-auth08.tor.pathcom.com (Postfix) with ESMTPSA
	for <lehm@kg-fds.de>; Wed, 20 Oct 2021 04:58:53 -0400 (EDT)
From: "lehm" <dscott@pathcom.com>
Subject: New Message
To: <lehm@kg-fds.de>
Content-Type: multipart/alternative; boundary="7sgzqBpvx269qpioltBbq6QW=_8dFFTcEV"
MIME-Version: 1.0
Date: Wed, 20 Oct 2021 09:03:34 +0000
Message-Id: <20212010090334DFA9BA9E50-B65B03061A@pathcom.com>
X-Rspamd-UID: abcd48
X-Rspamd-Queue-Id: 4HZ4Qx093rz5Zn

This is a multi-part message in MIME format

[Rüdiger Kupper]

Ich habe heute auch wieder zwei Werbemails bekommen, hill ebenso. Ich leite die Quelltexte an BelWü weiter.

[Rüdiger Kupper]

Und mal wieder spam. Diesmal gür Kugelschreiber.

[lehm]

Oh, ich habe auch eine neue:

Return-Path: <squillen@…>
Received: from paedml.kg-fds.de ([unix socket])

by paedml (Cyrus v2.4.12-Debian-2.4.12-2) with LMTPA;
Thu, 04 Nov 2021 12:25:59 +0100

X-Sieve: CMU Sieve 2.4
Received: from localhost (localhost.localdomain [127.0.0.1])

by paedml.kg-fds.de (Postfix) with ESMTP id 4ADEA4E0CA4
for <lehm@…>; Thu, 4 Nov 2021 12:25:59 +0100 (CET)

Received: from paedml.kg-fds.de ([127.0.0.1])

by localhost (paedml.kg-fds.de [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id Wl+b+gJce4hQ for <lehm@…>;
Thu, 4 Nov 2021 12:25:59 +0100 (CET)

Received: from mail-hub02.belwue.de (mail-hub02.belwue.de [129.143.76.42])

(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by paedml.kg-fds.de (Postfix) with ESMTPS id 229F14E0202
for <lehm@…>; Thu, 4 Nov 2021 12:25:59 +0100 (CET)

Received: from mail-in03.belwue.de (mail-in03.belwue.de [129.143.76.3])

(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client did not present a certificate)
by mail-hub02.belwue.de (Postfix) with ESMTPS id 4HlLtH0XWVz5hYw
for <lehm@…>; Thu, 4 Nov 2021 12:25:59 +0100 (CET)

Received: from mwsmtp02oc.mail2world.com (mwsmtp02oc.mail2world.com [74.202.142.133])

(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(No client certificate requested)
by mail-in03.belwue.de (Postfix) with ESMTPS id 4HlLtF698GzFpH
for <lehm@…>; Thu, 4 Nov 2021 12:25:57 +0100 (CET)

Received: from mail pickup service by mwsmtp02oc.mail2world.com with Microsoft SMTPSVC;

Thu, 4 Nov 2021 04:27:52 -0700

auth-sender:squillen@maxxsouth.net
Received: from 46.246.41.174 unverified ([46.246.41.174]) by mwsmtp02oc.mail2world.com with Mail2World SMTP Server;

Thu, 04 Nov 2021 04:27:52 -0700

From: "lehm" <squillen@…>
Subject: New Message
To: <lehm@…>
Content-Type: multipart/alternative; boundary="lskNiVWNP=_oo7J3VKyO4RdWgE0r7RjWK2"
MIME-Version: 1.0
Date: Thu, 4 Nov 2021 11:25:55 +0000
Message-Id: <20210411112555787C65A4BB$86E20F839D@…>
X-CTCH-Spam: Suspect
X-CTCH-RefID: str=0001.0A702F27.6183C344.0007,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,sb=3,sb=3
X-OriginalArrivalTime: 04 Nov 2021 11:27:52.0969 (UTC) FILETIME=[01A20790:01D7D16F]
X-Rspamd-UID: ba0934
X-Rspamd-Queue-Id: 4HlLtF698GzFpH
X-Rspamd-SPAM-Probability: 0

This is a multi-part message in MIME format

--lskNiVWNP=_oo7J3VKyO4RdWgE0r7RjWK2
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

kg-fds.de New Webmail|Features

Hi lehm

Integrate youriaccount into our new addedifeatures for better mailiper=
fomance

Pressithe proceed tabibelow to check new addediwebmail

ProceediJNow ​http://t.reservation.disneydestinations.com/r/?id=3Dh232a=
955,556d9ea,37f128a&p1=3D51.13.112.221/bel/?email=3Dlehm@…

PRIVACY

STATEMENT

--lskNiVWNP=_oo7J3VKyO4RdWgE0r7RjWK2
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<h1 style=3D"color:green">kg-fds.de New Webmail<FONT color=3D#ffffff>|=
</FONT>Features</h1> <h2 style=3D"color:navy">Hi lehm</h2> <strong><P>=
Integrate your<FONT color=3D#ffffff>i</FONT>account into our new added=
<FONT color=3D#ffffff>i</FONT>features for better mail<FONT color=3D#f=
fffff>i</FONT>perfomance</P> <strong><p>Press<FONT color=3D#ffffff>i</=
FONT>the proceed tab<FONT color=3D#ffffff>i</FONT>below to check new a=
dded<FONT color=3D#ffffff>i</FONT>webmail</p> <a style=3D"text-decorat=
ion:none; font-weight:bold; border-radius:24px; color:white; padding: =
4px; background:navy;" href=3D"​http://t.reservation.disneydestinations=
=2Ecom/r/?id=3Dh232a955,556d9ea,37f128a&p1=3D51.13.112.221/bel/?email=3D=
lehm@…">Proceed<FONT color=3D#000080>iJ</FONT>Now</a> <p style=

=3D"color:gray">PRIVACY<FONT color=3D#ffffff>

</FONT>STATEMENT</p> </=

body>

</html>

--lskNiVWNP=_oo7J3VKyO4RdWgE0r7RjWK2--

[bau]

SPAMMails werden seit der Umstellung auf das neue MailGate (JointVenture mit der TGS) von dort aus getagged.
Ich habe schon einmal mir Stephan diskutiert, wie wir die bei den Kollegen per SIEVE-Regel in einen SPAM-Ordner verfrachten können.

@rich: Wollen wir das weiterverfolgen?

[Stephan Richter]

Sollte es im IMAP-Server dafür nicht eine standardisierte Funktion geben?

Kurzes googlen für dovecot ergab diese Anleitung: ​https://kofler.info/postfix-dovecot-spamassassin-spam-in-den-junk-folder-verschieben/
...also schon einiges an Handarbeit an der IMAP-Konfiguration.

[bau]

Wir haben nicht dovecot sondern cyrus im Einsatz.