Dotaz: marny boj se spamem

[Fila]

Ahoj, mam postfix s amavidem, spammassassinem atd., ale chodí mi miliarda spamu.. vsechny zprávy jsou podobne, ale odesilatele a ip se meni. Je to cesky. Tady je ukazka:

Od Agáta Pánek 
Jak svítit volně, bez použití rukou?

Čelovka se silou 100W k montáži, výletům, rybaření

Máte plné zuby slabých, tradičních baterek?
Chcete mít při svícení volné ruce?

atd..

Chodi/chodilo vam to taky? Je nejaka realna moznost se toho zbavit A jak? Moooc diky.

Odpovědi

[jiwopene]

Dáte hlavičky?

[Fila]

Odesilatel a IP se meni, ale v podstate je to porad podobny.

Return-Path: blankapgacpmwvasek@scoopfare.com
Delivered-To: filip@mojedomena.cz
Received: from localhost (localhost [127.0.0.1])
    by mojedomena.cz (Postfix) with ESMTP id ED9E82789C
    for filip@mojedomena.cz; Sat, 15 Aug 2020 08:01:21 +0200 (CEST)
Authentication-Results: mojedomena.cz;
    dkim=pass (1024-bit key; unprotected) header.d=scoopfare.com header.i=blankapgacpmwvasek@scoopfare.com header.b="ooMD/+oj";
    dkim-atps=neutral
X-Virus-Scanned: Debian amavisd-new at mojedomena.cz
Received: from mojedomena.cz ([127.0.0.1])
    by localhost (mojedomena.cz [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id R6QzVP6BWyMH for filip@mojedomena.cz;
    Sat, 15 Aug 2020 08:01:15 +0200 (CEST)
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=185.253.218.182; helo=kindly.scoopfare.com; envelope-from=blankapgacpmwvasek@scoopfare.com; receiver=UNKNOWN
Received: from kindly.scoopfare.com (kindly.scoopfare.com [185.253.218.182])
    by mojedomena.cz (Postfix) with ESMTP id 31BA727822
    for filip@mojedomena.cz; Sat, 15 Aug 2020 08:01:14 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=dkim; d=scoopfare.com;
    h=Date:From:Message-ID:To:Subject:List-Unsubscribe:MIME-Version:Content-Type:
    Content-Transfer-Encoding; i=blankapgacpmwvasek@scoopfare.com;
    bh=pEmM/p110GHEQwQfWxACWIPpWR9aiZdvs/fJk5h0M2g=;
    b=ooMD/+oj2zPXqQv4cc9sJf5UoLtzdwGTMkSAsH3b8Ny9gIc9wUtPOwuyhzSDwQInkWtzw5ceNUbI
    JdawxWVGsEy+3upsZ1ZrLkrBnu9hXxOwVJMSy7QTJ7qLIxNi2F4HWAZw41Pa/mI7oJUW+NdoHOyt
    Y2SYC/t/UN1xL/bSuHI=
Date: Sat, 15 Aug 2020 08:01:14 +0200
From: =?UTF-8?Q?Blanka_Va=C5=A1ek?= blankapgacpmwvasek@scoopfare.com
Message-ID: 078627jwqykfhuepesgcapvjmpiavxbeqibc@xfryqgh.scoopfare.com
To: filip@mojedomena.cz
Subject: =?UTF-8?Q?Unavuje_V=C3=A1s_letn=C3=AD_horko=3F_Ochlazovac=C3=AD_box_V=C3=A1s_okam=C5=BEit=C4=9B_osv=C4=9B=C5=BE=C3=AD?=
List-Unsubscribe: http://scoopfare.com/ub.php?b=yaay60764307fg4rehwa28my78c5g85r8q1d9s
X-Report-Abuse: http://scoopfare.com/aa.php?a=yaay60764307fg4rehwa28my78c5g85r8q1d9s
MIME-Version: 1.0
Precedence: bulk
Content-Type: multipart/alternative; boundary=b1_bwe9kcidbmh4.lb7XcsjM; charset="UTF-8"
Content-Transfer-Encoding: 8bit

Vechny domeny ze kterych ten bordel chodi maji stejny web (tady scoopfare.com):

Under maintenance
 

If you have any problems please feel free to contact us.

We will respond within 24 hours.


Contact us: evans.joe1900@gmail.com

[Fila]

A tady je ukazka mailu ktery mi jde rovnou do karanteny

Return-Path:  jessie-cairo-filip=mojedomena.cz@reveforly.icu 
Delivered-To: spam-quarantine
X-Envelope-From:  jessie-cairo-filip=mojedomena.cz@reveforly.icu 
X-Envelope-To:  filip@mojedomena.cz 
X-Envelope-To-Blocked:  filip@mojedomena.cz 
X-Quarantine-ID:  PICQqw_ZOmhU 
X-Spam-Flag: YES
X-Spam-Score: 9.044
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.044 tag=-999 tag2=4 kill=6 tests=[BAYES_50=0.8,
	DCC_CHECK=1.1, DKIM_INVALID=0.1, DKIM_SIGNED=0.1,
	FROM_FMBLA_NEWDOM=1.499, FROM_SUSPICIOUS_NTLD=0.5,
	FROM_SUSPICIOUS_NTLD_FP=1.999, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1,
	MIME_HTML_ONLY_MULTI=0.001, MPART_ALT_DIFF=0.79, RDNS_NONE=0.793,
	SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_PDS_OTHER_BAD_TLD=0.01,
	URIBL_ABUSE_SURBL=1.25, URIBL_BLOCKED=0.001]
	autolearn=no autolearn_force=no
Received: from mojedomena.cz ([127.0.0.1])
	by localhost (mojedomena.cz [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id PICQqw_ZOmhU for  filip@mojedomena.cz ;
	Fri, 14 Aug 2020 20:18:19 +0200 (CEST)
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=107.158.89.63; helo=mail.reveforly.icu; envelope-from=jessie-cairo-filip=mojedomena.cz@reveforly.icu; receiver= UNKNOWN  
Authentication-Results: mojedomena.cz;
	dkim=pass (1024-bit key; unprotected) header.d=reveforly.icu header.i=jessie-cairo@reveforly.icu header.b="BJ/8sjG4";
	dkim-atps=neutral
Received: from mail.reveforly.icu (unknown [107.158.89.63])
	by mojedomena.cz (Postfix) with ESMTP id 64B2B27671
	for  filip@mojedomena.cz ; Fri, 14 Aug 2020 20:18:18 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=reveforly.icu;
 h=Date:From:To:Subject:MIME-Version:Content-Type:List-Unsubscribe:Message-ID; i=jessie-cairo@reveforly.icu;
 bh=/el3C5VQL8k25QvITIsIjYxnS54=;
 b=BJ/8sjG4O+644lLmiAwBPRvseUzVWw79NLdHULFe+I/8KXnC+I/vDTa05swi4kpRyH7uyiZyvuq5
   AcfohKGe+ESY2oelcxGAT7VMyFaDB1wRPL5TDKnEh+6ltubRGrqeinFvUSgAvwPnIxFAuqpIjQgT
   QmRENuyXD3AXJKMhH+Y=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=reveforly.icu;
 b=Ym9/gGQ3feiPXnK7lJSTfqcfSUwAQSMJOW5nE9P3R5LI7VZs3+3ggx35vzuCHGb/SWbRq5HODhES
   +AKchFL/MbI7q/QP6GuVEegcqX8OKS9e8GKPokwlFaSdjY9iS4g45emmU3fETLJzNgjHlFozgn2c
   KBPwYnSKYIOZJqeL43g=;
Received: by mail.reveforly.icu id h6ramk0001gl for  filip@mojedomena.cz ; Fri, 14 Aug 2020 14:07:41 -0400 (envelope-from  jessie-cairo-filip=mojedomena.cz@reveforly.icu )
Date: Fri, 14 Aug 2020 14:07:41 -0400
From: Jessie Cairo  jessie-cairo@reveforly.icu 
To:    filip@mojedomena.cz 
Subject: Summer Body Secret - Controversial Wait Loss Pill is TOO Good to be True
MIME-Version: 1.0
Content-Type: multipart/alternative; 
	boundary="----=_Part_1918_1394353944.15974240311"
List-Unsubscribe:  http://www.reveforly.icu/98f5y23v95UJ89I11fU11NSQ25ex23nHD5ItIIfYIvisrxth4wEG.10edcRKm9cn95GsS106Ay3rUx/grandchild-biped 
Message-ID:  0.0.0.5D.1D67265CD2394E8.399323@mail.reveforly.icu 

------=_Part_1918_1394353944.1597428440311
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

 html 
  head  
   title  /title  
  /head  
  body  
   center  
    table style="font-family:'Times New Roman'; letter-spacing:normal; text-indent:0px; text-transform:none; word-spacing:0px; width:600px"  
     tbody  
      tr  
       td  
        table border="1" cellpadding="0" cellspacing="0" style="font-family:'Times New Roman',Times,serif; font-size:17px" width="100%"  
         tbody  
          tr  
           td  
            table border="0" cellpadding="5" cellspacing="5" width="100%"  
             tbody  
              tr  
               td  
                div style="font-family:'Sans Serif'; font-size:16px"  
                 div style="color:#000000; line-height:normal; font-family:sans-serif; font-size:12px"  
                  h1 style="margin:20px 0px 16px; color:#222222; text-transform:none; line-height:48px; text-indent:0px; letter-spacing:normal; font-family:OpenSans-Bold; font-size:44px; font-style:normal; font-weight:normal; word-spacing:0px; white-space:normal; text-align:center"  a data-saferedirecturl="https://www.google.com/url?q=http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" font-size:="" href="http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" rel="noopener" sans="" style="font-family: " target="_blank" text-align:=""  img alt="" class="CToWUd" src="http://www.reveforly.icu/7375L23m95QM7aP12KdsD7boH25eP23FHD5ItIIfYIvisrxth4wEG.10WdcRKm9cn97t1suJW05n@rXx/psychosocial-glower" /  /a  span style="font-family:'Arial'"  span style="color:#d50000"  strong  span style="color:#e60000" Breaking News:  /span  /strong  /span  span style="color:#00
 0000"  strong 51lbs in 61 Days: New No-Exercise  Skinny Pill' Melts Belly Fat /strong  /span  /span  /h1  
                  p style="text-align:center; color:#222222; line-height:21.6px; font-family:'Sans Serif'; font-size:18px; margin-bottom:15px"  br /   a data-saferedirecturl="https://www.google.com/url?q=http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" href="http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" rel="noopener" target="_blank"  img alt="" class="CToWUd" src="http://www.reveforly.icu/8t96B23G9t5D7qam10gdl7cQ25eQ23DHD5ItIIfYIvisrxth4wEG.10JdcRKm9cn95Cku106elXrxL/Chicanos-logic" style="width: 550px; " /  /a  /p  
                  p style="margin:0px; padding:0px; text-align:center; color:#222222; line-height:23px; font-family:'Sans Serif'"  a data-saferedirecturl="https://www.google.com/url?q=http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" font-size:="" href="http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" rel="noopener" sans="" style="font-family: " target="_blank" text-align:=""  img alt="" class="CToWUd" src="http://www.reveforly.icu/dawn-Osborne/1d44o2395L7Caw11udW7CdU25eI23lHD5ItIIfYIvisrxth4wEG.10WdcRKm9cn95Qs1R06ulrUx@" style="width: 550px; " /  /a  /p  
                  p style="margin:0px; padding:0px; text-align:center; color:#222222; line-height:23px; font-family:'Arial'"  br /   br /   strong  span style="color:#0000ff"  a data-saferedirecturl="https://www.google.com/url?q=http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" href="http://www.reveforly.icu/grandchild-biped/9ae5V23z95k8Ol611yd7N8nP25eo23LHD5ItIIfYIvisrxth4wEG.10ndcRKm9cn95HuR105fkLrx" rel="noopener" style="color:#0000ff; font-size:36px" target="_blank"  span style="font-size:36px; " How about a recommendation? br /   br /  See what the SHARKS think! /span  /a  /span  /strong  /p  
                  p style="margin:0px; padding:0px; text-align:center; color:#222222; line-height:23px; font-family:Verdana,Geneva,sans-serif"    /p  
                 /div  
                /div   br /   br /   br /   br /    
                div style="text-align: center; " 
                 span style="font-size:11px; " To unsubscribe please click the link below or write to: br /  A/43, amarabati , city Kolkata West Bengal 700110 br /   a href="http://www.reveforly.icu/Chicanos-logic/c9c6A2Vm395c8aSZ10Od7P9L25eK23vHD5ItIIfYIvisrxth4wEG.10cdcRKm9cn97wvS1vg05t@prx" Automatically Unsubscribe Here /a  a href="http://www.reveforly.icu/Palomar-replicates/8at6fm2_395WY89g11SAd7LaP25eU23LHD5ItIIfYIvisrxth4wEG.10IdcRKm9cn95gS1y06sOrWxk"   /a  /span 
                /div   /td  
              /tr  
             /tbody  
            /table   /td  
          /tr  
         /tbody  
        /table   /td  
      /tr  
     /tbody  
    /table  
   /center    
  img src="http://www.reveforly.icu/8455R239g5kBO8511igd7epQ25eF23EHD5ItIIfYIvisrxth4wEG.10vdcRKm9cn97SgW10SJ6R1ANrx/furtiveness-credibly" alt=""/  /body 
 /html 

------=_Part_1918_1394353944.1597428440311--

[MMMMMMMMM]

URIBL_BLOCKED=0.001 - rozjeď si na serveru vlastní kešující rekurzivní DNS. S tím DNS, který nyní v systému používáš, dochází k blokaci DNS dotazů (pro black/white listy). Jinak osobně doporučuju si některé testy trošku potunit a dát jim vyšší skóre. Např. já používám

score DCC_CHECK 3.5
score RAZOR2_CHECK 2.5
score PYZOR_CHECK 2.5 

[j]

Jestli maj ty maily i stejnej podpis ... (ten dkim) tak quick solution = rucne blokni prave ten.

---

Dete s tim guuglem dopice!

[Josef Kufner]

Můj spamassasin už se na to natrénoval. Ale docela mu to trvalo. Rozchoď si trénování přesunem do spam složky a chvíli to vydrž.

[Fila]

Uz asi pul roku se snazim o neco podobného a spoustim

 /usr/bin/sa-learn --spam /sysdata/vmail/domains/mojedomena.cz/filip/mail/.Junk

s vystupem

Learned tokens from 12 message(s) (12 message(s) examined)

, ale zadnou zmenu neregistruju. Asi delam neco blbe.

[Josef Kufner]

Koukni na Replacing antispam plugin with IMAPSieve. Je to o něco pohodlnější.

[AraxoN]

Prešiel som zo Spamassassin na Rspamd a konečne mám pocit, že trénovať spamy má zmysel.

[Milan Uhrák]

thunderbird mi po zařazení do spamu ( a vytvoření složky pro spam ) po třech (?) emailech ničí spam na počkání. Dovecot+postfix, no spamassasin ....

Milan

[Fila]

jj, to je pravda.. jenze ja nelezu do mailu jen pres TB, ale spis přes RC a klienta v mobilu

[Max]

Doporučuji zprovoznit kontrolu na blacklistech a dávat za to bodové hodnocení. Neskutečně se to pak pročistí. Některé blacklisty ale vyžadují volání z vlastních dns serverů (tzn. nepoužívat google dns ani dns od ISP, ale mít nastavený bind jako kešující dns server, co nemá nastavený žádný forwarde).
FuzzyOCR apod. také nebývají standardně ve spamassasinu a musí se doladit zvlášť.
Zdar Max

[Fila]

Blacklisty se mi kontrolujou, spousta mailu mi nedojde ani do spamu a zustavaji na serveru v karantene.. ale tohle proste proleze

[Aleš Kapica]

Použij to v kombinaci s fail2ban. Ten kontroluje logy. Pokud je v něm něco čeho se bude moct chytit, tak zablokuješ otravný server dřív než stihne poslat něco dalšího a budeš mít klid.

[chinook]

Jaké blacklisty doporučuješ? A jde kontrolovat i obsah emailu na blacklistech, třeba závadné odkazy?

[Max]

Tak samozřejmě, to je základ (kontrola linků v mailu). Používám URIBL (je potřeba vlastní dns server).
Zdar Max