[Postfixbuch-users] Mail beim falschen Empfänger eingeliefert?

Fr Mai 26 11:57:17 CEST 2006

* Zieba, Darius <Darius.Zieba at telemed.de>:
> ich habe ein Problem den ich nicht nachvollziehen kann. Vorgestern hat sich
> ein Mailuser beschwert, dass er eine Mail die nicht an ihn adressiert war
> erhielt. Erst dachte ich er hätte sich geirrt aber in den Logs fand ich
> merkwürdige Einträge;
> 
> May 23 07:59:33 xxxxx postfix/smtpd[8072]: A7B08209160: client=cpe-24-58-167-111.twcny.res.rr.com[24.58.167.111]
> May 23 07:59:34 xxxxx postfix/cleanup[6925]: A7B08209160: message-id=<20060523055933.A7B08209160 at x.txxxxd.de>
> May 23 07:59:35 xxxxx postfix/oqmgr[21320]: A7B08209160: from=<vwazswczdugjil at ciberaula.infase.es>, size=26446, nrcpt=2 (queue active)
> May 23 07:59:36 xxxxx postfix/cleanup[6578]: 278D820914B: message-id=<20060523055933.A7B08209160 at x.txxxxd.de>
> May 23 07:59:36 xxxxx postfix/smtp[6413]: A7B08209160: to=<hno-arxxxxx at txxxxd.de>, relay=127.0.0.1[127.0.0.1], delay=3, status=sent (250 2.6.0 Ok, id=08053-05, from MTA: 250 Ok: queued as 278D820914B)
> May 23 07:59:36 xxxxx postfix/smtp[6413]: A7B08209160: to=<hno-neyyyyy at txxxxd.de>, relay=127.0.0.1[127.0.0.1], delay=3, status=sent (250 2.6.0 Ok, id=08053-05, from MTA: 250 Ok: queued as 278D820914B)
> May 23 07:59:36 xxxxx postfix/oqmgr[21320]: A7B08209160: removed
> May 23 08:38:31 xxxxx postfix/cleanup[24242]: 55C31209159: message-id=<20060523055933.A7B08209160 at x.txxxxd.de>
> May 23 08:38:34 xxxxx postfix/cleanup[23894]: E8BD420915A: message-id=20060523055933.A7B08209160 at x.txxxxd.de <mailto:20060523055933.A7B08209160 at x.txxxxd.de> 
> 
>  
> Der Header den mir der User hno-neyyyyy at txxxxd.de zukommen ließ sieht so
> aus;
> 
> X-KENId: 00002718KEN12913932
> Return-Path: < <mailto:vwazswczdugjil at ciberaula.infase.es>
> vwazswczdugjil at ciberaula.infase.es>
> Received: from xx.xx.xx.xx:110
>    by KEN! (192.168.114.254:1225) with POP3
>    ; Tue, 23 May 2006 08:41:08 +0200
> Received: from localhost (localhost [127.0.0.1])
>    by xxxxx.txxxxd.de (Postfix) with ESMTP id 278D820914B;
>    Tue, 23 May 2006 07:59:36 +0200 (CEST)
> Received: from cpe-24-58-167-111.twcny.res.rr.com
> (cpe-24-58-167-111.twcny.res.rr.com [24.58.167.111])
>    by xxxxx.txxxxd.de (Postfix) with SMTP id A7B08209160;
>    Tue, 23 May 2006 07:59:33 +0200 (CEST)
> Received: from zipolite.com (unknown [78.16.192.206])
>    by promotionstat.com with SMTP id YZYMG60SJU
>    for <hno-arxxxxx at txxxxd.de <mailto:hno-arxxxxx at txxxxd.de> >; Tue, 23 May
> 2006 15:08:11 -0800
> Date: Tue, 23 May 2006 07:59:33 +0200 (CEST)
> From: "Swiss Invest company." < <mailto:iucunkfvoo at zipolite.com> iucunkfvoo at zipolite.com>
> Subject: ***Spam*** SWISS INVEST LTD OFFERS YOU A PRESTIGIOUS JOB/VACANCY.
> [Tue, 23 May 2006 15:08:11 -0800]
> Sender: "SWISS INVEST LTD." < <mailto:jdgrrgpkrxsqb at regiomontano.com> jdgrrgpkrxsqb at regiomontano.com>
> To: "Hno-arabellahaus" <hno-arxxxxx at txxxxd.de <mailto:hno-arxxxxx at txxxxd.de>
> >
> Message-Id: < <mailto:20060523055933.A7B08209160 at slxtmx.telemed.de>
> 20060523055933.A7B08209160 at xxxxx.txxxxd.de>
> Mime-Version: 1.0
> Content-Type: multipart/related; 
>    boundary="10G2VB4UTBVEMFQ8X98XNOP"
> X-KENRecTime: 1148366468
> X-KENAntiSpam: DNSBL:bl.spamcop.net, cbl.abuseat.org, blacklist.spambag.org
> X-Priority: 3 (Normal)
> X-AntiVir4Ken: checked by AntiVir for KEN!; host=server
>    ANTIVIR.VDF 6.34.01.122, AVEWIN32.DLL 6.34.01.58, AVPACK32.DLL
> 6.33.00.06,
>    AVDOWNLD.DLL 6.34.00.02, UNRAR.DLL 0.00.00.00, UNACEV2.DLL 2.6.00.00,
>    SAVAPI.DLL 6.33.00.00, SAVAKEN.DLL 6.33.00.04
> User-Agent: Internet Mail Service (5.5.2650.21)
> X-Mailer: Internet Mail Service (5.5.2650.21)
> Content-Scanner: amavisd-new at txxxxd.de 
> X-Spam-Level: ********************************
> X-Spam-Status: Yes, score=33.0 required=5.0 autolearn=spam
> X-Spam-Flag: YES
> X-Spam-Report: BAYES_99=1.886, DNS_FROM_RFC_POST=1.614,
> FORGED_IMS_HTML=2.034,
>    FORGED_MUA_IMS=2.37, HTML_30_40=0.021, HTML_FONT_LOW_CONTRAST=0.788, 
>    HTML_IMAGE_ONLY_12=2.942, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.177, 
>    MIME_QP_LONG_LINE=0.039, RCVD_IN_BL_SPAMCOP_NET=1.216, 
>    RCVD_IN_NJABL_DUL=0.088, RCVD_IN_SORBS_DUL=1.987, RCVD_IN_XBL=3.076, 
>    SPF_PASS=-0.001, UNWANTED_LANGUAGE_BODY=2.8, URIBL_OB_SURBL=3.213, 
>    URIBL_PH_SURBL=2, URIBL_SBL=0.996, URIBL_SC_SURBL=4.263, 
>    URIBL_WS_SURBL=1.462
> X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on xxxxx.txxxxd.de
> 
>  
> 
> Hat jemand schon was ähnliches gehabt??

Ja, man nennt es Spam...

Wo ist das Problem? Die Angaben im Header haben nichts mit dem Emfänger zu
tun? Das ist bei Spam durchaus üblich. Nahezu alle (!) Angaben im Header einer
E-Mail können gefälscht werden. Auf den Header braucht sich keiner zu
verlassen...

p at rick

-- 
Das Postfix-Buch
<http://www.postfix-buch.com>
saslfinger (debugging SMTP AUTH):
<http://postfix.state-of-mind.de/patrick.koetter/saslfinger/>