Spam messages garbled and delivered to Inbox

Albrecht Dreß albrecht.dress at lios-tech.com
Tue Mar 24 14:25:31 CET 2009


Hi all,

I have a question about "weird" messages being delivered through  
Kolab.  They are spam messages which have been detected as such (by  
MailScanner/spamassassin) on a box which is sitting between the Kolab  
server and the internet, on a different machine.

The message header somehow gets "mixed up" which as a result will drop  
the message in the Inbox instead of the junk box.  The headers of such  
a message contain (non-printable chars included):

<snip>
Date: Mon, 23 Mar 2009 18:37:44 +0100 (CET)\r
To: undisclosed-recipients:;\r
X-Kolab-Scheduling-Message: FALSE\r
\r
" <ipffjexxqlhkwe at sch.city.kobe.jp>\r
Reply-To: "=?ISO-2022-JP?B?GyRCMkZMXDZNMlYbKEIK?=\r
" <ipffjexxqlhkwe at sch.city.kobe.jp>\r
To: albrecht.dress at xxx.yyy\r
Subject:  
\203n\203b\203L\203\212\214\276\202\301\202\304\202\242\202\253\202\310\202\350\211\357\202\244\202\314\202\306\202\251\226\263\227\235\202\305\202\267\201B\r
Date: Mon, 23 Mar 2009 15:29:48 -0200\r
MIME-Version: 1.0\r
[...more headers...]
X-my-org-MailScanner-SpamCheck: spam, SpamAssassin (Wertung=22.83,\r
\tbenoetigt 4, autolearn=spam, BAYES_99 8.00, MISSING_MIMEOLE 0.00,\r
\tRCVD_HELO_IP_MISMATCH 2.84, RCVD_IN_PBL 0.91, RCVD_NUMERIC_HELO  
2.07,\r
\tRDNS_NONE 0.10, SUBJECT_NEEDS_ENCODING 0.00, SUBJ_ILLEGAL_CHARS  
1.59,\r
\tTVD_RCVD_IP 1.93, TVD_RCVD_IP4 3.18, TVD_SPACE_RATIO 2.22)\r
X-my-org-MailScanner-SpamScore: ssssssssssssssssssssss\r
</snip>

Note the extra newline after the "X-Kolab-Scheduling-Message:" header.   
I *think* that this newline has not been there when the message has  
been received on the first server (the one between the Internet and  
Kolab) as the Postfix/Mailscanner on that box adds the  
"X-my-org-MailScanner*" headers.  So, where does it come from?  Any  
ideas?

Thanks, Albrecht.




More information about the users mailing list