1

Topic: Spam

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 0.9.9
- Deployed with iRedMail Easy or the downloadable installer? installer
- Linux/BSD distribution name and version: Debian 8
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): Mysql
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====


Hello iRedMail Team,

i receive the last days a lot of spam. The most times, I can see in the log file this connection:
from mail.longtermchallenge.com (vpsnode32.webstudio50.com [2.58.126.8])  or
from mail.mediameaning.com (vpsnode30.webstudio48.com [213.142.151.66])

First I blocked the IP addresses, but the spammer are change every times.
I add a lot of rbl-list, but no changes.
DKIM and also SPF from spammer is OK


Is there a solution to block vpsnodeXX.webstudioXX.com

thx

zicke007

2 (edited by Neutro 2020-02-06 19:17:08)

Re: Spam

Hello,

As explained here:

https://forum.iredmail.org/topic13847-b … mains.html

cd /opt/iredapd/tools/
python wblist_admin.py --add --blacklist '@.webstudio@'

Also you can try enabling greylisting if you disabled it.

3

Re: Spam

Is not working for me. I receive a other spam mail.
See the log file:

Received: from mail.healthierchallenge.com (vpsnode32.webstudio50.com [2.58.126.6])


In the database amavisd, table mailaddr i can see thid new record:
ID  pirority   email
1       2        @.webstudio@

4

Re: Spam

etc\postfix\sender_access.pcre

/webstudio\d{1,2}\.com$/ REJECT

root@mail:~# postmap -q 'ykcuwdj@webstudio12.com' pcre:/etc/postfix/sender_access.pcre
REJECT

5

Re: Spam

Is not working for me. Have a look at the mail.log:
mail.bestmediamarket.com (vpsnode32.webstudio50.com [2.58.126.14])


My config:
/etc/postfix/main.cf:
check_sender_access pcre:/etc/postfix/sender_access.pcre

/etc/postfix/sender_access.pcre:
/webstudio\d{1,2}\.com$/ REJECT


Test:
postmap -q 'ykcuwdj@webstudio12.com' pcre:/etc/postfix/sender_access.pcre
REJECT

6

Re: Spam

The hostname "vpsnodeXX.webstudioYY.com" is reverse DNS, you cannot block it in /etc/postfix/sender_access.pcre.
Please try this:

*) Add smtpd_client_restrictions rule in /etc/postfix/main.cf like this:

smtpd_client_restrictions =
    permit_mynetworks
    permit_sasl_authenticated
    check_client_access pcre:/etc/postfix/rdns.pcre

*) Add file /etc/postfix/rdns.pcre with content below:

/webstudio\d+\.com$/ REJECT

*) Restart or reload Postfix service.

----

Does my reply help a little? How about buying me a cup of coffee ($5) as an encouragement?

buy me a cup of coffee