Mar 11 08:24:58 Nethserver clamd[6181]: SelfCheck: Database status OK.
Mar 11 08:27:50 Nethserver rspamd[5964]: <acc2a9>; csession; rspamd_controller_check_password: allow unauthorized connection from a trusted IP 127.0.0.1
Mar 11 08:27:50 Nethserver rspamd[5964]: <acc2a9>; csession; rspamd_mime_text_to_utf8: converted from ISO_8859-1:1987 to UTF-8 inlen: 139, outlen: 139
Mar 11 08:27:50 Nethserver rspamd[5964]: <acc2a9>; csession; rspamd_message_parse: loaded message; id: <4B5E45DB5D50C0C3D6CD53D5D8484B5E@3G14F9O9R5>; queue-id: <undef>; size: 1364; checksum: <f1cb9215a3a0bfeb70373548a2c14525>
Mar 11 08:27:50 Nethserver rspamd[5964]: <acc2a9>; csession; fuzzy_generate_commands: <4B5E45DB5D50C0C3D6CD53D5D8484B5E@3G14F9O9R5>, part is shorter than 1000 bytes: 278 (139 * 2.00 bytes), skip fuzzy check
Mar 11 08:27:50 Nethserver rspamd[5964]: <acc2a9>; csession; fuzzy_generate_commands: <4B5E45DB5D50C0C3D6CD53D5D8484B5E@3G14F9O9R5>, part is shorter than 1000 bytes: 278 (139 * 2.00 bytes), skip fuzzy check
Mar 11 08:27:53 Nethserver rspamd[5964]: <acc2a9>; lua; url_redirector.lua:161: found redirect from https://goo.gl/TdmLYP to http://trustinfomarket.su/?157977032, err code 301
Mar 11 08:27:53 Nethserver rspamd[5964]: <acc2a9>; surbl; surbl_continue_process_handler: <4B5E45DB5D50C0C3D6CD53D5D8484B5E@3G14F9O9R5> got reply from redirector: 'https://goo.gl/TdmLYP' -> 'http://trustinfomarket.su/?157977032'
Mar 11 08:27:53 Nethserver rspamd[5964]: <acc2a9>; surbl; process_dns_results: <4B5E45DB5D50C0C3D6CD53D5D8484B5E@3G14F9O9R5> domain [trustinfomarket.su.dbl.spamhaus.org] is in surbl dbl.spamhaus.org(201007f)
Mar 11 08:27:57 Nethserver rspamd[5964]: <acc2a9>; csession; bayes_classify: skip classification as ham class has not enough learns: 37, 200 required
Mar 11 08:27:57 Nethserver rspamd[5964]: <acc2a9>; csession; rspamd_task_write_log: id: <4B5E45DB5D50C0C3D6CD53D5D8484B5E@3G14F9O9R5>, ip: 102.158.229.231, from: <ness@samsun.co.kr>, (default: T (reject): [32.60/20.00] [DBL_SPAM(6.50){trustinfomarket.su.dbl.spamhaus.org;},SPAM_FLAG(5.00){},ONCE_RECEIVED_STRICT(4.00){},RBL_SPAMHAUS_XBL_ANY(4.00){},MX_INVALID(3.00){},HFILTER_HOSTNAME_UNKNOWN(2.50){},MX_MISSING(2.00){query timed out;},RBL_SPAMHAUS_CSS(2.00){231.229.158.102.zen.spamhaus.org : 127.0.0.3;},RBL_SPAMHAUS_PBL(2.00){231.229.158.102.zen.spamhaus.org : 127.0.0.11;},RDNS_NONE(1.00){},MID_RHS_NOT_FQDN(0.50){},DMARC_POLICY_SOFTFAIL(0.10){samsun.co.kr : No valid SPF, No valid DKIM;none;},MIME_GOOD(-0.10){text/plain;},ONCE_RECEIVED(0.10){},ASN(0.00){asn:37705, ipnet:102.158.0.0/16, country:TN;},DIRECT_TO_MX(0.00){Microsoft Windows Live Mail 16.4.3505.912;},FREEMAIL_ENVRCPT(0.00){attglobal.net;},FREEMAIL_TO(0.00){attglobal.net;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_X_PRIO_THREE(0.00){3;},PREVIOUSLY_DELIVERED(0.00){eddie_atherton@attglobal.net;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ONE(0.00){1;},RCVD_NO_TLS_LAST(0.00){},RECEIVED_SPAMHAUS(0.00){231.229.158.102.zen.spamhaus.org;},R_DKIM_NA(0.00){},R_SPF_NA(0.00){},TO_DN_NONE(0.00){}]), len: 1364, time: 7314.034ms real, 14.160ms virtual, dns req: 28, digest: <f1cb9215a3a0bfeb70373548a2c14525>, mime_rcpt: <eddie_atherton@attglobal.net>
Mar 11 08:37:50 Nethserver clamd[6181]: SelfCheck: Database status OK.Mar 11 08:27:57 Nethserver rspamd[5964]: <acc2a9>; csession; rspamd_protocol_http_reply: regexp statistics: 76 pcre regexps scanned, 3 regexps matched, 163 regexps total, 7 regexps cached, 5.88k bytes scanned using pcre, 5.88k bytes scanned total
Mar 11 08:41:57 Nethserver postfix/smtpd[29331]: connect from unknown[36.66.238.11]
this is the full logs, I do not understand the first line…it is likely pop3 proxy bypass the postfix milter @davidep ???
yep pop3 proxy is the target
Mar 12 08:48:06 Nethserver postfix/anvil[12079]: statistics: max cache size 1 at Mar 12 08:41:32
Mar 12 08:51:06 Nethserver rspamd[5964]: <7c231d>; csession; rspamd_controller_check_password: allow unauthorized connection from a trusted IP 127.0.0.1
Mar 12 08:51:06 Nethserver rspamd[5964]: <7c231d>; csession; rspamd_message_parse: loaded message; id: <0.1.1F.E1A.1D3BA19E0E30C7C.0@drone184.ral.icpbounce.com>; queue-id: <undef>; size: 46467; checksum: <b6fdcc470eb57d2df95f9969cf8a61ab>
Mar 12 08:51:07 Nethserver rspamd[5964]: <7c231d>; surbl; process_dns_results: <0.1.1F.E1A.1D3BA19E0E30C7C.0@drone184.ral.icpbounce.com> domain [icptrack.com] is in surbl uribl.rspamd.com
Mar 12 08:51:07 Nethserver rspamd[5964]: <7c231d>; surbl; process_dns_results: <0.1.1F.E1A.1D3BA19E0E30C7C.0@drone184.ral.icpbounce.com> domain [icptrack.com.multi.uribl.com] is in surbl multi.uribl.com(4)
Mar 12 08:51:08 Nethserver rspamd[5964]: <7c231d>; surbl; process_dns_results: <0.1.1F.E1A.1D3BA19E0E30C7C.0@drone184.ral.icpbounce.com> domain [icontact.com.multi.uribl.com] is in surbl multi.uribl.com(4)
Mar 12 08:51:10 Nethserver rspamd[5964]: <7c231d>; csession; bayes_classify: skip classification as ham class has not enough learns: 106, 200 required
Mar 12 08:51:10 Nethserver rspamd[5964]: <7c231d>; csession; rspamd_task_write_log: id: <0.1.1F.E1A.1D3BA19E0E30C7C.0@drone184.ral.icpbounce.com>, ip: 207.254.213.241, from: <bounces@icpbounce.com>, (default: F (rewrite subject): [6.80/20.00] [RAMBLER_URIBL(4.50){icptrack.com;},URIBL_GREY(1.50){icptrack.com.multi.uribl.com;icontact.com.multi.uribl.com;},R_DKIM_REJECT(1.00){icontactmail3.com;},MV_CASE(0.50){},MX_GOOD(-0.50){bounces001.icpbounce.com;},R_SPF_ALLOW(-0.20){+ip4:207.254.213.192/26;},MIME_GOOD(-0.10){multipart/alternative;text/plain;},ONCE_RECEIVED(0.10){},ASN(0.00){asn:7349, ipnet:207.254.208.0/20, country:US;},DMARC_NA(0.00){seasmoke.com;},FREEMAIL_ENVRCPT(0.00){attglobal.net;},FREEMAIL_TO(0.00){attglobal.net;},FROM_HAS_DN(0.00){},FROM_NEQ_ENVFROM(0.00){customerservice@seasmoke.com;bounces@icpbounce.com;},HAS_REPLYTO(0.00){customerservice@seasmoke.com;},PREVIOUSLY_DELIVERED(0.00){eddie_atherton@attglobal.net;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ONE(0.00){1;},RCVD_IN_DNSWL_NONE(0.00){241.213.254.207.list.dnswl.org : 127.0.15.0;},RCVD_NO_TLS_LAST(0.00){},REDIRECTOR_FALSE(0.00){seasmoke->click.icptrack.com;},REPLYTO_ADDR_EQ_FROM(0.00){},RWL_MAILSPIKE_GOOD(0.00){241.213.254.207.rep.mailspike.net : 127.0.0.18;},TAGGED_FROM(0.00){656879.14961151.875882;},TO_DN_NONE(0.00){}]), len: 46467, time: 3262.015ms real, 22.761ms virtual, dns req: 67, digest: <b6fdcc470eb57d2df95f9969cf8a61ab>, mime_rcpt: <Eddie_Atherton@attglobal.net>
Mar 12 08:51:10 Nethserver rspamd[5964]: <7c231d>; csession; rspamd_protocol_http_reply: regexp statistics: 112 pcre regexps scanned, 1 regexps matched, 163 regexps total, 7 regexps cached, 144.61k bytes scanned using pcre, 144.61k bytes scanned total
Mar 12 09:00:38 Nethserver postfix/smtpd[12679]: connect from unknown[185.234.216.190]
no where the postfix milter is invocated after the transaction