奇怪的垃圾邮件

小苹果

最近老是收到一封奇怪的垃圾邮件，发件人姓名是Viagra.com Inc，但发件人的email却跟收件人相同，如果不注意设为黑名单，则把自己设到黑名单里了，真是郁闷呀！

该怎样阻止这样的垃圾邮件？请高手帮忙，谢谢！

[ 本帖最后由 小苹果 于 2007-10-8 11:00 编辑 ]

wxhsh

最好能有日志，这样就能分析如何封堵了。

小苹果

需要什么日志？

wxhsh

smtp-in中与这封邮件进入相关的日志。

stdmis

這種郵件使用貝葉斯學習解決。

小苹果

那封邮件显示9月20日3：40：44，查看MDaemon-20070920-SMTP（入）.log文件，有下面一段记录，请问再怎么办？qmail@dsl88.230-57382.ttnet.net.tr是真正的地址吗？

Thu 2007-09-20 03:40:42: Spam Filter score/req: -153.80/12.0
Thu 2007-09-20 03:40:42: 邮件创建 successful：e:\mdaemon\queues\inbound\md50000015633.msg
Thu 2007-09-20 03:40:42: --> 250 Ok, message saved <Message-ID: 20070919124116.24014.qmail@dsl88.230-57382.ttnet.net.tr>
Thu 2007-09-20 03:40:43: <-- RSET
Thu 2007-09-20 03:40:43: --> 250 RSET? Well, ok.
Thu 2007-09-20 03:40:43: <-- QUIT
Thu 2007-09-20 03:40:43: --> 221 See ya in cyberspace
Thu 2007-09-20 03:40:43: SMTP 会话成功（进/出字节：3328/400）
Thu 2007-09-20 03:40:43: ----------

小苹果

原帖由 stdmis 于 2007-9-19 13:04 发表
這種郵件使用貝葉斯學習解決。

用贝页斯学习了，明天看看管不管用

wxhsh

Spam Filter score/req: -153.80/12.0
太强了，－153.8分，白名单匹配也不过－100分，另－53.8分哪来的，感觉日志不够完整。

小苹果

原帖由 wxhsh 于 2007-9-20 09:40 发表
Spam Filter score/req: -153.80/12.0
太强了，－153.8分，白名单匹配也不过－100分，另－53.8分哪来的，感觉日志不够完整。

大侠，能不能讲的详细一点？怎么看这个日志里的内容？或者给发个如何分析这个日志文件的教程看看 因不清楚从哪里开始是这封邮件的进入日志，从03:40:39分记录的日志都在这里了

Thu 2007-09-20 03:40:39: Performing DKIM lookup
Thu 2007-09-20 03:40:39: *  File: e:\mdaemon\queues\temp\md50000011821.tmp
Thu 2007-09-20 03:40:39: *  Message-ID: 20070919124116.24014.qmail@dsl88.230-57382.ttnet.net.tr
Thu 2007-09-20 03:40:39: *  Result: neutral
Thu 2007-09-20 03:40:39: ---- End DKIM results
Thu 2007-09-20 03:40:39: Passing message through AntiVirus (Size: 3210)...
Thu 2007-09-20 03:40:39: *  发生错误，邮件将在排队时再次扫描
Thu 2007-09-20 03:40:39: ---- End AntiVirus results
Thu 2007-09-20 03:40:39: Passing message through Spam Filter (Size: 3210)...
Thu 2007-09-20 03:40:42: *  2.7 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
Thu 2007-09-20 03:40:42: *  3.0 MDAEMON_DNSBL MDaemon: marked by MDaemon's DNSBL
Thu 2007-09-20 03:40:42: * -100 USER_IN_WHITELIST From: address is in the whitelist
Thu 2007-09-20 03:40:42: * -100 USER_IN_WHITELIST_TO address is listed in 'whitelist_to'
Thu 2007-09-20 03:40:42: *  1.5 HEAD_ILLEGAL_CHARS Headers have too many raw illegal characters
Thu 2007-09-20 03:40:42: *  1.0 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
Thu 2007-09-20 03:40:42: *  0.0 HTML_MESSAGE BODY: HTML included in message
Thu 2007-09-20 03:40:42: *  0.0 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
Thu 2007-09-20 03:40:42: *  8.0 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
Thu 2007-09-20 03:40:42: *      [URIs: smellhistory.com pharmnewmake.com]
Thu 2007-09-20 03:40:42: *  3.0 URIBL_BLACK Contains a URL listed in the URIBL.com blacklist
Thu 2007-09-20 03:40:42: *      [URIs: pharmnewmake.com smellhistory.com]
Thu 2007-09-20 03:40:42: *  9.0 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
Thu 2007-09-20 03:40:42: *      [URIs: smellhistory.com pharmnewmake.com]
Thu 2007-09-20 03:40:42: *  9.5 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
Thu 2007-09-20 03:40:42: *      [URIs: smellhistory.com pharmnewmake.com]
Thu 2007-09-20 03:40:42: *  8.0 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
Thu 2007-09-20 03:40:42: *      [URIs: smellhistory.com pharmnewmake.com]
Thu 2007-09-20 03:40:42: *  0.5 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Thu 2007-09-20 03:40:42: ---- End SpamAssassin results
Thu 2007-09-20 03:40:42: Spam Filter score/req: -153.80/12.0
Thu 2007-09-20 03:40:42: 邮件创建 successful：e:\mdaemon\queues\inbound\md50000015633.msg
Thu 2007-09-20 03:40:42: --> 250 Ok, message saved <Message-ID: 20070919124116.24014.qmail@dsl88.230-57382.ttnet.net.tr>
Thu 2007-09-20 03:40:43: <-- RSET
Thu 2007-09-20 03:40:43: --> 250 RSET? Well, ok.
Thu 2007-09-20 03:40:43: <-- QUIT
Thu 2007-09-20 03:40:43: --> 221 See ya in cyberspace
Thu 2007-09-20 03:40:43: SMTP 会话成功（进/出字节：3328/400）
Thu 2007-09-20 03:40:43: ----------

小苹果

从日志里看，好像是由于垃圾邮件将发件人设成收件人了，因此分析时发件人和收件人都在白名单里，各得-100分，加起来-200分！！