hMailServer forum

SorenR

While Namecheap came back to me with yet another list of domains they have suspended, I have had NO LUCK with Namesilo. Those fcukers are just persistant. The Whois entries for the domains in question are protected by PrivacyGuardian.org and I had a look at them. They may disclose the identity of th...

SorenR

SUCCESS! It turns out those guys at Namecheap are awesome! Domains are still listed in Whois BUT! mxtoolbox cannot find the suspended ones so it appear they have no DNS records. :mrgreen: Hello, Thank you for your email. While the following domain names are registered with Namecheap, they are hosted...

SorenR

jimimaseye wrote: ↑
2019-03-16 01:51
That is the namecheap TnC. I thought you were taking about namesilo that were being non helpful.

Namesilo have similar wording in their Terms and Conditions.

https://www.namesilo.com/terms.php Chapter 5, section vi

Maybe I should write them an email and remind them

SorenR

The problem there is they cannot terminate the domain because the domain will have been bought by the spammer and as such he will own it. The Host can disconnect the hosting service however as that will be a contravention of the terms. The spammer can't take his domain and set up in any other hosts...

SorenR

Well, after feeding Namecheap and Namesilo a handsome number of "unused UCE/SPAM" email they've responded. Namecheap Legal & Abuse Team have consolidated all the domains into one case and are actively looking into it. They recognise the domains are listed in SURBL and Spamhaus DBL and ask for 48 hou...

SorenR

ChrisBDirectD wrote: ↑
2019-03-14 12:42
Thanks, do you meant turn off push so you have to check for mail manually?

Many thanks for your help with this.

That is what I am told. The problem is most often in combination with POP3.

SorenR

nice I think I shall play with that concept I hit a showstopper on the continued development... The "Whois Abuse Contact" was actually a picture :evil: Option Explicit Dim sURL, sHTML, sWhois, Match, Matches, Email, Emails sURL = "https://www.whois.com/whois/" & "exvoice.icu" With CreateObject("MSX...

SorenR

Hi all, I wonder if anyone can offer advice, I have one particular user who intermittently has issues with sending emails, he is using an iphone, recently upgraded to s max and the problem still persist as it did with his old phone. Sometimes when trying to send an email but not all times it give h...

SorenR

Latest addition is an UCE list ... Let's see if I can piss some people off :mrgreen: Oh and... To stop the complaints from coming, they need to stop the SPAM mails from coming :mrgreen: I have added to my XML "directory" <UCE> <namesilo>^(mail\.danzamor\.com)$</namesilo> <namesilo>^(mail\.downpic\.c...

SorenR

Oh but what are 60 seconds... A mere minute... A minute passes quickly...

https://www.youtube.com/watch?v=xet6r5nNlnI

SorenR

Botnet looks for possible botnet sources of email by checking various DNS values that indicate things such as other ISP's clients or workstations, or misconfigured DNS settings that are more likely to happen with client or workstation addresses than servers. https://github.com/eilandert/Botnet.pm NO...

SorenR

So by tagging mails with this List-Unsubscribe header as SPAM, SpamAssassin will eventually see it as SPAM. By "tagging" do you mean your script above hit by rule? Sub SPAMList(oMessage, strMatch) Dim i If (oMessage.HeaderValue("X-hMailServer-Spam") = "YES") Then i = CInt(oMessage.HeaderValue("X-hM...

SorenR

Try this ... In hmailserver.ini [Settings] add "DNSBLChecksAfterMailFrom=0"

DNSBLChecksAfterMailFrom - By default, hMailServer runs DNS blacklists checks after SMTP/MAIL FROM. Some users prefer to have it running after the SMTP/RCPT TO command. In this case, set the value of this setting to 0.

SorenR

I don't know if anyone else has noticed this, but when I spend a lot of time in hMailServer Administrator, it's responsiveness starts to becomes sluggish and so does the mail server itself (connected mail clients clearly start taking longer to load messages, change folders, save draft messages, etc...

SorenR

I'm guessing my situation is a bit different than yours as well SorenR. Your suggested scripts indicate that you are putting in 100% confidence into the spamhaus zen list and lashback to block emails. Given the large number of customer email addresses I host, I can't do that. If it was only my comp...

SorenR

I just checked 25 of the last spam messages that came through and 25 of the last legit sending domains in my inbox. All of the spam domains had no website or threw out a 403 forbidden and all 25 legit domains have a valid website at the root domain. I haven't seen any spam filtering options to do t...

SorenR

Is there a way to script adding a spam reason and spam score to the current list before hMailServer checks the total spam score? Is scripting the best way to achieve this or is there an easier way for me to plug in another external spam filter? So with all your fancy SPAM fighting and many years of...

SorenR

The code below is the "beginners framework" without ANY exceptions that may apply to your network. Sub OnHELO comes from the "unofficial" build of hMailServer and in lack of this trigger, it can be moved to OnSMTPData. SnowShoe SPAM https://www.spamhaus.org/faq/section/Glossary#233 LashBack RBL is a...

SorenR

https://vdhout.nl/category/hmailserver/page/2

Using the SEARCH function here you can find MANY cool tips on SPAMFighting.

For a start look here viewtopic.php?f=20&t=33602

SorenR

Even so, I still result in -ve1.1 score (default rules). How comes yours hit spam level just because of the extra +0.9 from that particular rule score? (Even without my bayes score it would be only +1.0) Ah.. We'r Danish. When we do stuff, we follow thru :mrgreen: BOTNET_IPINHOSTNAME is a custom pl...

SorenR

(My Observation: I bet your son is LOVING the fact you're seeing his private emails from his girlfriends. :lol: ) Ah... I have elected to only log certain headers in my daily logs, but when something is marked for SPAM, it IS MINE ... ALL MINE ... Muah ha ha ha ha ... Anyways, it was only a school ...

SorenR

1 observation... Vanilla 3.4.0: Header eval fails on hotmail addresses as these now come from "outlook.com" !! * 0.9 FORGED_HOTMAIL_RCVD2 hotmail.com 'From' address, but no 'Received:' It turns out this issue dates back to 2017. It took until today that my son received mail from a girl who is using ...

SorenR

I received an email that threatens to blackmail me unless I pay them. I have no intension of paying. Let them have at it since what they claim is not true. I have no camera on my computers. Only my ipad has a camera. Found today that this actually have a name... https://en.wikipedia.org/wiki/Sextor...

SorenR

haveibeenpwned.com - is this for real??? They say this email has been pwned, but there's no proof of that. Just try to use any admin@ accounts, like admin@google.com or admin@applie.com even admin@whitehouse.gov They say they all been pwned. Really ?! :roll: Seems like an advertisement for 1passwor...

SorenR

ozgurerdogan wrote: ↑
2019-02-21 15:53
Around 40 domains and 1200 users.

Yeah.. More RAM should do it. If you are serious about 64 bit you should have a look at Dravions builds...

viewtopic.php?p=209615#p209615

SorenR

ozgurerdogan wrote: ↑
2019-02-21 15:39
So this time instead of memory overload, this io load rises. So maybe increasing memory is better idea.

How many domains and users ? Ca...

SorenR

When using internal sa (same box at HM installed) to check spam mails, it causes memory load on server. So I think of using an external box for sa. My question is, when using external box of sa, will every mail be sent and recieved between hm and sa? thus causing high io and traffic between hm and ...

SorenR

You would need something like ... static (inside,outside) tcp interface smtp 192.168.0.50 smtp netmask 255.255.255.255 static (inside,outside) tcp interface imap4 192.168.0.50 imap4 netmask 255.255.255.255 It's from my (very) old Cisco ASA5505 however it may not fit your 1841... Time to dig out the ...

SorenR

A little while back I changed my Spam routine. I used to reject all above about 15 on my system, catch all 7-15 in Quarantine, and pass 6 and under (I have fairly high scores and deliberately inflate SpamAssassin Scores) Now I accept and quarantine everything from 7 and up, with an account level ru...

SorenR

About the matter of the loop... Ever since version 4.2, hMailServer have a "Rules loop count" in hMailAdmin -> Settings -> Protocols -> SMTP [Advanced] to not allow looping to continue forever. When first forwarding an email, hMailServer add a header "X-hMailServer-LoopCount" containing the number o...

SorenR

Been running this isLashBack() function over the weekend... The listings are determined objectively and systematically. Only IPs that send email to specially-created, LashBack owned-and-monitored email addresses (unsubscribe probes) -- that are used only on suppression lists -- are blacklisted. You ...

SorenR

It seems that it's been accounted for here... :maildata echo %time% Stopping Hmailserver service...>> %BackLog%& net stop hmailserver >> %BackLog% set FailedHmailservice=Ok set bold=%noBold%&set fontcolor=%fontBlack% if errorlevel 1 set Failed=true &set FailedHmailservice=Failed to stop. Backup of e...

SorenR

I run this monitor on my server via Scheduler every 10 minutes. 90% of the code is actually the logfile writer :roll: The section "CODE" is where the action is. I do a simple check here but this could easily be expanded to do the SMS thingy via API to a GSM device, a SMSC/MMSC connected to a GSM ba...

SorenR

I run this monitor on my server via Scheduler every 10 minutes. 90% of the code is actually the logfile writer :roll: The section "CODE" is where the action is. I do a simple check here but this could easily be expanded to do the SMS thingy via API to a GSM device, a SMSC/MMSC connected to a GSM bac...

SorenR

We get a couple of them every week... SCAM! Those of our laptops with cams have stickers on them so that's how we know. Also some of them claim to have a "webbug/tracker" in the email so the scammer will know if we read it... BOOOO... They forgot... :mrgreen: Delete it and forget it... OTOH... Bette...

SorenR

palinka wrote: ↑
2019-02-16 00:53
I get those all the time. I guess some old people fall for that stuff, or at least that's what we're told.

Recipient of this is in Denmark... Postal prices are mental here...

SorenR

Deleted my last post... this fell into the trap: mail-oln040092254091.outbound.protection.outlook.com

spamhaus do have some bugs

SorenR

A guy I know started receiving SPAM the old fashioned way. What is happening to the world?

SorenR

I too use ClamAV via SpamAssassin and must admit that I am thinking of killing ClamAV via hMailServer as 99% of my ClamAV hits come via SpamAssassin. Does SA delete the attachment? I thought it just assigned a score. I rather prefer the slightly safer road of deleting the attachment. I changed my s...

SorenR

Just for the record, I'm still on 0.99.2 and the following SaneSecurity extensions.. rsync://rsync.sanesecurity.net/sanesecurity;phish.ndb;N;Y;Y;N;N rsync://rsync.sanesecurity.net/sanesecurity;rogue.hdb;N;Y;Y;N;N rsync://rsync.sanesecurity.net/sanesecurity;sanesecurity.ftm;N;N;Y;N;N rsync://rsync.sa...

SorenR

rzane0110 wrote: ↑
2019-02-13 12:00
I do no think that you need a software for that, you can simply go into the control panel and switch off auto updates.

Have you ever used Windows 10 ?

SorenR

This is potentially an IMPORTANT update. If a lookup in the XML file returns "", the RegEx Lookup/oLookup WILL MATCH EVERYTHING. The change is altering ---> Function LoadXMLNode(oXML, MyNode) : LoadXMLNode = "" to ---> Function LoadXMLNode(oXML, MyNode) : LoadXMLNode = " THIS CANNOT BE EMPTY " I cam...

SorenR

This should take care of; 1: 127-0-0-1 2: 127-000-000-001 3: 1-0-0-127 4: 001-000-000-127 Dim a, b(3), i, strRegEx a = Split(oClient.IPAddress, ".") For i = 0 to 3 b(i) = Right("00" & a(i),3) Next strRegEx = "(" & a(0) & "-" & a(1) & "-" & a(2) & "-" & a(3) & ")|" &_ "(" & b(0) & "-" & b(1) & "-" & ...

SorenR

"SMTPD" 2052 3 "2019-02-11 01:27:19.137" "191.19.107.164" "SENT: 220 mx.acme.inc ESMTP" "SMTPD" 2052 3 "2019-02-11 01:27:19.418" "191.19.107.164" "RECEIVED: EHLO 191-19-107-164.user.vivozap.com.br" "SMTPD" 2052 3 "2019-02-11 01:27:19.528" "191.19.107.164" "SENT: 554 5.3.0 CODE10 Your access to this...

SorenR

Dim a, strRegEx a = Split(oClient.IPAddress, ".") strRegEx = "(" & a(3) & "-" & a(2) & "-" & a(1) & "-" & a(0) & ")|(" & a(0) & "-" & a(1) & "-" & a(2) & "-" & a(3) & ")" If Lookup(strRegEx, oClient.HELO) Then Result.Value = 2 Result.Message = "530 CODE10 Your access to this mail system has been re...

SorenR

Had a closer look at my raw SMTP logs ... oops ... I do get them, but they are denied as sender and recipient are the same and my domain require authentication. Hmm... I got 1 Friday, 2 Saturday and today at 5 PM it really took off... I see some of them have the IP address the "right way" "SMTPD" 27...

SorenR

This is for IPv4 only. I must admit I have not seen one of those in a VERY VERY long time... Dim a a = Split(oClient.IPAddress, ".") If (InStr(1, oClient.HELO, a(3) & "-" & a(2) & "-" & a(1) & "-" & a(0), 1) > 0) Then Result.Value = 2 Result.Message = "530 CODE10 Your access to this mail system has ...

SorenR

I get a lot of these: 2019-02-10 01:02:22.199 RECEIVED: EHLO 24-121-219-54.erkacmtk02.com.sta.suddenlink.net It's a valid fqdn, i suppose. But it's bot net crap from a dynamic ip. SA filters them fine, but it would be great to reject them altogether. This appear the most I can cut it down and still...

SorenR

This will filter out ANY non-RFC compliant HELO/EHLO greeting. There are a lot of SPAM BOTs and infected clients/servers that can be captured using this. This is NOT a foolproof test and valid servers/clients MAY fail. That's why you MUST use a Whitelist BEFORE this test. I experience Outlook 365 cl...

SorenR

Installed. I'm not sure how useful the rest will be, but the reject on helo will slay a lot of spammers. The code in OnSMTPData(oClient, oMessage) I have in OnHELO(oClient) but since OnHELO(oClient) is not in the official build, I placed the code there. The benefit of moving it to OnHELO(oClient) i...

SorenR

I have been using this feature a while now and it is brilliant. I used to modify my Black/Whitelists directly in my script and reload/restart every time. Not anymore. Data is located in an XML file in the Events directory and I use Microsoft XML Notepad 2007 to edit the XML file across my SMB networ...

SorenR

No. These are RFC defined protocol communications and are independant of whatever clients are being used. (Why would it.) Well, no rule without the exception - as always :mrgreen: IMAP4 ID --> https://tools.ietf.org/html/rfc2971 name Name of the program version Version number of the program os Name...

SorenR

For some reason I had to set it to If X-hMailServer-LoopCount Less than 2. It is working now and only sending me one copy of the bounce messages. Thanks again for your help! The message is forwarded by some previous rule perhaps? If you have a server rule forwarding the message and later an account...

SorenR

RvdH wrote: ↑
2019-02-07 18:03

SorenR wrote: ↑
2019-02-07 18:00
Major flaw... You are not passing the "oMessage" object to the function. AND you need to save the oMessage object after any changes.
Oops...even I did not see that

Well, We can't all be perfect

... Damn we need a smiley with a halo

SorenR

There is a domain with several email addresses in my server. The addresses are for instance john@domain.com, jane@domain.com, bob@domain.com (there is about a dozen in total, but you get the idea). One of my providers sends its notifications to a service@domain.com. I am looking at the domain's add...

SorenR

Hello, If spamscore is below 9, spam messages goes to spam folder of the related account by a global rule. I also want to delete any attachments in those messages tagged as spam. For that I have added below function in EventHandlers and set a global rule to call this function when subject contains ...

SorenR

So it's not a technical issue, it's a trust issue... Development relay: Standard hMailServer with IP Range definition AND scripting/rules to validate sender domain. Production relay: Standard hMailServer with IP Range definition. You really need to stay off of the caffeine. You do not trust your de...

SorenR

SPF, DKIM and DMARC are ALL domain-centric. SSL certificates are server-centric.

Any deviation from this, is punished with 6 month in a virtual jail cell, wearing a read string with a bow on your right index finger.

SorenR

Pritorius wrote: ↑
2019-02-07 01:48

SorenR wrote: ↑
2019-01-29 01:46

Pritorius wrote: ↑
2019-01-29 01:42
A week later, they sent my request to the development Department. I'm waiting for an answer.
Send my reply above to the developers. They owe you a case of beers
Thank you! Bitrix24 developers have made a fix, everything works.

One is glad to be of service.

SorenR

Thank you Søren for your suggestion. I tried it and now I am not getting any non-delivery messages. A couple of questions. Did you purposely have me leave out the If Not contains line? Does hMailServer need to be restarted for the Rule to take effect? Thanks again for your help! hMailServer have a ...

Search found 2800 matches