Home » Kerio User Forums » Kerio Connect » Spam Repellent logged, but message still delivered
Lyle M

Messages: 59

Karma: 7
Send a private message to this user
The following log entries appeared in my Security log for
[27/Aug/2013 09:48:03] SMTP Spam attack detected from, client sent data before SMTP greeting
[27/Aug/2013 09:48:33] SMTP Spam attack detected from, client sent data before SMTP greeting
[27/Aug/2013 09:55:03] IP address found in DNS blacklist ARM Labs-GBUdb, mail from <Senior-Advisory-Center@vaittale.me> to <kjames<_at_>fredericknewspost.com>

However, the payload of the 9:48:03 connection appears to have been delivered:

[27/Aug/2013 09:48:03] Recv: Queue-ID: 521cae12-00006937, Service: SMTP, From: <ReverseMortgCalc@vaittale.me>, To: <lyle@newspost.com>, Size: 8834, Sender-Host: fleapits.forecastexpress.info, Subject: Seniors Quickly Find Your Max Borrow Rate, Msg-Id: <2595809503890259561765756741<_at_>a3qnxi1cv.vaittale.me>

Return-Path: <ReverseMortgCalc<_at_>vaittale.me>
X-Spam-Status: No, hits=0.0 required=2.5
tests=BAYES_00: -1.665,HTML_MESSAGE: 0.001,MIME_HTML_ONLY: 0.001,
T_REMOTE_IMAGE: 0.01,TOTAL_SCORE: -1.653,autolearn=
Received: from 00910eb5.vaittale.me ([])
by mail.newspost.com
for lyle<_at_>newspost.com;
Tue, 27 Aug 2013 09:48:02 -0400
Received: by 00910eb5.a3qnxi1cv.vaittale.me
(amavisd-new, port 10595) with ESMTP id 00UIDTNCAY910EPRUTYVKPB5;
for <lyle<_at_>newspost.com>; Tue, 27 Aug 2013 06:47:43 -0700
Importance: Normal
Message-ID: <2595809503890259561765756741<_at_>a3qnxi1cv.vaittale.me>
To: lyle<_at_>newspost.com
From: "Reverse Mortg Calc" <ReverseMortgCalc<_at_>vaittale.me>
Content-Type: text/html; charset=us-ascii
X-Priority: 3 (Normal)
Reply-To: <bounce-9503890<_at_>vaittale.me>
Return-Path: <bounce-9503890<_at_>vaittale.me>
Subject: Seniors Quickly Find Your Max Borrow Rate
Content-Language: en-us
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Date: Tue, 27 Aug 2013 06:47:43 -0700

I have a 15 second SMTP delay enabled for Spam Repellent. I also just upgraded from 7.4.3 to 8.1.3. Any ideas how this is possible?
I'm going to look for other examples as time permits. Hopefully, this is just a one-off fluke.
Previous Topic: Setting up POP3?
Next Topic: IM Databases not creating
Goto Forum:

Kerio discussion forums are intended for open communication between forum members and may contain information and material posted by members which may be useful in learning about Kerio products. The discussion forums are not intended to provide technical support for any specific product. Any information implied or expressed in the discussion forums is that of the posting member. Kerio is in no way responsible for the information posted in the forums, or its accuracy. Kerio employees may participate in the discussions, but their postings do not represent an offical position of the company on any issues raised or discussed. Kerio reserves the right to monitor and maintain the forums to promote free and accurate exchange of information.

Current Time: Mon Nov 19 20:45:31 CET 2018

Total time taken to generate the page: 2.06212 seconds
.:: Contact :: Home ::.
Powered by: FUDforum 3.0.4.