Spammer with attachment that bypasses spamassassin

Fri Mar 29 11:29:19 UTC 2019

Sure , Here  they are, I just tweaked the ips and names  , I noticed 
this in my postfix log file:

  MailScanner[29247]: Message BC40B48E89.AA059 from XXX.XXX.XXX.XXX 
(business-education+bncbcgz73fdtyhrblo767sakgqeq2agr3q at googlegroups.com) 
to xxxx.xxx is too big for spam checks (2655956 > 200000 bytes)

The headers are :

Sender: business-education at googlegroups.com
Received-SPF: pass (google.com: domain of xxx at xxxxxx.xxx designates XX.XX.XX.XX as permitted sender) client-ip=XX.XX.XX.XX;
MIME-Version: 1.0
References: <CANRqB_k2U-5PD3GKpfN=BGBbc7Rkj50aBt1jm0i7zs1PV4EAfQ at mail.gmail.com>
  <CANRqB_=kJgxPrh-KM2iSseqgZ0mh9R1W-nVv=RN=PjF6pJdOAA at mail.gmail.com>
  <CANRqB_nAbwsN-UJrbvqTFhS9imbvvxeTm_xnT7gAMyRJ68=GgQ at mail.gmail.com>
  <CANRqB_mkywZVo5t6sa3Qo48RKhb_Yqzp9vR0LrqZfmKHecB7fg at mail.gmail.com>
  <CANRqB_mT7aJP8Uhgn4ejqLpsH5Gwc3uQXAJ82rZf--6x1Sdi6A at mail.gmail.com>
  <CANRqB_kN2LnaqGNzZ1Ym8u0OOVVo5c=NnZynNq=uHJz2p0VvgA at mail.gmail.com>
  <CANRqB_k-M2MLUDnZep3XXg4xwbx_qmoJ6n+r43k4GYmCqGmZug at mail.gmail.com>
  <CANRqB_kU8HapxUfNjOK6WbYEz9T6XLrRs9LnmRgcSOceMpF9zQ at mail.gmail.com>
  <CANRqB_=+0XBEVY+SizVb+gK11Jv+=LVDN4BKgWcbA5TfWtkJjQ at mail.gmail.com>
  <CANRqB_ncQnLz9LRSygBY2PRm7TJ3KFdKmssfbFd=TWcWqg=1Hg at mail.gmail.com>
  <CANRqB_knDxy6qi=ojcxM96uJGaAPp-jZBgDE5bT0qXK+7Rca+Q at mail.gmail.com>
  <CANRqB_nZNOHhtrrQS_Ki723qfhFOJtVC=ek7h+VW_OJgnK2VEw at mail.gmail.com>
  <CANRqB_n83NYjSszj8SASF62OEdeYf8SeF6nCdfMWVwBiW0Tx6w at mail.gmail.com>
  <CANRqB_kHSNLe6nAjaBER5O2GmAnUNE0d6+yayuy0sPf2N8kn0Q at mail.gmail.com>
  <CANRqB_m59+x1mBEwkgpyLwpcURoTkcWjrtkyX5wYmXLuWx4JMA at mail.gmail.com>
  <CANRqB_ms7AFhT-y0nwxCOi4B6WL5uh+s_7-vVZq0OEXYfVy_LA at mail.gmail.com>
  <CANRqB_=9E7D2e=Zyuj5mwTXaOAezA8nFhuVdnVsTc9hCVuKr_w at mail.gmail.com>
  <CANRqB_=H-AcrnNFApWECjqwn8a2sBjK8aXoPAy1_SoB=XO89rA at mail.gmail.com>
  <CANRqB_kvL_aJcOUZ4pu5+T85S0Weqvch+iU5A1c2HQuOnjnWsg at mail.gmail.com>
  <CANRqB_mQ5oZHGfZ=uia6nHF=D0tGW1ajC60hzbUbeFSthFfX7w at mail.gmail.com>
  <CANRqB_mBMiogbDzukxPbq5ibA8G03fTpVTMvMDCBnWEH0vdy5g at mail.gmail.com>
  <CANRqB_ksDtpUgj80yc9Rcm+jLV4G=22k41zrbzWeNsREVPOgoQ at mail.gmail.com>
  <CANRqB_mXAzK9111A_0KCfozyLAWV=PQKLj=depFrLNkMu=SDrw at mail.gmail.com>
  <CANRqB_k=GjNRDAgwr8sd2k+t0K0Kv8S5AhjXwO41Qiiib5EXiA at mail.gmail.com>
  <CANRqB_kO54X=ARk1ZTMVQOTYS2R6cqFeMo4s6zCpfTxQT9SP+w at mail.gmail.com>
  <CANRqB_ms2reFNa8-LONHnes6HDmisZTEC0v+xMZsUG6G0gpyOA at mail.gmail.com>
  <CANRqB_mpPmRV3BE4r+sR83Mkcv_GOv6tsL9B54oYse3dZrZoMg at mail.gmail.com>
  <CANRqB_k1cz4Bj9D9g11u1CLQ+eKX3kYeNPtT61i9KHGOsaf8yg at mail.gmail.com>
  <CANRqB_n7D1wzpsYixJLxWuRiYj5JKHkyYktqMu4-ymNANmZ+dA at mail.gmail.com>
  <CANRqB_=dOfKyZH4f2zxiZH-h-amP9EV2vCE4EVXWqL20MaAAGw at mail.gmail.com>
  <CANRqB_mmsbtWsGJm+adKutdox52Vimw-yi7oJVC8Aixw4A8+gw at mail.gmail.com>
  <CANRqB_mEqvvOW4c+BxLFsHv1hjfwvtYhp42iaNh9ZOuqx9Y21w at mail.gmail.com>
  <CANRqB_=yGFDpYZmSqUB2bivu=aG8kEAPpRWd7XbhHe7j2V+s1Q at mail.gmail.com>
  <CANRqB_nXBy1KgPh6GqomXFG=iwskdf06h2ZB11DSKkcBvPdTKQ at mail.gmail.com>
  <CANRqB_mwLqXSrxzX3HpTBjNSjo=OXSYdnXNo9qAETTXPzD-Mhg at mail.gmail.com>
  <CANRqB_ny_kxuhkF7NpLHV6EWuV8-nTYU1BT+gYbiheJUW8aQ=Q at mail.gmail.com>
  <CANRqB_kVFXOdLoqVanySpdQGjar-iLT-Mvg7rJU24napwF5aKw at mail.gmail.com> <CANRqB_=eMeWsNSvFsUC8ToiyDVPe9KHTrDweDJkHzKyx+rzsBQ at mail.gmail.com>
In-Reply-To: <CANRqB_=eMeWsNSvFsUC8ToiyDVPe9KHTrDweDJkHzKyx+rzsBQ at mail.gmail.com>
From: "Business Education" <xxx at xxxxxxx.xxx>
Date: Fri, 29 Mar 2019 12:12:36 +0200
Message-ID: <CANRqB_kYjsK-UGt_YnRqcDgPE0=3ex9w0SVC-bucpn21kTffCg at mail.gmail.com>
Subject: =?UTF-8?B?zpXOmc6UzpnOms6XIM6gzqHOn86jzqbOn86hzpEgzpPOmc6RIM6kzpEgMTIwIEFEVkFOQw==?=
	=?UTF-8?B?RUQgQ09VUlNFUyDOpM6fzqUgU0JF?=
To: business-education at googlegroups.com
Content-Type: multipart/mixed; boundary="000000000000d0be6e058538e96d"
Reply-To: xxx at xxxxx.xxx
Precedence: list
Mailing-list: list business-education at googlegroups.com; contact business-education+owners at googlegroups.com

GP

On 3/29/19 1:08 PM, L.P.H. van Belle via MailScanner wrote:
> Can you send me the header info?
>   
>
>> -----Oorspronkelijk bericht-----
>> Van: MailScanner
>> [mailto:mailscanner-bounces+belle=bazuin.nl at lists.mailscanner.
> info] Namens George Papamichelakis
>> Verzonden: vrijdag 29 maart 2019 12:08
>> Aan: mailscanner at lists.mailscanner.info
>> Onderwerp: Spammer with attachment that bypasses spamassassin
>>
>> Hi all
>>
>>
>> I Have issue with one spammer that due to fact that  he includes some
>> pdf file in his email
>>
>> bypasses the blacklist and his email gets delivered to all addresses
>> that he has from the domain.
>>
>> Can I somehow force mailscanner to not bypass this particular sender
>> due to message size ?
>>
>> I use mailscanner 5.0.2 with postfix  on a debian machine and
>> mailwatch
>> 1.2.10 web interface.
>>
>>
>> thanks in advance
>>
>> GP
>>
>>
>>
>> -- 
>> MailScanner mailing list
>> mailscanner at lists.mailscanner.info
>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20190329/d7215181/attachment.html>