<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">Hello,</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">we are currently running MailScanner in combination with the following setup:</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">MailWatch Version:1.2.0 - RC1 DEV<br>
MailScanner Version:4.85.2<br>
ClamAV Version:0.99.1 <br>
SpamAssassin Version:3.4.0 <br>
PHP Version:5.4.16<br>
MySQL Version:10.0.25-MariaDB-wsrep (3 node cluster)</div>
<div>
<p style="color: rgb(0, 0, 0); margin: 0px;">CentOS Linux release 7.2.1511 (Core) </p>
<p style="color: rgb(0, 0, 0); margin: 0px;">6 Core Intel(R) Xeon(R) CPU X5650 @ 2.67GHz</p>
<p style="color: rgb(0, 0, 0); margin: 0px;">virtualiced in a Virtuozzo 6.0 CloudServer environment</p>
<p style="color: rgb(0, 0, 0); margin: 0px;"><br>
</p>
<p style="color: rgb(0, 0, 0); margin: 0px;">processing about 20-24000 mails per day and we do get about 30-50 "Denial of Service attack" mails, which are not moved to the quarantine location as advertised in the „disarmed“ mail.</p>
<p style="color: rgb(0, 0, 0); margin: 0px;"><br>
</p>
<p style="color: rgb(0, 0, 0); margin: 0px;">After reading trough the Maillinglist we have set -> Maximum Processing Attempts = 0</p>
<p style="margin: 0px;">Which also doesnt’help, and have disabled -> Dangerous Content Scanning = no</p>
<p style="margin: 0px;"><br>
</p>
<p style="margin: 0px;">We could anly see such messages with the following log entries:</p>
<p style="margin: 0px;">May 13 02:30:02 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in D1A4AA0DBC.A33FC from some_address@returns.groups.yahoo.com</p>
<p style="margin: 0px;">May 13 02:30:23 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in 11057A0844.AB59A from some_address@coldiretti.it</p>
<p style="margin: 0px;">May 13 02:33:04 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in 3E0E2A08D7.AAAA3 from some_address@googlegroups.com</p>
<p style="margin: 0px;">May 13 02:42:27 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in CEF30A08AC.AE861 from some_address@csak1utazas.hu</p>
<p style="margin: 0px;">May 13 02:53:05 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in 0A11DA0844.ABECC from some_address@coldiretti.it</p>
<p style="margin: 0px;">May 13 03:16:25 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in 10455A0844.AF1FC from some_address@paypal.at</p>
<p style="margin: 0px;">May 13 03:23:18 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in CC42FA0844.A3738 from some_address@billa.at</p>
<p style="margin: 0px;">May 13 03:34:55 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in 6306AA08AC.A8311 from some_address@coldiretti.it</p>
<p style="margin: 0px;">May 13 03:37:06 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in BF3ECA08AC.A7E73 from some_address@amazonses.com</p>
<p style="margin: 0px;">May 13 03:46:35 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in EAE58A0DBC.A86E2 from some_address@vetmeduni.ac.at</p>
<p style="margin: 0px;"></p>
<p style="margin: 0px;">May 13 03:57:43 mx01 MailScanner[25323]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
Content Checks</span>: Detected and have disarmed KILLED tags in HTML message in 0B375A08AC.AAEB0 from some_address@xing.com</p>
<p style="margin: 0px;"><br>
</p>
<p style="margin: 0px;">Here are the whole log entris for a particular mail:</p>
<p style="margin: 0px;"><br>
</p>
<p style="margin: 0px;">May 13 03:46:23 mx01 postfix/smtpd[29099]: <span style="color: rgb(195, 55, 32);">
EAE58A0DBC</span>: client=mail.meduniwien.ac.at[149.148.224.72]</p>
<p style="margin: 0px;">May 13 03:46:23 mx01 postfix/cleanup[29649]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
EAE58A0DBC</span>: hold: header Received: from mailfp2.srv.meduniwien.ac.at (mail.meduniwien.ac.at [149.148.224.72])??by mx01.mail.netstorage.at (Postfix) with ESMTPS id
<span style="font-variant-ligatures: no-common-ligatures; color: #c33720">EAE58A0DBC</span>??for <some_address@jensen-jarolim.at>; Fri, 13 May 2016 03 from mail.meduniwien.ac.at[149.148.224.72]; from=<some_address@vetmeduni.ac.at> to=<some_address@jensen-jarolim.at>
proto=ESMTP helo=<mailfp2.srv.meduniwien.ac.at></p>
<p style="margin: 0px;">May 13 03:46:23 mx01 postfix/cleanup[29649]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
EAE58A0DBC</span>: message-id=<8b7eb9021b7f725b13b26feb1fd22385@mlgns.com></p>
<p style="margin: 0px;">May 13 03:46:23 mx01 postfix/cleanup[29649]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
EAE58A0DBC</span>: resent-message-id=<20160513014548.2CFA8EE2DE@mail.vu-wien.ac.at></p>
<p style="margin: 0px;">May 13 03:46:35 mx01 MailScanner[25323]: Content Checks: Detected and have disarmed KILLED tags in HTML message in
<span style="font-variant-ligatures: no-common-ligatures; color: #c33720">EAE58A0DBC</span>.A86E2 from some_address@vetmeduni.ac.at</p>
<p style="margin: 0px;"></p>
<p style="margin: 0px;">May 13 03:46:35 mx01 MailScanner[25323]: Requeue: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
EAE58A0DBC</span>.A86E2 to D0A8EA15C3</p>
<p style="margin: 0px;">May 13 03:46:35 mx01 postfix/qmgr[27970]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
D0A8EA15C3</span>: from=<some_address@vetmeduni.ac.at>, size=25282, nrcpt=1 (queue active)</p>
<p style="margin: 0px;">May 13 03:46:36 mx01 postfix/smtp[29822]: <span style="font-variant-ligatures: no-common-ligatures; color: #c33720">
D0A8EA15C3</span>: to=<some_address@jensen-jarolim.at>, relay=mailfilter01.crossip.net[89.207.144.61]:25, delay=12, delays=11/0.01/0.54/0.23, dsn=2.0.0, status=sent (250 Ok: queued as 3578F5C00D2)</p>
<p style="margin: 0px;"></p>
<p style="margin: 0px;">May 13 03:46:36 mx01 postfix/qmgr[27970]: <span style="color: rgb(195, 55, 32);">
D0A8EA15C3</span>: removed</p>
<p style="margin: 0px;"><br>
</p>
<p style="margin: 0px;"><br>
</p>
<p style="margin: 0px;">We have also done the test for missing Perl extensions, and all are present.</p>
<p style="margin: 0px;"><br>
</p>
<p style="margin: 0px;">We could catch some of these emails and will directly forward them to <span style="white-space: pre-wrap; background-color: rgb(255, 255, 255);">Jerry Benton</span></p>
</div>
<div style="color: rgb(0, 0, 0);">
<div id="MAC_OUTLOOK_SIGNATURE">
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div>
<div style="color: rgb(0, 0, 0); margin: 0px;">Mit freundlichen Grüßen,</div>
<div style="color: rgb(0, 0, 0); margin: 0px;">With best regards,</div>
<div style="color: rgb(0, 0, 0); margin: 0px;"><span lang="de"> </span></div>
<div style="color: rgb(0, 0, 0); margin: 0px;"><font><span lang="de">Michael Böttger</span></font></div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0); margin: 0px;">
<br>
</div>
<div style="font-size: 14px; font-family: Calibri, sans-serif; color: rgb(0, 0, 0); margin: 0px;">
<font face="Calibri,sans-serif" size="2"><span style="font-size:11pt;"></span></font></div>
</div>
</div>
</div>
</body>
</html>