View Single Post
Old 14 Jul 2017, 09:02 AM   #1
camner
Cornerstone of the Community
 
Join Date: Jul 2002
Location: Tacoma, WA
Posts: 642
spam getting through custom sieve rules

I have custom sieve rules set up to discard mail sent to certain addresses. When I test the script by sending myself an email to one particular address on the "discard" list, the email correctly gets discarded. But certain emails from outside spammers to that same email address get through, and I don't understand why. I have run my Sieve code on this particular email through Sieve Tester, and sure enough, it gets through.

The only reference to a "To" address I could find is highlighted in red in the message below, which is the email address that is in my Sieve script to be discarded, and as I indicated, sending myself an email to that address does result in the email being discarded.

Am I misreading the headers and is the email actually being sent to a different address?

Thanks for any help you can be.

Here's the raw headers:
Code:
Return-Path: <mlopez@oben.com.co>
Received: from compute5.internal (compute5.nyi.internal [10.202.2.45])
	 by sloti38d1t06 (Cyrus fastmail-fmjessie44472-15312-git-fastmail-15312) with LMTPA;
	 Thu, 13 Jul 2017 15:41:18 -0400
X-Cyrus-Session-Id: sloti38d1t06-281765-1499974878-2-2414931264603118082
X-Sieve: CMU Sieve 3.0
X-Spam-known-sender: no
X-Spam-score: 6.2
X-Spam-hits: BAYES_40 -0.001, DIET_1 0.001, MISSING_SUBJECT 1.799,
  RCVD_IN_BL_SPAMCOP_NET 2, RCVD_IN_INVALUEMENT 2, SPF_HELO_PASS -0.001,
  SPF_PASS -0.001, URI_NOVOWEL 0.5, LANGUAGES en, BAYES_USED user,
  SA_VERSION 3.4.0
X-Spam-source: IP='190.145.99.75', Host='mail.casaoben.com', Country='CO',
  FromHeader='co', MailFrom='co'
X-Spam-charsets: 
X-Resolved-to: myFMname@fastmail.com
X-Delivered-to: sp@myfmdomain.com
X-Mail-from: mlopez@oben.com.co
Received: from mx3 ([10.202.2.202])
  by compute5.internal (LMTPProxy); Thu, 13 Jul 2017 15:41:18 -0400
Received: from mx3.messagingengine.com (localhost [127.0.0.1])
	by mailmx.nyi.internal (Postfix) with ESMTP id 03D7446444
	for <sp@myfmdomain.com>; Thu, 13 Jul 2017 15:41:18 -0400 (EDT)
Received: from mx3.messagingengine.com (localhost [127.0.0.1])
    by mx3.messagingengine.com (Authentication Milter) with ESMTP
    id 01EBEB883D7;
    Thu, 13 Jul 2017 15:41:18 -0400
Authentication-Results: mx3.messagingengine.com;
    dkim=none (no signatures found);
    dmarc=none (p=none) header.from=oben.com.co;
    spf=pass smtp.mailfrom=mlopez@oben.com.co smtp.helo=mail.casaoben.com
Received-SPF: pass
    (oben.com.co: 190.145.99.75 is authorized to use 'mlopez@oben.com.co' in 'mfrom' identity (mechanism 'mx' matched))
    receiver=mx3.messagingengine.com;
    identity=mailfrom;
    envelope-from="mlopez@oben.com.co";
    helo=mail.casaoben.com;
    client-ip=190.145.99.75
Received: from mail.casaoben.com (mail.casaoben.com [190.145.99.75])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by mx3.messagingengine.com (Postfix) with ESMTPS
	for <sp@myfmdomain.com>; Thu, 13 Jul 2017 15:41:17 -0400 (EDT)
Received: from localhost (localhost [127.0.0.1])
	by mail.casaoben.com (Postfix) with ESMTP id D54FF196154B;
	Thu, 13 Jul 2017 09:28:35 -0500 (COT)
Received: from mail.casaoben.com ([127.0.0.1])
	by localhost (mail.casaoben.com [127.0.0.1]) (amavisd-new, port 10032)
	with ESMTP id V52moA6lzHma; Thu, 13 Jul 2017 09:28:35 -0500 (COT)
Received: from localhost (localhost [127.0.0.1])
	by mail.casaoben.com (Postfix) with ESMTP id 90EF91936437;
	Wed, 12 Jul 2017 18:21:00 -0500 (COT)
X-Virus-Scanned: amavisd-new at casaoben.com
Received: from mail.casaoben.com ([127.0.0.1])
	by localhost (mail.casaoben.com [127.0.0.1]) (amavisd-new, port 10026)
	with ESMTP id g-eHNeuIkBdp; Wed, 12 Jul 2017 18:21:00 -0500 (COT)
Received: from [127.0.0.1] (unknown [185.138.92.84])
	by mail.casaoben.com (Postfix) with ESMTPSA id E9BA018CDFE8;
	Wed, 12 Jul 2017 10:50:12 -0500 (COT)
Date: Wed, 12 Jul 2017 17:50:02 +0200
From: mlopez@oben.com.co
To: sp@aceplasticinc.com, sp@action-hi.co.uk, sp@aircomp.com, sp@asfc.ac.uk,
Message-Id: <20170712155012.E9BA018CDFE8@mail.casaoben.com>


: SMTPHEADER_REPLYTO#
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="--_com.android.email_56950588071180"
Message-ID: <eqt0ayh-b6i839-20@oben.com.co>

This is a multi-part message in MIME format

----_com.android.email_56950588071180
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

filterUsage=0 filterMask= negateFilter=0 plaintext=1 convertMsgBodyToImage=0 convertedMsgBody=%3Chtml%3E%3Cbody%3E%3Cimg+src%3D%22%23ATTACHIMG(1)%23%22%3E%3C%2Fbody%3E%3C%2Fhtml%3E delayedMessage=0 minutesToDelay=60 Both Short-Term And Long-Lasting Improvements: The Newest Diet Solution It’s never too late to start working on improving your body's natural weight loss system. Begin improving your health by learning more about our extraordinary diet product. All the powerful components are there to provide both momentary and lasting improvements, you will drop approximately 40 pounds or more, you will lose 4 inches or more off your waistline. The crucial part: you'll keep all of that off. You [wouldn’t|would not} believe the wonderful results that you can check on our official website. To learn all the information you need, click on this link http://www.google.com/url?q=http%3A%2F%2Feqhgr.goodlostfat2.top&sa=D&sntz=1&usg=AFQjCNGcaXtyk5hp8wTtnOEApw8mYE7_xQ

----_com.android.email_56950588071180
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

filterUsage=0
filterMask=
negateFilter=0
plaintext=1
convertMsgBodyToImage=0
convertedMsgBody=%3Chtml%3E%3Cbody%3E%3Cimg+src%3D%22%23ATTACHIMG(1)%23%22%3E%3C%2Fbody%3E%3C%2Fhtml%3E
delayedMessage=0
minutesToDelay=60
Both Short-Term And Long-Lasting Improvements: The Newest Diet Solution
It’s never too late to start working on improving your body's natural weight loss system.
Begin improving your health by learning more about our extraordinary diet product.
All the powerful components are there to provide both momentary and lasting improvements, you will drop approximately 40 pounds or more, you will lose 4 inches or more off your waistline.
The crucial part: you'll keep all of that off.
You [wouldn’t|would not} believe the wonderful results that you can check on our official website.
To learn all the information you need, click on this link
http://www.google.com/url?q=http%3A%2F%2Feqhgr.goodlostfat2.top&sa=D&sntz=1&usg=AFQjCNGcaXtyk5hp8wTtnOEApw8mYE7_xQ

----_com.android.email_56950588071180--
camner is offline   Reply With Quote