https://bugs.exim.org/show_bug.cgi?id=3042
--- Comment #4 from Lars Timmann <lt@???> ---
We catched one problematic mail.
This mail hangs on our external mail server and is not delivered to our
internal mailserver. Both updated to exim-4.96.2. As it is obviously spam we
could show all data:
# exim -Mvl 1qxQSQ-0000I8-1U
2023-10-30 12:29:22.160 Received from admin@??? H=sophosxgs.domain.tld
[192.168.104.42]:45786 I=[192.168.104.33]:25 P=esmtps L.
X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=4191 M8S=0 RT=0.001s
id=20231030112909.0E44C3A2DFE35454@??? T="Business investment"
2023-10-30 12:29:22.430 H=mail.domain.tld [192.168.9.2]:25: Remote host closed
connection in response to end of data
2023-10-30 12:29:22.644 H=mail.domain.tld [192.168.9.100]:25: Remote host
closed connection in response to end of data
2023-10-30 12:29:22.646 user@??? R=mail_route T=remote_smtp defer (-18)
H=mail.domain.tld [192.168.9.100]:25 I=[192.168.104.33]:61120 DT=0.213s: Remote
host closed connection in response to end of data
2023-10-30 12:30:03.901 H=mail.domain.tld [192.168.9.100]:25: Remote host
closed connection in response to end of data
2023-10-30 12:30:04.201 H=mail.domain.tld [192.168.9.2]:25: Remote host closed
connection in response to end of data
2023-10-30 12:30:04.203 user@??? R=mail_route T=remote_smtp defer (-18)
H=mail.domain.tld [192.168.9.2]:25 I=[192.168.104.33]:53387 DT=0.298s: Remote
host closed connection in response to end of data
...
And so on...
# exim -Mvh 1qxQSQ-0000I8-1U
1qxQSQ-0000I8-1U-H
exim 100 100
<admin@???>
1698665362 0
-received_time_usec .157578
-received_time_complete 1698665362.159479
--helo_name sophosxgs.domain.tld
-host_address [192.168.104.42]:45786
--host_name sophosxgs.domain.tld
-interface_address [192.168.104.33]:25
-received_protocol esmtps
-aclm _linelength_limit 3
998
-body_linecount 10
-max_received_linelength 92
-tls_cipher TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256
-tls_ourcert -----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----\n
-tls_resumption B
-tls_ver TLS1.2
XX
1
user@???
298P Received: from sophosxgs.domain.tld ([192.168.104.42]:45786)
by MailExt1.domain.tld with esmtps (TLS1.2) tls
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96.2)
(envelope-from <admin@???>)
id 1qxQSQ-0000I8-1U
for user@???;
Mon, 30 Oct 2023 12:29:22 +0100
325P Received: from mailext.domain.tld ([192.168.104.34]:42831
helo=MailExt2.domain.tld)
by sophosxgs.domain.tld with esmtps (TLS1.2) tls
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96)
(envelope-from <admin@???>)
id 1qxQSG-0001T1-2t
for user@???;
Mon, 30 Oct 2023 12:29:12 +0100
320P Received: from hwsrv-1105621.hostwindsdns.com ([192.168.216.93]:44389
helo=genarec.com)
by MailExt2.MH-Hannover.DE with esmtps (TLS1.2) tls
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
(Exim 4.96.2)
(envelope-from <admin@???>)
id 1qxQSG-0006Vl-37
for user@???;
Mon, 30 Oct 2023 12:29:12 +0100
038R Reply-To: alamoudimohammad5@???
065F From: Password Notification <anxjf<info@???>
033T To: user@???
029 Subject: Business investment
033 Date: 30 Oct 2023 11:29:10 +0000
058I Message-ID: <20231030112909.0E44C3A2DFE35454@???>
018 MIME-Version: 1.0
024 Content-Type: text/html
044 Content-Transfer-Encoding: quoted-printable
022 X-Sophos-IBS: success
072 X-SASI-Version: Antispam-Engine: 5.1.4, AntispamData: 192.168.30.105116
018 X-SASI-RCODE: 200
028 X-SASI-SpamProbability: 30%
2142 X-SASI-Hits: BODYTEXTH_SIZE_10000_LESS 0.000000, BODY_SIZE_1000_LESS
0.000000,
BODY_SIZE_2000_LESS 0.000000, BODY_SIZE_5000_LESS 0.000000,
BODY_SIZE_500_599 0.000000, BODY_SIZE_7000_LESS 0.000000,
CTE_QUOTED_PRINTABLE 0.000000, CTYPE_JUST_HTML 0.500000,
FRAUD_WEBMAIL_R_NOT_F 0.100000, FRAUD_X3 1.000000, FROM_NAME_PHRASE 0.000000,
HREF_LABEL_TEXT_NO_URI 0.000000, HREF_LABEL_TEXT_ONLY 0.000000,
HTML_NO_HTTP 0.100000, KNOWN_MTA_TFX 0.000000, NO_CTA_URI_FOUND 0.000000,
NO_URI_HTTPS 0.000000, RCVD_EXIM_IP_PORT 1.000000,
REPLYTO_FROM_DIFF_ADDY 0.100000, SENDER_NO_AUTH 0.000000,
SINGLE_HREF_URI_IN_BODY 0.000000, SXL_IP_TFX_WM 0.000000,
TO_DOMAIN_IN_FROMNAME_NOT_SAME 0.000000, TO_DOMAIN_IN_FROM_NOT_SAME 0.000000,
WEBMAIL_REPLYTO_NOT_FROM 0.500000, __ANY_URI 0.000000,
__BODY_TEXT_X4 0.000000, __CSHC_NS_B_FN_FA 0.000000, __CT 0.000000,
__CTE 0.000000, __CTYPE_HTML 0.000000, __CTYPE_IS_HTML 0.000000,
__DC_PHRASE 0.000000, __FRAUD_BODY_WEBMAIL 0.000000, __FRAUD_COMMON 0.000000,
__FRAUD_INTRO 0.000000, __FRAUD_REPLY 0.000000, __FRAUD_URGENCY 0.000000,
__FRAUD_WEBMAIL 0.000000, __FRAUD_WEBMAIL_REPLYTO 0.000000,
__FROM_DOMAIN_NOT_IN_BODY 0.000000, __FROM_NAME_NOT_IN_ADDR 0.000000,
__FROM_NAME_NOT_IN_BODY 0.000000, __FUR_HEADER 0.000000, __HAS_FROM 0.000000,
__HAS_HTML 0.000000, __HAS_MSGID 0.000000, __HAS_REPLYTO 0.000000,
__HEADER_ORDER_FROM 0.000000, __HREF_LABEL_TEXT 0.000000,
__HTML_AHREF_TAG 0.000000, __MIME_HTML 0.000000, __MIME_HTML_ONLY 0.000000,
__MIME_TEXT_H 0.000000, __MIME_TEXT_H1 0.000000, __MIME_VERSION 0.000000,
__MSGID_DATETIME_DOT_HEX16 0.000000, __PART_TYPE_HTML 0.000000,
__PHISH_SPEAR_GREETING 0.000000, __RCPT_HOST_IN_FROM 0.000000,
__RCPT_HOST_IN_FROM_NAME 0.000000, __RCVD_EXIM_IP_PORT 0.000000,
__REPLYTO_GMAIL 0.000000, __SANE_MSGID 0.000000, __SEO_WEBSITE 0.000000,
__SPEAR_FROM_NAME 0.000000, __STOCK_PHRASE_8 0.000000,
__SUBJ_ALPHA_END 0.000000, __SUBJ_SHORT 0.000000, __TAG_EXISTS_HTML 0.000000,
__TO_HOST_IN_FROM 0.000000, __TO_HOST_IN_FROM_NAME 0.000000,
__TO_MALFORMED_2 0.000000, __TO_NO_NAME 0.000000, __URI_MAILTO 0.000000,
__URI_NO_WWW 0.000000, __URI_NS 0.000000
030 X-Sophos-Firewall: smtpd v1.0
# exim -Mvb 1qxQSQ-0000I8-1U
1qxQSQ-0000I8-1U-D
<html><head>
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
</head>
<body><p>Dear Sir Madam,</p><p>My name is Mohammed Al Amoudi from the Kingd=
om of Saudi Arabia.</p><p>I contacted you because of my interest in your se=
ctor.</p><p>We would like to get an idea of the chances of a successful inv=
estment in your area and for other important business discussions.</p><p>I =
await your urgent response.</p><p>Reply to email address for further discus=
sions <a href=3D"mailto:“alamoudimohammad5@???">“alamoudi=
mohammad5@???</a>”</p></body></html>
On the internal mail server we just see:
--
You are receiving this mail because:
You are on the CC list for the bug.
--
## subscription configuration (requires account):
##
https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-dev-unsubscribe@???
## Exim details at
http://www.exim.org/
## Please use the Wiki with this list -
http://wiki.exim.org/
