False Positives
Dharmesh Mevawala <[email protected]> Fri, 20 Nov 2015 11:47:55 +0530
| Newsgroups | gmane.mail.qmail.scanner |
|---|---|
| Organization | You Broadband India Pvt. Ltd. |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --------------040108010709040204040709 Content-Type: multipart/alternative; boundary="------------040207000904040709060007" --------------040207000904040709060007 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit We are a leading ISP in India & we are running qmail & qmail-scanner on our various email servers. Since last few days, we have observed that some of the emails are getting quarantined by qmail-scanner. These are legal emails sent by bank to our customer, to whom we provide internet services. He is using email-id provided by us. Bank is sending him various emails based on financial transactions done by him. Since these emails are getting quarantined, its not getting delivered to our customer. He raised a complain for the same. Emails seems auto-generated by bank's email sever & seems to be a false positive to me. This is happening to multiple customers of ours. Pl. help me resolve this issue. I have attached few sample mails here with. -- Regards, *Regards,* *Dharmesh Mevawala* Manager-Networks YOU Broadband India Pvt. Ltd. 2nd Floor, Millennium Arcade Adajan-Hazira Road, Surat-395009 Mobile: +91 98790 00854 Landline: +91 261 6676767 Ext: 1650 Email: [email protected] http://www.youbroadband.in --------------040207000904040709060007 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit <html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body bgcolor="#FFFFFF" text="#000000"> <font face="Verdana">We are a leading ISP in India & we are running qmail & qmail-scanner on our various email servers.<br> Since last few days, we have observed that some of the emails are getting quarantined by qmail-scanner.<br> These are legal emails sent by bank to our customer, to whom we provide internet services. He is using email-id<br> provided by us. Bank is sending him various emails based on financial transactions done by him. Since these emails<br> are getting quarantined, its not getting delivered to our customer. He raised a complain for the same. Emails seems auto-generated<br> by bank's email sever & seems to be a false positive to me. This is happening to multiple customers of ours. Pl. help me resolve this issue.<br> <br> I have attached few sample mails here with. <br> </font><br> <div class="moz-signature">-- <br> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 11 (filtered)"> <title>Regards,</title> <style> <!-- /* Font Definitions */ @font-face {font-family:Verdana; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} @page Section1 {size:612.0pt 792.0pt; margin:72.0pt 90.0pt 72.0pt 90.0pt;} div.Section1 {page:Section1;} --> </style> <div class="Section1"> <p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:10.0pt; font-family:Verdana">Regards,</span></b></p> <p class="MsoNormal" style="text-autospace:none"><b><span style="font-size:10.0pt; font-family:Verdana">Dharmesh Mevawala</span></b></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana">Manager-Networks</span></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana">YOU Broadband India Pvt. Ltd. </span></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana">2nd Floor, Millennium Arcade</span></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana">Adajan-Hazira Road</span><span style="font-size:10.0pt; font-family:Verdana">, Surat</span><span style="font-size:10.0pt;font-family: Verdana">-395009</span></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana">Mobile</span><span style="font-size:10.0pt;font-family: Verdana">: +91 98790 00854</span></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana">Landline: +91 261 6676767 Ext: 1650</span></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana">Email: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a></span></p> <p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt; font-family:Verdana"><a class="moz-txt-link-freetext" href="http://www.youbroadband.in">http://www.youbroadband.in</a></span></p> <p class="MsoNormal"> </p> </div> </div> </body> </html> --------------040207000904040709060007-- --------------040108010709040204040709 Content-Type: message/rfc822; name="Attached Message" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="Attached Message" X-Account-Key: account1 X-Mozilla-Keys: Return-Path: <> Delivered-To: [email protected] Received: (qmail 1623 invoked by uid 508); 19 Nov 2015 07:43:12 -0000 X-Qmail-Scanner-Diagnostics: from inmail.youbroadband.in by getmail.youbroadband.in (envelope-from <>, uid 500) with qmail-scanner-2.11 (mhr: 1.0. clamdscan: 0.98.7/21068. spamassassin: 3.3.2. Clear:RC:0(203.187.192.7):SA:0(2.2/5.0):. Processed in 1.027606 secs); 19 Nov 2015 07:43:12 -0000 X-Spam-Status: No, score=2.2 required=5.0 X-Spam-Level: ++ Received: from inmail.youbroadband.in ([203.187.192.7]) (envelope-sender <>) by getmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 07:43:11 -0000 Received: (qmail 9324 invoked by alias); 19 Nov 2015 07:42:24 -0000 Delivered-To: [email protected] Received: (qmail 9321 invoked by alias); 19 Nov 2015 07:42:24 -0000 Delivered-To: [email protected] Received: (qmail 9318 invoked by uid 508); 19 Nov 2015 07:42:24 -0000 Received: from mx1.youbroadband.in ([203.187.192.28]) (envelope-sender <>) by inmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 07:42:24 -0000 Received: (qmail 24907 invoked by uid 508); 19 Nov 2015 07:41:59 -0000 Date: 19 Nov 2015 07:41:59 -0000 From: "System Anti-Virus Administrator" <[email protected]> To: [email protected] Subject: policy-violation found in sent message "Inward Cheque Debit Alert" Message-ID: <[email protected]> Auto-Submitted: auto-replied In-Reply-To: <63833038.1447918944174.JavaMail.wasadm@alertapp> References: <63833038.1447918944174.JavaMail.wasadm@alertapp> MIME-Version: 1.0 Content-type: text/plain Content-Transfer-Encoding: 8bit Attention: [email protected] A policy-violation was found in an Email message you sent. This Email scanner intercepted it and stopped the entire message reaching its destination. The policy-violation was reported to be: Disallowed breakage found in header name - not valid email Please contact your IT support personnel with any queries regarding this policy. Your message was sent with the following envelope: MAIL FROM: [email protected] RCPT TO: [email protected] ... and with the following headers: --- MAILFROM: [email protected] RCPTTO: [email protected] IP-Addr: 115.112.212.211 Received: from alerts8.kotak.com ([115.112.212.211]) (envelope-sender <[email protected]>) by mx1.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 07:41:59 -0000 Message-ID: <63833038.1447918944174.JavaMail.wasadm@alertapp> Date: Thu, 19 Nov 2015 13:12:24 +0530 (GMT+05:30) From: [email protected] To: [email protected] Subject: Inward Cheque Debit Alert Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_162766_54788932.1447918944171" Inward Cheque Debit Alert : UTF8 --- The original message is kept in: mx1.youbroadband.in:/var/spool/qscan/quarantine/policy/new/mx1.youbroadband.in144791891958824895 where the System Anti-Virus Administrator can further diagnose it. The Email scanner reported the following when it scanned that message: --- ---perlscanner results --- problem 'Disallowed breakage found in header name - not valid email' found in message --- --------------040108010709040204040709 Content-Type: message/rfc822; name="Attached Message" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="Attached Message" X-Account-Key: account1 X-Mozilla-Keys: Return-Path: <> Delivered-To: [email protected] Received: (qmail 28730 invoked by uid 508); 19 Nov 2015 07:13:10 -0000 X-Qmail-Scanner-Diagnostics: from inmail.youbroadband.in by getmail.youbroadband.in (envelope-from <>, uid 500) with qmail-scanner-2.11 (mhr: 1.0. clamdscan: 0.98.7/21068. spamassassin: 3.3.2. Clear:RC:0(203.187.192.7):SA:0(2.2/5.0):. Processed in 0.58404 secs); 19 Nov 2015 07:13:10 -0000 X-Spam-Status: No, score=2.2 required=5.0 X-Spam-Level: ++ Received: from inmail.youbroadband.in ([203.187.192.7]) (envelope-sender <>) by getmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 07:13:09 -0000 Received: (qmail 3831 invoked by alias); 19 Nov 2015 07:12:22 -0000 Delivered-To: [email protected] Received: (qmail 3828 invoked by alias); 19 Nov 2015 07:12:22 -0000 Delivered-To: [email protected] Received: (qmail 3825 invoked by uid 508); 19 Nov 2015 07:12:22 -0000 Received: from mx1.youbroadband.in ([203.187.192.28]) (envelope-sender <>) by inmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 07:12:22 -0000 Received: (qmail 16232 invoked by uid 508); 19 Nov 2015 07:11:57 -0000 Date: 19 Nov 2015 07:11:57 -0000 From: "System Anti-Virus Administrator" <[email protected]> To: [email protected] Subject: policy-violation found in sent message "Large Credit alert" Message-ID: <[email protected]> Auto-Submitted: auto-replied In-Reply-To: <447027877.1447917142393.JavaMail.wasadm@alertapp> References: <447027877.1447917142393.JavaMail.wasadm@alertapp> MIME-Version: 1.0 Content-type: text/plain Content-Transfer-Encoding: 8bit Attention: [email protected] A policy-violation was found in an Email message you sent. This Email scanner intercepted it and stopped the entire message reaching its destination. The policy-violation was reported to be: Disallowed breakage found in header name - not valid email Please contact your IT support personnel with any queries regarding this policy. Your message was sent with the following envelope: MAIL FROM: [email protected] RCPT TO: [email protected] ... and with the following headers: --- MAILFROM: [email protected] RCPTTO: [email protected] IP-Addr: 115.112.212.210 Received: from alerts7.kotak.com ([115.112.212.210]) (envelope-sender <[email protected]>) by mx1.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 07:11:57 -0000 Message-ID: <447027877.1447917142393.JavaMail.wasadm@alertapp> Date: Thu, 19 Nov 2015 12:42:22 +0530 (GMT+05:30) From: [email protected] To: [email protected] Subject: Large Credit alert Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_155784_1781099049.1447917142373" Large Credit alert : UTF8 --- The original message is kept in: mx1.youbroadband.in:/var/spool/qscan/quarantine/policy/new/mx1.youbroadband.in144791711758816224 where the System Anti-Virus Administrator can further diagnose it. The Email scanner reported the following when it scanned that message: --- ---perlscanner results --- problem 'Disallowed breakage found in header name - not valid email' found in message --- --------------040108010709040204040709 Content-Type: message/rfc822; name="Attached Message" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="Attached Message" X-Account-Key: account1 X-Mozilla-Keys: Return-Path: <> Delivered-To: [email protected] Received: (qmail 15894 invoked by uid 508); 19 Nov 2015 02:41:13 -0000 X-Qmail-Scanner-Diagnostics: from inmail.youbroadband.in by getmail.youbroadband.in (envelope-from <>, uid 500) with qmail-scanner-2.11 (mhr: 1.0. clamdscan: 0.98.7/21068. spamassassin: 3.3.2. Clear:RC:0(203.187.192.7):SA:0(2.2/5.0):. Processed in 0.55853 secs); 19 Nov 2015 02:41:13 -0000 X-Spam-Status: No, score=2.2 required=5.0 X-Spam-Level: ++ Received: from inmail.youbroadband.in ([203.187.192.7]) (envelope-sender <>) by getmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 02:41:12 -0000 Received: (qmail 26746 invoked by alias); 19 Nov 2015 02:40:26 -0000 Delivered-To: [email protected] Received: (qmail 26743 invoked by alias); 19 Nov 2015 02:40:26 -0000 Delivered-To: [email protected] Received: (qmail 26740 invoked by uid 508); 19 Nov 2015 02:40:25 -0000 Received: from mx1.youbroadband.in ([203.187.192.28]) (envelope-sender <>) by inmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 02:40:25 -0000 Received: (qmail 2775 invoked by uid 508); 19 Nov 2015 02:40:01 -0000 Date: 19 Nov 2015 02:40:01 -0000 From: "System Anti-Virus Administrator" <[email protected]> To: [email protected] Subject: policy-violation found in sent message "Account Balance - Daily" Message-ID: <[email protected]> Auto-Submitted: auto-replied In-Reply-To: <399775700.1447900825516.JavaMail.wasadm@alertapp> References: <399775700.1447900825516.JavaMail.wasadm@alertapp> MIME-Version: 1.0 Content-type: text/plain Content-Transfer-Encoding: 8bit Attention: [email protected] A policy-violation was found in an Email message you sent. This Email scanner intercepted it and stopped the entire message reaching its destination. The policy-violation was reported to be: Disallowed breakage found in header name - not valid email Please contact your IT support personnel with any queries regarding this policy. Your message was sent with the following envelope: MAIL FROM: [email protected] RCPT TO: [email protected] ... and with the following headers: --- MAILFROM: [email protected] RCPTTO: [email protected] IP-Addr: 115.112.212.204 Received: from alerts1.kotak.com ([115.112.212.204]) (envelope-sender <[email protected]>) by mx1.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 02:40:00 -0000 Message-ID: <399775700.1447900825516.JavaMail.wasadm@alertapp> Date: Thu, 19 Nov 2015 08:10:25 +0530 (GMT+05:30) From: [email protected] To: [email protected] Subject: Account Balance - Daily Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_25103_1613193255.1447900825512" Account Balance - Daily : UTF8 --- The original message is kept in: mx1.youbroadband.in:/var/spool/qscan/quarantine/policy/new/mx1.youbroadband.in14479008005882762 where the System Anti-Virus Administrator can further diagnose it. The Email scanner reported the following when it scanned that message: --- ---perlscanner results --- problem 'Disallowed breakage found in header name - not valid email' found in message --- --------------040108010709040204040709 Content-Type: message/rfc822; name="Attached Message" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="Attached Message" X-Account-Key: account1 X-Mozilla-Keys: Return-Path: <> Delivered-To: [email protected] Received: (qmail 17160 invoked by uid 508); 19 Nov 2015 08:27:08 -0000 X-Qmail-Scanner-Diagnostics: from inmail.youbroadband.in by getmail.youbroadband.in (envelope-from <>, uid 500) with qmail-scanner-2.11 (mhr: 1.0. clamdscan: 0.98.7/21068. spamassassin: 3.3.2. Clear:RC:0(203.187.192.7):SA:0(2.2/5.0):. Processed in 0.615947 secs); 19 Nov 2015 08:27:08 -0000 X-Spam-Status: No, score=2.2 required=5.0 X-Spam-Level: ++ Received: from inmail.youbroadband.in ([203.187.192.7]) (envelope-sender <>) by getmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 08:27:07 -0000 Received: (qmail 17080 invoked by alias); 19 Nov 2015 08:26:20 -0000 Delivered-To: [email protected] Received: (qmail 17077 invoked by alias); 19 Nov 2015 08:26:20 -0000 Delivered-To: [email protected] Received: (qmail 17074 invoked by uid 508); 19 Nov 2015 08:26:20 -0000 Received: from mx1.youbroadband.in ([203.187.192.28]) (envelope-sender <>) by inmail.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 08:26:20 -0000 Received: (qmail 4467 invoked by uid 508); 19 Nov 2015 08:25:55 -0000 Date: 19 Nov 2015 08:25:55 -0000 From: "System Anti-Virus Administrator" <[email protected]> To: [email protected] Subject: policy-violation found in sent message "Issued Cheque Return" Message-ID: <[email protected]> Auto-Submitted: auto-replied In-Reply-To: <357766483.1447921580218.JavaMail.wasadm@alertapp> References: <357766483.1447921580218.JavaMail.wasadm@alertapp> MIME-Version: 1.0 Content-type: text/plain Content-Transfer-Encoding: 8bit Attention: [email protected] A policy-violation was found in an Email message you sent. This Email scanner intercepted it and stopped the entire message reaching its destination. The policy-violation was reported to be: Disallowed breakage found in header name - not valid email Please contact your IT support personnel with any queries regarding this policy. Your message was sent with the following envelope: MAIL FROM: [email protected] RCPT TO: [email protected] ... and with the following headers: --- MAILFROM: [email protected] RCPTTO: [email protected] IP-Addr: 115.112.212.207 Received: from alerts4.kotak.com ([115.112.212.207]) (envelope-sender <[email protected]>) by mx1.youbroadband.in (qmail-ldap-1.03) with SMTP for <[email protected]>; 19 Nov 2015 08:25:54 -0000 Message-ID: <357766483.1447921580218.JavaMail.wasadm@alertapp> Date: Thu, 19 Nov 2015 13:56:20 +0530 (GMT+05:30) From: [email protected] To: [email protected] Subject: Issued Cheque Return Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_Part_174618_243928714.1447921580215" Issued Cheque Return : UTF8 --- The original message is kept in: mx1.youbroadband.in:/var/spool/qscan/quarantine/policy/new/mx1.youbroadband.in14479215555884459 where the System Anti-Virus Administrator can further diagnose it. The Email scanner reported the following when it scanned that message: --- ---perlscanner results --- problem 'Disallowed breakage found in header name - not valid email' found in message --- --------------040108010709040204040709 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ --------------040108010709040204040709 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Qmail-scanner-general mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general --------------040108010709040204040709--