Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Email was not forwarded
  FAQ FAQ  Forum Search   Register Register  Login Login

Email was not forwarded

 Post Reply Post Reply
Author
vbourbeau View Drop Down
Newbie
Newbie


Joined: 14 April 2010
Status: Offline
Points: 19
Post Options Post Options   Thanks (0) Thanks(0)   Quote vbourbeau Quote  Post ReplyReply Direct Link To This Post Topic: Email was not forwarded
    Posted: 07 November 2014 at 1:15pm

Hi, I don't understand in log file I see all the test pass for the email but nothing is forward? And nothing quarantine?

look the log above:

11/07/14 10:51:13:914 -- (118643312) Detected TCP Connection: 24.201.245.36
11/07/14 10:51:13:914 -- (118643312) Connection from: 24.201.245.36 - Originating country : Canada
11/07/14 10:51:14:273 -- (118643312) Received MAIL FROM: ******@******.ca
11/07/14 10:51:14:351 -- (118643312) Received RCPT TO: m*****n@*****.com
11/07/14 10:51:14:398 -- (118643312) Resolving 24.201.245.36 - relais.videotron.ca
11/07/14 10:51:14:632 -- (118643312) found SPF record for videotron.ca: v=spf1 mx a:relais.videotron.ca a:mx01.videotron.com a:mx02.videotron.com ip4:24.201.245.36 ~all
11/07/14 10:51:14:742 -- (118643312) SPF query result: pass
11/07/14 10:51:14:742 -- (118643312) - SPF analysis for videotron.ca done: - pass

Nothing else after that...




Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 07 November 2014 at 8:12pm
vbourbeau,

There should be at least one other line containing the same id (118643312) indicating a disconnect. Please note that it may appear several minutes after the tries you indicated above. Some servers/bots may just attempt to find the validity of a recipient by issuing the sequence of commands above and then either disconnect or let the smtp session expire. That IP (24.201.245.36) is a legitimate mail server, but there are several reports of it having been compromised and used to spam in the past years.

If you'd like to zip and email us your entire activity logfile for us to look, you can contact us at support at logsat dot com.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
vbourbeau View Drop Down
Newbie
Newbie


Joined: 14 April 2010
Status: Offline
Points: 19
Post Options Post Options   Thanks (0) Thanks(0)   Quote vbourbeau Quote  Post ReplyReply Direct Link To This Post Posted: 18 November 2014 at 10:20am
sorry for the long reply I've not recived notice of post probaby block by spamfilter :)

any way I've many case today look this one:


11/18/14 10:06:36:059 -- (102752064) Detected TCP Connection: 204.19.176.234
11/18/14 10:06:36:059 -- (102752064) Connection from: 204.19.176.234 - Originating country : Canada
11/18/14 10:06:36:403 -- (102752064) Received MAIL FROM: A***B@a**.com
11/18/14 10:06:36:559 -- (102752064) Received RCPT TO: d***@b***.com
11/18/14 10:06:36:653 -- (102752064) Resolving 204.19.176.234 - cpt-smtp03l-p.acceo.com
11/18/14 10:06:37:043 -- (102752064) found SPF record for acceo.com: v=spf1 ip4:204.19.176.0/24 ip4:64.254.227.0/24 ip4:74.114.101.0/28 206.162.179.0/24 ?all
11/18/14 10:06:37:043 -- (102752064) SPF query result: pass
11/18/14 10:06:37:043 -- (102752064) - SPF analysis for acceo.com done: - pass
11/18/14 10:06:37:043 -- (102752064) Mail from: A***B@a**.com
11/18/14 10:06:37:449 -- (102752064) - MAPS search done...
11/18/14 10:06:37:449 -- (102752064) RCPT TO: d***@b***.com
accepted
11/18/14 10:06:37:449 -- (102752064) Bypassed all rules for: d***@b***.com from A***B@a**.com ( Whitelisted EmailTO)
11/18/14 10:07:10:745 -- (102752064) Disconnect
11/18/14 10:07:10:745 -- (102752064) IdSMTPServerException non-critical error: Not Connected



Edited by vbourbeau - 18 November 2014 at 10:22am
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 18 November 2014 at 12:50pm
SpamFilter reported an exception:
IdSMTPServerException non-critical error: Not Connected

Indicating that the connection was abruptly terminated. As this happened about 30 seconds after the the initial exchange of the MAIL FROM/RCPT TO recipients, it's likely that the disconnect it occurred while the payload of the email was being transmitted. It's thus possible that a firewall/antivirus/antispam (either the sender's or yours) has terminated the connection due to a virus or a malicious payload.

Only with a packet sniffer it would be possible to find out more details as to what is actually happening, but as the two source IPs in your email samples are different, I suspect you may be having this behavior from multiple sources, making the packet captures a bit complicated due to the large amounts of data if you're unable to filter the capture by IPs.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.305 seconds.