imail spool下有大量.SMD文件,imail服务器发送大量垃圾邮件
打开IMAIL 队列显示如下
通过imail log Analyze分析
Analyze Imail Log Report
Log Start 05/03 08:49:00 - Log End 05/03 16:41:00
Logs Analyzed:
E:\IMail\spool\sys0503.txt
Reports
Remote Delivery Size (Sender)
Remote Delivery Size (Sender)
Bytes
Occurrences
Description
4,130,875 278 xgsgd@xicp.cn
3,835,418 264 hwif@xicp.cn
3,748,814 3 test@szyecon.xicp.cn
3,488,709 232 qihcweo@xicp.cn
...
...
以上xgsgd,hwif,qihcweo用户都不是我们公司的用户，正是这几个帐号在大量发送邮件。
请问是不是以上用户通过破解我司某些用户的密码，从而通过我司的邮件服务器来发送邮件。
怎样才能查到它们是冒充我司哪些用户通过邮件服务器验证成功的（不知表述是否正确）
附上imail系统日志
05:03 09:01 SMTPD(53cd01680000006f) connect 216.24.198.210 port 43313
05:03 09:01 SMTPD(53cd01680000006f) EHLO mwsaexz05:03 09:01 SMTPD(53cd01680000006f) Authenticated test@szyecon.xicp.cn, session treated as local.
05:03 09:01 SMTPD(53cd01680000006f) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTPD(53cd01680000006f) RCPT TO:<wlcc1818@gmail.com>
05:03 09:01 SMTPD(53cd01680000006f) E:\IMail\spool\D53cd01680000006f.SMD 12286
05:03 09:01 SMTP-(53cd01680000006f) processing E:\IMail\spool\Q53cd01680000006f.SMD
05:03 09:01 SMTP-(53cd01680000006f) Trying gmail.com (0)
05:03 09:01 SMTP-(53cd01680000006f) Connect gmail.com (1)
05:03 09:01 SMTP-(53cd01680000006f) 220 mx.google.com ESMTP p10si12826453pbp.191
05:03 09:01 SMTP-(53cd01680000006f) >EHLO szyecon.xicp.cn
05:03 09:01 SMTPD(53d1016800000070) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53cd01680000006f) 250-mx.google.com at your service,
05:03 09:01 SMTP-(53cd01680000006f) 250-SIZE 35882577
05:03 09:01 SMTP-(53cd01680000006f) 250-8BITMIME
05:03 09:01 SMTP-(53cd01680000006f) 250-STARTTLS
05:03 09:01 SMTP-(53cd01680000006f) 250 ENHANCEDSTATUSCODES
05:03 09:01 SMTP-(53cd01680000006f) >MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTPD(53d1016800000070) RCPT TO:<wldnnet@winmail.com>
05:03 09:01 SMTP-(53cd01680000006f) 250 2.1.0 OK p10si12826453pbp.191
05:03 09:01 SMTP-(53cd01680000006f) >RCPT To:<wlcc1818@gmail.com>
05:03 09:01 SMTP-(53cd01680000006f) 250 2.1.5 OK p10si12826453pbp.191
05:03 09:01 SMTP-(53cd01680000006f) >DATA
05:03 09:01 SMTPD(53d1016800000070) E:\IMail\spool\D53d1016800000070.SMD 12337
05:03 09:01 SMTP-(53d1016800000070) processing E:\IMail\spool\Q53d1016800000070.SMD
05:03 09:01 SMTP-(53d1016800000070) Trying winmail.com (0)
05:03 09:01 SMTP-(53d1016800000070) Connect winmail.com (1)
05:03 09:01 SMTP-(53cd01680000006f) 354Go ahead p10si12826453pbp.191
05:03 09:01 SMTP-(53cd01680000006f) >.
05:03 09:01 SMTPD(53d4016800000071) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 POP3D(61D2D18C) logon success for fengjuan szyecon.xicp.cn from 192.168.51.13
05:03 09:01 SMTPD(53d4016800000071) RCPT TO:<wleong@sina.com>
05:03 09:01 POP3D(61D2D18C) logoff for fengjuan szyecon.xicp.cn R:0, D:0, P:0, RS:0 from 192.168.51.13
05:03 09:01 POP3D(61D2D44B) logon success for chenyouliangsmt szyecon.xicp.cn from 192.168.51.29
05:03 09:01 POP3D(61D2D44B) logoff for chenyouliangsmt szyecon.xicp.cn R:0, D:0, P:0, RS:0 from 192.168.51.29
05:03 09:01 SMTPD(53d4016800000071) E:\IMail\spool\D53d4016800000071.SMD 12322
05:03 09:01 SMTP-(53d4016800000071) processing E:\IMail\spool\Q53d4016800000071.SMD
05:03 09:01 SMTP-(53d4016800000071) Trying sina.com (0)
05:03 09:01 SMTP-(53d4016800000071) Connect sina.com (1)
05:03 09:01 SMTP-(53d4016800000071) 220 irxd5-171.sinamail.sina.com.cn ESMTP
05:03 09:01 SMTP-(53d4016800000071) >EHLO szyecon.xicp.cn
05:03 09:01 SMTP-(53d4016800000071) 250-irxd5-171.sinamail.sina.com.cn
05:03 09:01 SMTP-(53d4016800000071) 250-8BITMIME
05:03 09:01 SMTP-(53d4016800000071) 250 SIZE 83886080
05:03 09:01 SMTP-(53d4016800000071) >MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53d4016800000071) 250 sender <xgsgd@xicp.cn> ok
05:03 09:01 SMTP-(53d4016800000071) >RCPT To:<wleong@sina.com>
05:03 09:01 SMTP-(53d4016800000071) 250 recipient <wleong@sina.com> ok
05:03 09:01 SMTP-(53d4016800000071) >DATA
05:03 09:01 SMTP-(53d4016800000071) 354 go ahead
05:03 09:01 SMTP-(53d4016800000071) >.
05:03 09:01 SMTP-(53d4016800000071) 250 ok:Message 698057800 accepted
05:03 09:01 SMTP-(53d4016800000071) rdeliver sina.com wleong@sina.com (1) <xgsgd@xicp.cn> 12322
05:03 09:01 SMTP-(53d4016800000071) >QUIT
05:03 09:01 SMTP-(53d4016800000071) 221 irxd5-171.sinamail.sina.com.cn
05:03 09:01 SMTP-(53d4016800000071) finished E:\IMail\spool\Q53d4016800000071.SMD status=1
05:03 09:01 SMTP-(53cd01680000006f) 250 2.0.0 OK 1304384244 p10si12826453pbp.191
05:03 09:01 SMTP-(53cd01680000006f) rdeliver gmail.com wlcc1818@gmail.com (1) <xgsgd@xicp.cn> 12286
05:03 09:01 SMTP-(53cd01680000006f) >QUIT
05:03 09:01 SMTP-(53cd01680000006f) 221 2.0.0 closing connection p10si12826453pbp.191
05:03 09:01 SMTP-(53cd01680000006f) finished E:\IMail\spool\Q53cd01680000006f.SMD status=1
05:03 09:01 SMTPD(53d7016800000072) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTPD(53d7016800000072) RCPT TO:<wlfengxg@yahoo.com.cn05:03 09:01 SMTPD(53d7016800000072) E:\IMail\spool\D53d7016800000072.SMD 12322
05:03 09:01 SMTP-(53d7016800000072) processing E:\IMail\spool\Q53d7016800000072.SMD
05:03 09:01 SMTP-(53d7016800000072) Trying yahoo.com.cn (0)
05:03 09:01 SMTP-(53d7016800000072) Connect yahoo.com.cn (1)
05:03 09:01 SMTP-(53d7016800000072) 421 4.7.0 Messages from 183.62.96.161 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
05:03 09:01 SMTP-(53d7016800000072) SMTP_DELIV_FAILED
05:03 09:01 SMTP-(53d7016800000072) >QUIT
05:03 09:01 SMTP-(53d7016800000072)
05:03 09:01 SMTP-(53d7016800000072) requeuing E:\IMail\spool\Q53d7016800000072.SMD R0 T1
05:03 09:01 SMTP-(53d7016800000072) finished E:\IMail\spool\Q53d7016800000072.SMD status=3
05:03 09:01 SMTPD(53dc016800000073) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTPD(53dc016800000073) RCPT TO:<wlh_ok2002@yahoo.com.cn>
05:03 09:01 SMTPD(53dc016800000073) E:\IMail\spool\D53dc016800000073.SMD 12330
05:03 09:01 SMTP-(53dc016800000073) processing E:\IMail\spool\Q53dc016800000073.SMD
05:03 09:01 SMTP-(53dc016800000073) Trying yahoo.com.cn (0)
05:03 09:01 SMTP-(53dc016800000073) Connect yahoo.com.cn (1)
05:03 09:01 SMTP-(53dc016800000073) 421 4.7.0 Messages from 183.62.96.161 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html
05:03 09:01 SMTP-(53dc016800000073) SMTP_DELIV_FAILED
05:03 09:01 SMTP-(53dc016800000073) >QUIT
05:03 09:01 SMTP-(53dc016800000073)
05:03 09:01 SMTP-(53dc016800000073) requeuing E:\IMail\spool\Q53dc016800000073.SMD R0 T1
05:03 09:01 SMTP-(53dc016800000073) finished E:\IMail\spool\Q53dc016800000073.SMD status=3
05:03 09:01 SMTPD(53df016800000074) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTPD(53df016800000074) RCPT TO:<wlhits@sina.com.cn>
05:03 09:01 SMTPD(53df016800000074) E:\IMail\spool\D53df016800000074.SMD 12329
05:03 09:01 SMTP-(53df016800000074) processing E:\IMail\spool\Q53df016800000074.SMD
05:03 09:01 SMTP-(53df016800000074) Trying sina.com.cn (0)
05:03 09:01 SMTP-(53df016800000074) Connect sina.com.cn (1)
05:03 09:01 SMTP-(53df016800000074) 220 irtj11-87.sinamail.sina.com.cn ESMTP
05:03 09:01 SMTP-(53df016800000074) >EHLO szyecon.xicp.cn
05:03 09:01 SMTPD(53e2016800000075) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53df016800000074) 250-irtj11-87.sinamail.sina.com.cn
05:03 09:01 SMTP-(53df016800000074) 250-8BITMIME
05:03 09:01 SMTP-(53df016800000074) 250 SIZE 83886080
05:03 09:01 SMTP-(53df016800000074) >MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53df016800000074) 250 sender <xgsgd@xicp.cn> ok
05:03 09:01 SMTP-(53df016800000074) >RCPT To:<wlhits@sina.com.cn>
05:03 09:01 SMTP-(53df016800000074) 452 Too many recipients received this hour
05:03 09:01 SMTP-(53df016800000074) >QUIT
05:03 09:01 SMTP-(53df016800000074) 221 irtj11-87.sinamail.sina.com.cn
05:03 09:01 SMTP-(53df016800000074) requeuing E:\IMail\spool\Q53df016800000074.SMD R0 T1
05:03 09:01 SMTP-(53df016800000074) finished E:\IMail\spool\Q53df016800000074.SMD status=3
05:03 09:01 SMTPD(53e2016800000075) RCPT TO:<wlhxx@mail.china.com>
05:03 09:01 SMTPD(53e2016800000075) E:\IMail\spool\D53e2016800000075.SMD 12335
05:03 09:01 SMTP-(53e2016800000075) processing E:\IMail\spool\Q53e2016800000075.SMD
05:03 09:01 SMTP-(53e2016800000075) Trying mail.china.com (0)
05:03 09:01 SMTP-(53e2016800000075) Connect mail.china.com (1)
05:03 09:01 SMTP-(53d1016800000070) 220 p3pismtp01-001.prod.phx3.secureserver.net ESMTP
05:03 09:01 SMTP-(53d1016800000070) >EHLO szyecon.xicp.cn
05:03 09:01 SMTP-(53d1016800000070) 250-p3pismtp01-001.prod.phx3.secureserver.net
05:03 09:01 SMTP-(53d1016800000070) 250-8BITMIME
05:03 09:01 SMTP-(53d1016800000070) 250 SIZE 31457280
05:03 09:01 SMTP-(53d1016800000070) >MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53d1016800000070) 250 sender <xgsgd@xicp.cn> ok
05:03 09:01 SMTP-(53d1016800000070) >RCPT To:<wldnnet@winmail.com>
05:03 09:01 POP3D(61D2FBA9) logoff for dl.angle szyecon.xicp.cn R:28, D:28, P:0, RS:10729332 from 192.168.5.194
05:03 09:01 SMTP-(53d1016800000070) 550 #5.1.0 Address rejected wldnnet@winmail.com
05:03 09:01 SMTP-(53d1016800000070) >QUIT
05:03 09:01 SMTP-(53d1016800000070) 221 p3pismtp01-001.prod.phx3.secureserver.net
05:03 09:01 SMTP-(53d1016800000070) Creating message from Postmaster
05:03 09:01 SMTP-(53d1016800000070) Delivery process now using new file: 53eb000000c423a3
05:03 09:01 SMTP-(53eb000000c423a3) processing E:\IMail\spool\Q53eb000000c423a3.GSE
05:03 09:01 SMTP-(53d1016800000070) finished E:\IMail\spool\Q53d1016800000070.SMD status=2
05:03 09:01 SMTP-(53eb000000c423a3) Trying xicp.cn (0)
05:03 09:01 SMTP-(53eb000000c423a3) Connect xicp.cn (1)
05:03 09:01 SMTPD(53e5016800000076) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53eb000000c423a3) 220 srv05.olivemail.cn ESMTP Olivemail
05:03 09:01 SMTP-(53eb000000c423a3) >EHLO szyecon.xicp.cn
05:03 09:01 SMTPD(53e5016800000076) RCPT TO:<wlinco@mail.tzptt.zj.cn>
05:03 09:01 SMTP-(53eb000000c423a3) 250-srv05.olivemail.cn
05:03 09:01 SMTP-(53eb000000c423a3) 250-PIPELINING
05:03 09:01 SMTP-(53eb000000c423a3) 250-SIZE 102400000
05:03 09:01 SMTP-(53eb000000c423a3) 250-VRFY
05:03 09:01 SMTP-(53eb000000c423a3) 250-ETRN
05:03 09:01 SMTP-(53eb000000c423a3) 250-STARTTLS
05:03 09:01 SMTP-(53eb000000c423a3) 250-AUTH LOGIN PLAIN
05:03 09:01 SMTP-(53eb000000c423a3) 250-AUTH=LOGIN PLAIN
05:03 09:01 SMTP-(53eb000000c423a3) 250-ENHANCEDSTATUSCODES
05:03 09:01 SMTP-(53eb000000c423a3) 250-8BITMIME
05:03 09:01 SMTP-(53eb000000c423a3) 250 DSN
05:03 09:01 SMTP-(53eb000000c423a3) >MAIL FROM:<>
05:03 09:01 SMTP-(53eb000000c423a3) 250 2.1.0 Ok
05:03 09:01 SMTP-(53eb000000c423a3) >RCPT To:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53eb000000c423a3) 554 5.7.1 <>: Sender address rejected: Access denied
05:03 09:01 SMTP-(53eb000000c423a3) >QUIT
05:03 09:01 SMTP-(53eb000000c423a3) 221 2.0.0 Bye
05:03 09:01 SMTP-(53eb000000c423a3) finished E:\IMail\spool\Q53eb000000c423a3.GSE status=2
05:03 09:01 SMTPD(53e5016800000076) E:\IMail\spool\D53e5016800000076.SMD 12326
05:03 09:01 SMTP-(53e5016800000076) processing E:\IMail\spool\Q53e5016800000076.SMD
05:03 09:01 SMTP-(53e5016800000076) Trying mail.tzptt.zj.cn (0)
05:03 09:01 SMTP-(53e5016800000076) Connect mail.tzptt.zj.cn (1)
05:03 09:01 SMTP-(53e5016800000076) 220 #2172002 Helo Welcome!Naesa Umail-TX Service ready
05:03 09:01 SMTP-(53e5016800000076) >EHLO szyecon.xicp.cn
05:03 09:01 SMTP-(53e5016800000076) 250-SIZE 65536000
05:03 09:01 SMTP-(53e5016800000076) 250-8bitmime
05:03 09:01 SMTP-(53e5016800000076) 250-AUTH LOGIN PLAIN
05:03 09:01 SMTP-(53e5016800000076) 250-AUTH=LOGIN PLAIN
05:03 09:01 SMTP-(53e5016800000076) 250 OK
05:03 09:01 SMTP-(53e5016800000076) >MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTP-(53e5016800000076) 250 #2172005 Ok
05:03 09:01 SMTP-(53e5016800000076) >RCPT To:<wlinco@mail.tzptt.zj.cn>
05:03 09:01 SMTP-(53e5016800000076)
05:03 09:01 SMTP-(53e5016800000076) >QUIT
05:03 09:01 SMTP-(53e5016800000076)
05:03 09:01 SMTP-(53e5016800000076) requeuing E:\IMail\spool\Q53e5016800000076.SMD R0 T1
05:03 09:01 SMTP-(53e5016800000076) finished E:\IMail\spool\Q53e5016800000076.SMD status=3
05:03 09:01 POP3D(61D3346C) logon success for jimmychen szyecon.xicp.cn from 192.168.7.50
05:03 09:01 SMTPD(53ed016800000077) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 POP3D(61D3346C) logoff for jimmychen szyecon.xicp.cn R:0, D:0, P:0, RS:0 from 192.168.7.50
05:03 09:01 SMTPD(53ed016800000077) RCPT TO:<wljeffery@hotmail.com>
05:03 09:01 POP3D(61D338C2) logon success for lcy szyecon.xicp.cn from 192.168.52.24
05:03 09:01 POP3D(61D338C2) logoff for lcy szyecon.xicp.cn R:0, D:0, P:0, RS:0 from 192.168.52.24
05:03 09:01 SMTPD(53ed016800000077) E:\IMail\spool\D53ed016800000077.SMD 12338
05:03 09:01 SMTP-(53ed016800000077) processing E:\IMail\spool\Q53ed016800000077.SMD
05:03 09:01 SMTP-(53ed016800000077) Trying hotmail.com (0)
05:03 09:01 SMTP-(53ed016800000077) Connect hotmail.com (1)
05:03 09:01 POP3D(61D34C98) logon success for youj szyecon.xicp.cn from 192.168.7.37
05:03 09:01 POP3D(61D34C98) logoff for youj szyecon.xicp.cn R:0, D:0, P:0, RS:0 from 192.168.7.37
05:03 09:01 SMTP-(53ed016800000077) 220 col0-mc3-f29.Col0.hotmail.com Sending unsolicited commercial or bulk e-mail to Microsoft's computer network is prohibited. Other restrictions are found at http://privacy.msn.com/Anti-spam/. Violations will result in use of equipment located in California and other states. Mon, 2 May 2011 17:57:55 -0700
05:03 09:01 SMTP-(53ed016800000077) >EHLO szyecon.xicp.cn
05:03 09:01 POP3D(61D35012) logon success for hey szyecon.xicp.cn from 192.168.53.6
05:03 09:01 SMTP-(53ed016800000077) 250-col0-mc3-f29.Col0.hotmail.com (3.12.0.56) Hello
05:03 09:01 SMTP-(53ed016800000077) 250-SIZE 36909875
05:03 09:01 SMTP-(53ed016800000077) 250-PIPELINING
05:03 09:01 SMTP-(53ed016800000077) 250-8bitmime
05:03 09:01 SMTP-(53ed016800000077) 250-BINARYMIME
05:03 09:01 SMTP-(53ed016800000077) 250-CHUNKING
05:03 09:01 SMTP-(53ed016800000077) 250-AUTH LOGIN
05:03 09:01 SMTP-(53ed016800000077) 250-AUTH=LOGIN
05:03 09:01 SMTP-(53ed016800000077) 250 OK
05:03 09:01 SMTP-(53ed016800000077) >MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 SMTPD(53f2016800000078) MAIL FROM:<xgsgd@xicp.cn>
05:03 09:01 POP3D(61D35012) logoff for hey szyecon.xicp.cn R:0, D:0, P:0, RS:0 from 192.168.53.6
05:03 09:01 SMTPD(53f2016800000078) RCPT TO:<wll@jobems.com>
05:03 09:01 POP3D(61D352C2) logon success for yctan szyecon.xicp.cn from 192.168.51.14
05:03 09:01 POP3D(61D352C2) logoff for yctan szyecon.xicp.cn R:0, D:0, P:0, RS:0 from 192.168.51.14
05:03 09:01 SMTP-(53ed016800000077) 250 xgsgd@xicp.cn....Sender OK
05:03 09:01 SMTP-(53ed016800000077) >RCPT To:<wljeffery@hotmail.com>
05:03 09:01 SMTP-(53ed016800000077) 250 wljeffery@hotmail.com
05:03 09:01 SMTP-(53ed016800000077) >DATA
05:03 09:01 SMTP-(53ed016800000077) 354 Start mail input; end with <CRLF>.<CRLF>
05:03 09:01 SMTP-(53ed016800000077) >.
[ 本帖最后由 nitchina 于 2011-5-3 17:19 编辑 ] 筛选分析日志后 找到可疑的帐号 再反查日志中被利用的本地的帐号 最近也遇到同样的情况，关注下 LZ已经很好的解释了这个问题的解决办法了。
页:
[1]
