邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 发送邮件的日志里有很多本机连接到外网IP, 然后失败的认证信息. 这个要怎么处理? [打印本页]

作者: imone 时间: 2010-10-12 13:24
标题: 发送邮件的日志里有很多本机连接到外网IP, 然后失败的认证信息. 这个要怎么处理?
以下是其中一段的日志.
帮忙分析一下,
这是本机有木马在连接外网, 还是外网在暴力破解我的邮件服务器密码?

10:12 13:19 SMTPD(efe9016a00000b80) [192.168.1.200] connect 83.103.81.146 port 3885
10:12 13:19 SMTPD(efe9016a00000b80) [83.103.81.146] EHLO kgqrkqs.com
10:12 13:19 SMTPD(efe9016a00000b80) FAILED authentication @yuming.com
10:12 13:19 SMTPD(efed018300000b81) [192.168.1.200] connect 78.31.46.196 port 1660
10:12 13:19 SMTPD(efed018300000b81) [78.31.46.196] EHLO sxhyxa.com
10:12 13:19 SMTPD(efed018300000b81) FAILED authentication @yuming.com
10:12 13:19 SMTPD(eff6017000000b82) [192.168.1.200] connect 208.122.113.174 port 23340
10:12 13:19 SMTPD(eff6017000000b82) [208.122.113.174] EHLO bhtbgwn.com
10:12 13:19 SMTPD(eff8017f00000b83) [192.168.1.200] connect 213.210.189.2 port 55357
10:12 13:19 SMTPD(eff6017000000b82) FAILED authentication @yuming.com
10:12 13:19 SMTPD(effa017600000b84) [192.168.1.200] connect 201.151.226.156 port 1977
10:12 13:19 SMTPD(effa016200000b85) [192.168.1.200] connect 220.225.245.246 port 2235
10:12 13:19 SMTPD(effa017600000b84) [201.151.226.156] EHLO evkulv.com
10:12 13:19 SMTPD(eff8017f00000b83) [213.210.189.2] EHLO txzpbf.com
10:12 13:19 SMTPD(effa016200000b85) [220.225.245.246] EHLO gbxqjoq.com
10:12 13:19 SMTPD(effa017600000b84) FAILED authentication @yuming.com
10:12 13:19 SMTPD(eff8017f00000b83) FAILED authentication @yuming.com
10:12 13:19 SMTPD(effa016200000b85) FAILED authentication @yuming.com
10:12 13:19 SMTPD(efff018f00000b86) [192.168.1.200] connect 95.9.28.168 port 13493
10:12 13:20 SMTPD(efff018f00000b86) [95.9.28.168] EHLO ycmlnks.com
10:12 13:20 SMTPD(efff018f00000b86) FAILED authentication @yuming.com
10:12 13:20 SMTPD(f003014a00000b87) [192.168.1.200] connect 67.63.43.50 port 23539
10:12 13:20 SMTPD(f003018900000b88) [192.168.1.200] connect 110.174.232.158 port 17228
10:12 13:20 SMTPD(f003014a00000b87) [67.63.43.50] EHLO vqeftu.com
10:12 13:20 SMTPD(f003018900000b88) [110.174.232.158] EHLO fmtkhtg.com
10:12 13:20 SMTPD(f003014a00000b87) FAILED authentication @yuming.com
10:12 13:20 SMTPD(f003018900000b88) FAILED authentication @yuming.com
10:12 13:20 SMTPD(f005016a00000b89) [192.168.1.200] connect 66.64.0.243 port 4754
10:12 13:20 SMTPD(f005018300000b8a) [192.168.1.200] connect 188.223.82.84 port 63487
10:12 13:20 SMTPD(f005016a00000b89) [66.64.0.243] EHLO umnruh.com
10:12 13:20 SMTPD(f005018300000b8a) [188.223.82.84] EHLO ceripxo.com
10:12 13:20 SMTPD(f005016a00000b89) FAILED authentication @yuming.com
10:12 13:20 SMTPD(f005018300000b8a) FAILED authentication @yuming.com

作者: lgj858 时间: 2010-10-17 09:29
先说说你的服务器环境吧
你的在内网而且是不是只是用作内部发送

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.cn/)