邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 是不是帐户给劫持了 [打印本页]

作者: longest123 时间: 2010-12-16 10:22
标题: 是不是帐户给劫持了
今天查看系统日志，发现凌晨很多记录，我一直都没在凌晨作任何操作，很多相似的记录如下，麻烦高手帮忙分析下：
Tue 2010-12-14 00:05:30: Session 8396; child 1
Tue 2010-12-14 00:05:30: 接受 POP 连接来自 [192.*.*.* ：1143]
Tue 2010-12-14 00:05:30: --> +OK abc.com POP MDaemon 9.5.2 ready <MDAEMON-F201012140005.AA053098MD5280@abc.com>
Tue 2010-12-14 00:05:30: <-- USER my
Tue 2010-12-14 00:05:30: --> +OK my... User ok
Tue 2010-12-14 00:05:30: <-- PASS ******
Tue 2010-12-14 00:05:30: --> +OK my@abc.com's mailbox has 149 total messages (148450066 octets)
Tue 2010-12-14 00:05:30: <-- STAT
Tue 2010-12-14 00:05:30: --> +OK 149 148450066
Tue 2010-12-14 00:05:30: <-- UIDL
Tue 2010-12-14 00:05:30: 发送 UIDL 回复（不记录）
Tue 2010-12-14 00:05:30: <-- LIST
Tue 2010-12-14 00:05:30: 发送 LIST 回复（不记录）
Tue 2010-12-14 00:05:30: <-- QUIT
Tue 2010-12-14 00:05:30: --> +OK my@abc.com abc.com POP Server signing off (149 messages left)
Tue 2010-12-14 00:05:30: POP session complete (Bytes in/out: 56/9135)
Tue 2010-12-14 00:05:30: ----------

作者: longest123 时间: 2010-12-16 10:28
标题: 垃圾邮件很多
最近邮箱很多垃圾邮件，凌晨的日志中有很多下面的记录，请高手分析下
Tue 2010-12-14 00:02:56: ----------
Tue 2010-12-14 00:03:00: Session 8365; child 1; thread 38084
Tue 2010-12-14 00:02:56: 接受 SMTP 连接来自 [192.*.*.* ：4727]
Tue 2010-12-14 00:02:56: --> 220 abc.com ESMTP MDaemon 9.5.2; Tue, 14 Dec 2010 00:02:56 +0800
Tue 2010-12-14 00:03:00: <-- EHLO ylmf-pc
Tue 2010-12-14 00:03:00: Performing IP lookup (ylmf-pc)
Tue 2010-12-14 00:03:00: * D=ylmf-pc TTL=(0) A=[113.*.*.5]
Tue 2010-12-14 00:03:00: ---- End IP lookup results
Tue 2010-12-14 00:03:00: --> 250-abc.com Hello ylmf-pc (may be forged), pleased to meet you
Tue 2010-12-14 00:03:00: --> 250-ETRN
Tue 2010-12-14 00:03:00: --> 250-AUTH=LOGIN
Tue 2010-12-14 00:03:00: --> 250-AUTH LOGIN CRAM-MD5
Tue 2010-12-14 00:03:00: --> 250-8BITMIME
Tue 2010-12-14 00:03:00: --> 250 SIZE 50000000
Tue 2010-12-14 00:03:00: <-- AUTH LOGIN
Tue 2010-12-14 00:03:00: --> 334 VXNlcm5hbWU6
Tue 2010-12-14 00:03:00: 连接关闭
Tue 2010-12-14 00:03:00: SMTP 会话终止（in/out 字节： 26/242）

作者: longest123 时间: 2010-12-16 10:29
标题: 垃圾邮件很多
最近邮箱很多垃圾邮件，凌晨的日志中有很多下面的记录，请高手分析下
Tue 2010-12-14 00:02:56: ----------
Tue 2010-12-14 00:03:00: Session 8365; child 1; thread 38084
Tue 2010-12-14 00:02:56: 接受 SMTP 连接来自 [192.*.*.* ：4727]
Tue 2010-12-14 00:02:56: --> 220 abc.com ESMTP MDaemon 9.5.2; Tue, 14 Dec 2010 00:02:56 +0800
Tue 2010-12-14 00:03:00: <-- EHLO ylmf-pc
Tue 2010-12-14 00:03:00: Performing IP lookup (ylmf-pc)
Tue 2010-12-14 00:03:00: * D=ylmf-pc TTL=(0) A=[113.*.*.5]
Tue 2010-12-14 00:03:00: ---- End IP lookup results
Tue 2010-12-14 00:03:00: --> 250-abc.com Hello ylmf-pc (may be forged), pleased to meet you
Tue 2010-12-14 00:03:00: --> 250-ETRN
Tue 2010-12-14 00:03:00: --> 250-AUTH=LOGIN
Tue 2010-12-14 00:03:00: --> 250-AUTH LOGIN CRAM-MD5
Tue 2010-12-14 00:03:00: --> 250-8BITMIME
Tue 2010-12-14 00:03:00: --> 250 SIZE 50000000
Tue 2010-12-14 00:03:00: <-- AUTH LOGIN
Tue 2010-12-14 00:03:00: --> 334 VXNlcm5hbWU6
Tue 2010-12-14 00:03:00: 连接关闭
Tue 2010-12-14 00:03:00: SMTP 会话终止（in/out 字节： 26/242）

作者: neil.fu 时间: 2010-12-16 13:38
最近网上疯传的破解弱密码的软件，导致很多弱密码的邮箱被破解，希望IT朋友多多注意，加强密码保护

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.cn/)