邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 不存在的用户发送大量垃圾邮件 [打印本页]

作者: badboylife 时间: 2010-12-23 10:13
标题: 不存在的用户发送大量垃圾邮件
斑竹，好久没来了，圣诞快乐。
言归正传
最近，发生了好几次，发现邮件服务器向外大量发送垃圾邮件，上万封，发送者为<>或者我服务器中不存在的一个用户名称，
在Mail Relay Options中我已选了No Mail Relay,还勾选了check valid sender,Atuo-deny possible hack attempts,Disable SMTP 'VRFY' command 3项
我始终就没找到关于发信者禁止为空的选项
我的机器是2003+mail8.22+FTP，没有网站.
还有一件怪事，也发生过两次了，早晨收邮件，客户端无法连接服务器，远程登录服务器，发现pop3，什么的一切都在运行，手动重启服务，还是依旧。web登录没有问题，
检查邮件服务器的端口，也没有被其他程序占用。等过个一个小时，有都正常了。令人百思不得其解。

作者: badboylife 时间: 2010-12-23 11:08
我把日志分析贴上来，斑竹把我看看，有一个和我差一个字母的域名在作怪！！！

Analyze V1.0
Log Start 12/23 00:00:00 - Log End 12/23 09:28:00
Logs Analyzed:
D:\IMail\spool\sys1223.txt
-------------------------------------------------------------------------------
SMTPD Connections

Occurrences Connecting IP
-------------------------------------------------------------------------------

Total - 4070

3,482 41.218.225.37
536 我的ip
6 64.130.108.20
5 66.207.207.65
5 59.57.244.139
3 125.77.254.227
2 201.216.190.157
2 67.19.195.90
2 216.145.76.16
2 203.199.134.253
2 139.165.32.74
2 65.244.158.104
。。。。。。。
-------------------------------------------------------------------------------
SMTPD Errors
Occurrences Error
-------------------------------------------------------------------------------
Total - 1

1 Invalid User IP = 206.248.241.203
-------------------------------------------------------------------------------
SMTP Local Deliveries
Occurrences Recipient
-------------------------------------------------------------------------------
Total - 4151
4,137 备份邮箱@我的域名
8 用户1@我的域名
3 用户2@我的域名
3 用户3@我的域名
-------------------------------------------------------------------------------
SMTP Senders (Remote Deliveries)
Occurrences Sender
-------------------------------------------------------------------------------
Total - 14304
14,304 mensahannan@域名（和我的域名差一个字母）
-------------------------------------------------------------------------------
SMTP Senders (Local Deliveries)
Occurrences Sender
-------------------------------------------------------------------------------
Total - 4151
4,126 mensahannan@域名（和我的域名差一个字母）
16 sys@message.yihaodian.com
3 janivy@galatiyachts.com
3 imerry_vk@cpdns.net
3 j_marian_uh@adeptis.com
-------------------------------------------------------------------------------
SMTP Remote Delivieries
Occurrences Recipient
-------------------------------------------------------------------------------
Total - 28553
19,642 multiple
3 amagiushunter@msn.com
3 ak4480@hotmail.com
3 djrothstein@vosymca.org
3 amr_atabani@msn.com
.........
-------------------------------------------------------------------------------
SMTP Deliveries to host

Occurrences Host
-------------------------------------------------------------------------------
Total - 14304
4,365 hotmail.com
2,125 msn.com
524 yahoo.com
123 cableone.net
107 spray.se
。。。。。。
-------------------------------------------------------------------------------
SMTP Errors
Occurrences Error
-------------------------------------------------------------------------------
Total - 120012

93,873 SMTP_DELIV_FAILED
8,851    undeliverable 553 5.1.8 <mensahannan@域名（和我的域名差一个字母）>... Domain of sender address mensahannan@域名

（和我的域名差一个字母） does not exist
6,280    undeliverable 550 IP 我的ip is blocked by EarthLink. Go to earthlink.net/block for details.
1,948    undeliverable 550 OU-002 Unfortunately, messages from 我的ip weren't sent. Please contact your Internet service

provider since part of their network is on our block list. You can also refer your provider to

http://mail.live.com/mail/troubleshooting.aspx#e
601    undeliverable 550 SC-001 Unfortunately, messages from 我的ip weren't sent. Please contact your Internet service

provider since part of their network is on our block list. You can also refer your provider to

http://mail.live.com/mail/troubleshooting.aspx#e
448    undeliverable 554 Denied [CS] (Mode: normal)
328    undeliverable 571 Message Refused
310    undeliverable 554 Transaction Failed Spam Message not queued.
261    undeliverable 550 5.1.8 <mensahannan@域名（和我的域名差一个字母）> Invalid address
253    undeliverable 553 Invalid sender domain
247    undeliverable 550 Unroutable address
240    undeliverable 550 5.1.8 invalid/host-not-in-DNS return address not allowed
231    undeliverable 572 mensahannan@域名（和我的域名差一个字母） host name is unknown
227    undeliverable 553 #5.1.8 Domain of sender address <mensahannan@域名（和我的域名差一个字母）> does not exist
202    undeliverable 553 <mensahannan@域名（和我的域名差一个字母）> unable to verify address
201    undeliverable 501 Sender domain must exist
163    undeliverable 550 5.1.0 error: R4.1: 我的ip
163    undeliverable 553 5.1.8 <mensahannan@域名（和我的域名差一个字母）>: Sender address rejected: Domain not found
160    undeliverable 553 域名（和我的域名差一个字母） does not exist
138    undeliverable 521 Error - Blocked for abuse. See http://att.net/blocks
131    undeliverable 553 5.1.8 Domain of sender address 域名（和我的域名差一个字母） does not exist
119    undeliverable 501 5.7.1 <mensahannan@域名（和我的域名差一个字母）>... Sender domain must exist
118    undeliverable 553 sorry, your envelope sender domain must exist (#5.7.1)
116    undeliverable 501 <mensahannan@域名（和我的域名差一个字母）>... Sender domain must exist
114    undeliverable 554 域名（和我的域名差一个字母） has no MX or A record
106    undeliverable 554 mail server permanently rejected message (#5.3.0)
105    undeliverable 550 Sender verify failed
........
-------------------------------------------------------------------------------
SMTP Mx Failures
Occurrences IP
-------------------------------------------------------------------------------
Total - 22340
5,972 202.106.199.34
809 195.245.231.196
417 209.240.204.25
337 64.95.64.197
308 209.240.204.26
268 216.82.248.44
257 198.133.103.44
256 216.82.248.45
190 211.115.216.252
175 68.180.206.184
..........
-------------------------------------------------------------------------------
Web Logins
Occurrences User
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web Files
Occurrences File
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web HEAD Requests
Occurrences IP
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web Hits
Occurrences IP
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Web Errors
Occurrences IP
-------------------------------------------------------------------------------

Total - 0
-------------------------------------------------------------------------------
Pop Logon

Occurrences User
-------------------------------------------------------------------------------
Total - 3
1 用户2@我的域名
1 用户3@我的域名
1 用户1@我的域名
-------------------------------------------------------------------------------
IMAP Login
Occurrences User
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
IMAP Errors
Occurrences User
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
POP Errors
Occurrences User
-------------------------------------------------------------------------------
Total - 0
-------------------------------------------------------------------------------
Unknown Log Lines
Occurrences Message
------------------------------------------------------------------------------
Total - 102
16
2 ***************************************************
2 ] MAIL FROM:<mensahannan@域名（和我的域名差一个字母）>
1 hews@fenceworksinc.com>
1 PT TO:<reedyvick@yahoo.com>
1 O:<jimmy@netkonnect.net>
1 steg35@yahoo.com>
1 <abdallah1974@yahoo.com>
1 leased to meet you
1 OM:<mensahannan@域名（和我的域名差一个字母）>
1 ected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the

intended recipient via alternate means.
1 ulaly01@yahoo.com>
1 gela_k_avery@yahoo.com>
1 isenbethed_04@yahoo.com>
1 rad2000@hotmail.com>
1 TO:<joseph1615@cs.com>
1 \spool\D412301cf00002503.SMD 3757
1 ail for delivery
1 .101.217.116] connect 41.218.225.37 port 55345
1 T TO:<crazybeach2000@yahoo.com>
1 :23 01:40 SMTP-(1f6901a800000e0d) SMTP_DELIV_FAILED
1 O:<marysavy@msn.com>
1 T TO:<gregt@1stpriority.com>
1 :<bbvd3@yahoo.com>
1 FROM:<mensahannan@域名（和我的域名差一个字母）>
1 rik@webmaster.se>
。。。。。。。
-------------------------------------------------------------------------------
Domain Senders - Remote Delivery
Size Occurrences Domain
-------------------------------------------------------------------------------
53,738,473 14,304 域名（和我的域名差一个字母）
-------------------------------------------------------------------------------
Remote Delivery - Senders
Size Occurrences Sender
-------------------------------------------------------------------------------

53,738,473 14,304 mensahannan@域名（和我的域名差一个字母）
-------------------------------------------------------------------------------
Remote Recipients by Domain

Size Occurrences Domain
-------------------------------------------------------------------------------

16,398,832 4,365 hotmail.com
7,983,400 2,125 msn.com
1,968,608 524 yahoo.com
462,093 123 cableone.net
401,986 107 spray.se
......
-------------------------------------------------------------------------------
Local Recipients by Sender Domain

Size Occurrences Domain
-------------------------------------------------------------------------------
15,500,925 4,126 域名（和我的域名差一个字母）
862,582 16 message.yihaodian.com
7,875 3 cpdns.net
6,999 3 adeptis.com
6,222 3 galatiyachts.com
-------------------------------------------------------------------------------
Local Deliveries by Sender
Size Occurrences Sender
-------------------------------------------------------------------------------
15,500,925 4,126 mensahannan@域名（和我的域名差一个字母）
862,582 16 sys@message.yihaodian.com
7,875 3 imerry_vk@cpdns.net
6,999 3 j_marian_uh@adeptis.com
6,222 3 janivy@galatiyachts.com
-------------------------------------------------------------------------------
Local Recipients
Size Occurrences User
-------------------------------------------------------------------------------
15,939,248 4,137 备份邮箱@我的域名
431,291 8 用户1@我的域名
7,032 3 用户3@我的域名
7,032 3 用户2@我的域名
-------------------------------------------------------------------------------
Local Recipent Domains
Size Occurrences Domain
-------------------------------------------------------------------------------
16,384,603 4,151 我的域名

作者: badboylife 时间: 2010-12-23 11:14
一开始，我以为是我的用户被人利用了，可仔细查看，发现大量发送邮件的用户的域名和我的域名差一个字母，可这个用户
怎么能利用我的邮件服务器向外发邮件呢？虽然是失败，但大量的待发邮件挤在我的队列里，实际上使我的服务器完全被阻塞了。
为什么会发生这样的事？

作者: neil.fu 时间: 2010-12-23 11:20
这个应该是退信式的垃圾邮件吧

作者: lgj858 时间: 2010-12-23 11:20
你的有帐号被利用在发送垃圾邮件了

作者: lgj858 时间: 2010-12-23 11:28
需要分析日志然后回溯查询被利用的帐号

作者: badboylife 时间: 2010-12-23 11:32

原帖由 lgj858 于 2010-12-23 11:20 发表
你的有帐号被利用在发送垃圾邮件了

斑竹，帮我看看日志，好像不是我的账户被利用啊
我的邮件账户很少，就3个用户，一个备份邮箱用户。能帮我看看是哪个用户被利用了吗？

作者: lgj858 时间: 2010-12-24 10:19
要看他验证的用户用的哪个

作者: badboylife 时间: 2010-12-24 11:24

原帖由 lgj858 于 2010-12-24 10:19 发表
要看他验证的用户用的哪个

斑竹，日志分析上看的出来吗？通过看日志分析，反查日志是吗？

作者: lgj858 时间: 2010-12-26 20:10
当然有记录

作者: ineedrmb 时间: 2011-1-27 11:00
确实肯定是某个帐号被盗用了，日志里都会反应得出来的，用日志分析器找到那个帐号改了密码就行了。

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.cn/)