邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: 这是被攻击了吗？ [打印本页]

作者: 山坛兄弟 时间: 2011-6-1 16:45
标题: 这是被攻击了吗？
20110601 145953 127.0.0.1    SMTPD (00110038) [210.22.180.62] RCPT TO:<contact@openshare.com.vn>
20110601 145953 127.0.0.1    SMTPD (001300EE) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145953 127.0.0.1    SMTPD (00270054) [210.22.180.62] d:\IMail\spool\De34900270054d9f5.SMD 57020
20110601 145953 127.0.0.1    SMTPD (00130078) [210.22.180.62] d:\IMail\spool\De33b00130078a307.SMD 57034
20110601 145954 127.0.0.1    SMTPD (001300EE) [210.22.180.62] RCPT TO:<thanhcongnguyen1989@gmail.com>
20110601 145954 127.0.0.1    SMTPD (001B0266) [210.22.180.62] d:\IMail\spool\De33d001b0266ad29.SMD 57015
20110601 145954 127.0.0.1    SMTPD (00130078) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145954 127.0.0.1    SMTPD (00190244) [210.22.180.62] d:\IMail\spool\De35f00190244314d.SMD 57019
20110601 145954 127.0.0.1    SMTPD (001A0206) [210.22.180.62] d:\IMail\spool\De33d001a0206aad7.SMD 57011
20110601 145955 127.0.0.1    SMTPD (001B0266) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145955 127.0.0.1    SMTPD (000F0160) [210.22.180.62] d:\IMail\spool\De338000f01609887.SMD 57034
20110601 145955 127.0.0.1    SMTPD (00270054) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145955 127.0.0.1    SMTPD (0007027E) [210.22.180.62] d:\IMail\spool\De33e0007027eb017.SMD 57017
20110601 145955 127.0.0.1    SMTPD (00270054) [210.22.180.62] RCPT TO:<info@wrap-roll.com>
20110601 145955 127.0.0.1    SMTPD (00190244) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145955 127.0.0.1    SMTPD (001A0206) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145955 127.0.0.1    SMTPD (001A0206) [210.22.180.62] RCPT TO:<paul.burger@unibas.ch>
20110601 145956 127.0.0.1    SMTPD (0008026E) [210.22.180.62] d:\IMail\spool\De3590008026e1941.SMD 57012
20110601 145956 127.0.0.1    SMTPD (001B0266) [210.22.180.62] RCPT TO:<gm@vprotravel.com>
20110601 145956 127.0.0.1    SMTPD (00190244) [210.22.180.62] RCPT TO:<bianca.baerlocher@unibas.ch>
20110601 145957 127.0.0.1    SMTPD (0008026E) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145957 127.0.0.1    SMTPD (001201F6) [210.22.180.62] d:\IMail\spool\De346001201f6cdff.SMD 57020
20110601 145957 127.0.0.1    SMTPD (0008026E) [210.22.180.62] RCPT TO:<support@Phongdichcum.com>
20110601 145957 127.0.0.1    SMTPD (0007027E) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145958 127.0.0.1    SMTPD (001201F6) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145958 127.0.0.1    SMTPD (00040062) [210.22.180.62] EHLO lily
20110601 145958 127.0.0.1    SMTPD (000F0160) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145958 127.0.0.1    SMTPD (001600D8) [210.22.180.62] d:\IMail\spool\De324001600d849fa.SMD 57019
20110601 145958 127.0.0.1    SMTPD (000F0160) [210.22.180.62] RCPT TO:<biltonen@biltwater.com>
20110601 145958 127.0.0.1    SMTPD (00040084) [210.22.180.62] d:\IMail\spool\De33a000400849f9c.SMD 57029
20110601 145958 127.0.0.1    SMTPD (0024007C) [210.22.180.62] d:\IMail\spool\De3680024007c533c.SMD 57020
20110601 145958 127.0.0.1    SMTPD (001600D8) [210.22.180.62] MAIL FROM:<jiangecho2000@gmail.com>
20110601 145958 127.0.0.1    SMTPD (001201F6) [210.22.180.62] RCPT TO:<isfh.bahnemann@oln.comlink>

作者: 山坛兄弟 时间: 2011-6-1 17:48
靠，找到罪魁祸首了！
20110601 000905 127.0.0.1 SMTPD (000007A0) Authenticated echo@****.com, session treated as local.

很可能被盗号利用了！

[ 本帖最后由山坛兄弟于 2011-6-1 17:49 编辑 ]

作者: lgj858 时间: 2011-7-1 23:54
筛选分析日志
然后回溯到最开始查找哪个帐号被利用了，日志里面会有

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.cn/)