求助：服务器群发垃圾邮件

eiis

10:08 11:20 SMTP-(8dd5009500007d78) 250-8BITMIME
10:08 11:20 SMTP-(8dd5009500007d78) 250-ENHANCEDSTATUSCODES
10:08 11:20 SMTP-(8dd5009500007d78) 250 DSN
10:08 11:20 SMTP-(8dd5009500007d78) >MAIL FROM:<noreply@163.com>
10:08 11:20 SMTP-(8dd900a200007d7e) 502 This server configured to NOT honor EHLO at present
10:08 11:20 SMTP-(8dd900a200007d7e) >HELO gotonets-676d68
10:08 11:20 SMTPD(8dde014c00007d85) [123.118.88.163] f:\IMail\spool\D8dde014c00007d85.SMD 67829
10:08 11:20 SMTP-(8dde014c00007d85) processing f:\IMail\spool\Q8dde014c00007d85.SMD
10:08 11:20 SMTP-(8dde014c00007d85) Trying NETVIGATOR.COM (0)
10:08 11:20 SMTP-(8dd5009500007d78) 250 2.0.0 OK
10:08 11:20 SMTP-(8dd5009500007d78) >RCPT To:<LINK@MAILGATE.RU>
10:08 11:20 SMTP-(8dde014c00007d85) Connect NETVIGATOR.COM [218.102.53.146:25] (1)
10:08 11:20 SMTP-(8dde014c00007d85) 220 imsmx06.netvigator.com ESMTP Sendmail 8.14.3/8.14.3; Fri, 8 Oct 2010 11:27:35 +0800
10:08 11:20 SMTP-(8dde014c00007d85) >EHLO gotonets-676d68
10:08 11:20 SMTPD(8de8014800007d94) [219.235.2.130] connect 123.118.88.163 port 32562
10:08 11:20 SMTPD(8de500b000007d8f) Authenticated marketing@blue-capital.com, session treated as local.
10:08 11:20 SMTPD(8de5014300007d90) Authenticated marketing@blue-capital.com, session treated as local.
10:08 11:20 SMTP-(8dd900a200007d7e) 250 gebro-sales.nl Hello gotonets-676d68, pleased to meet you
10:08 11:20 SMTP-(8dd900a200007d7e) >MAIL FROM:<noreply@163.com>
10:08 11:20 SMTP-(8dde014c00007d85) 250-imsmx06.netvigator.com Hello host-219-235-2-130.iphost.gotonets.com [219.235.2.130], pleased to meet you
10:08 11:20 SMTP-(8dde014c00007d85) 250-ENHANCEDSTATUSCODES
10:08 11:20 SMTP-(8dde014c00007d85) 250-PIPELINING
10:08 11:20 SMTP-(8dde014c00007d85) 250-8BITMIME
10:08 11:20 SMTP-(8dde014c00007d85) 250-SIZE 47185920
10:08 11:20 SMTP-(8dde014c00007d85) 250-DSN
10:08 11:20 SMTP-(8dde014c00007d85) 250-ETRN
10:08 11:20 SMTP-(8dde014c00007d85) 250-DELIVERBY
10:08 11:20 SMTP-(8dde014c00007d85) 250 HELP
10:08 11:20 SMTP-(8dde014c00007d85) >MAIL FROM:<noreply@163.com>
10:08 11:20 SMTP-(8dde014c00007d85) 250 2.1.0 <noreply@163.com>... Sender ok
10:08 11:20 SMTP-(8dde014c00007d85) >RCPT To:<MAXWLHK@NETVIGATOR.COM>
10:08 11:20 SMTPD(8ddf009b00007d86) [123.118.88.163] f:\IMail\spool\D8ddf009b00007d86.SMD 67826
10:08 11:20 SMTP-(8ddf009b00007d86) processing f:\IMail\spool\Q8ddf009b00007d86.SMD
10:08 11:20 SMTP-(8dde014c00007d85) 250 2.1.5 <MAXWLHK@NETVIGATOR.COM>... Recipient ok
10:08 11:20 SMTP-(8dde014c00007d85) >DATA
10:08 11:20 SMTPD(8de300a200007d8d) Authenticated marketing@blue-capital.com, session treated as local.
10:08 11:20 SMTP-(8dde014c00007d85) 354 Enter mail, end with "." on a line by itself
10:08 11:20 SMTPD(8de8014800007d94) [123.118.88.163] EHLO 192.168.1.100
10:08 11:20 SMTPD(8de500b000007d8f) [123.118.88.163] MAIL FROM:<noreply@163.com>
10:08 11:20 SMTPD(8de5014300007d90) [123.118.88.163] MAIL FROM:<noreply@163.com>
10:08 11:20 SMTP-(8dde014c00007d85) >.
10:08 11:20 SMTPD(8de300a200007d8d) [123.118.88.163] MAIL FROM:<noreply@163.com>
10:08 11:20 SMTPD(8de0017b00007d88) [123.118.88.163] f:\IMail\spool\D8de0017b00007d88.SMD 67831
10:08 11:20 SMTP-(8de0017b00007d88) processing f:\IMail\spool\Q8de0017b00007d88.SMD
10:08 11:20 SMTP-(8dde014c00007d85) 250 2.0.0 o983RZHG006354 Message accepted for delivery
10:08 11:20 SMTP-(8dde014c00007d85) rdeliver NETVIGATOR.COM MAXWLHK@NETVIGATOR.COM (1) <noreply@163.com> 67829
10:08 11:20 SMTP-(8dde014c00007d85) >QUIT
10:08 11:20 SMTP-(8dde014c00007d85) 221 2.0.0 imsmx06.netvigator.com closing connection
10:08 11:20 SMTP-(8dde014c00007d85) finished f:\IMail\spool\Q8dde014c00007d85.SMD status=1
10:08 11:20 SMTPD(8de5014300007d90) [123.118.88.163] RCPT TO:<MBI@SPS.NET.SA>
10:08 11:20 SMTPD(8de500b000007d8f) [123.118.88.163] RCPT TO:<MAXI_GONZALEZ@UOLSINECTIS.COM.AR>
10:08 11:20 SMTPD(8de0018f00007d89) [123.118.88.163] f:\IMail\spool\D8de0018f00007d89.SMD 67833
10:08 11:20 SMTP-(8de0018f00007d89) processing f:\IMail\spool\Q8de0018f00007d89.SMD
10:08 11:20 SMTPD(8de300a200007d8d) [123.118.88.163] RCPT TO:<MANOSCOSTAS@YAHOO.GR>
10:08 11:20 SMTPD(8de100a900007d8a) [123.118.88.163] f:\IMail\spool\D8de100a900007d8a.SMD 67831
10:08 11:20 SMTP-(8de100a900007d8a) processing f:\IMail\spool\Q8de100a900007d8a.SMD
10:08 11:20 SMTPD(8de9009500007d98) [219.235.2.130] connect 123.118.88.163 port 32569
10:08 11:20 SMTP-(8de100a900007d8a) Trying NETVIGATOR.COM (0)
10:08 11:20 SMTP-(8de100a900007d8a) Connect NETVIGATOR.COM [218.102.53.146:25] (1)
10:08 11:20 SMTP-(8de100a900007d8a) 220 imsmx06.netvigator.com ESMTP Sendmail 8.14.3/8.14.3; Fri, 8 Oct 2010 11:27:36 +0800
10:08 11:20 SMTP-(8de100a900007d8a) >EHLO gotonets-676d68
10:08 11:20 SMTP-(8de100a900007d8a) 250-imsmx06.netvigator.com Hello host-219-235-2-130.iphost.gotonets.com [219.235.2.130], pleased to meet you
10:08 11:20 SMTP-(8de100a900007d8a) 250-ENHANCEDSTATUSCODES
10:08 11:20 SMTP-(8de100a900007d8a) 250-PIPELINING
10:08 11:20 SMTP-(8de100a900007d8a) 250-8BITMIME
10:08 11:20 SMTP-(8de100a900007d8a) 250-SIZE 47185920
10:08 11:20 SMTP-(8de100a900007d8a) 250-DSN
10:08 11:20 SMTP-(8de100a900007d8a) 250-ETRN
10:08 11:20 SMTP-(8de100a900007d8a) 250-DELIVERBY
10:08 11:20 SMTP-(8de100a900007d8a) 250 HELP
10:08 11:20 SMTP-(8de100a900007d8a) >MAIL FROM:<noreply@163.com>
10:08 11:20 SMTP-(8de100a900007d8a) 250 2.1.0 <noreply@163.com>... Sender ok
10:08 11:20 SMTP-(8de100a900007d8a) >RCPT To:<MAYEELOK@NETVIGATOR.COM>
10:08 11:20 SMTP-(8de0017b00007d88) Trying ALAINCLUB.AE (0)
10:08 11:20 SMTP-(8de100a900007d8a) 250 2.1.5 <MAYEELOK@NETVIGATOR.COM>... Recipient ok
10:08 11:20 SMTP-(8de100a900007d8a) >DATA
10:08 11:20 SMTPD(8de8014800007d94) Authenticated marketing@blue-capital.com, session treated as local.
10:08 11:20 SMTPD(8de9009500007d98) [123.118.88.163] EHLO 192.168.1.100


日志的一部分，请问是哪个邮箱在群发垃圾文件呢？noreply@163.com这个怎么反复出现？如何禁止？

eiis

都不知道怎么查服务器上哪个邮局用户在滥发垃圾邮件，有详细的教程或者高人指点吗？

neil.fu

您的问题可以启用在线反垃圾网关解决，现在您的服务器被利用

lgj858

用imail的日志分析工具 筛选分析
然后再反查日志就可以查到是哪个帐号在被利用发送了