外发垃圾邮件

tomtang

近我的邮件服务器的IP地址经常被放进黑名单，我移除了又被放进去。我就发邮件到黑名单的网站询问，他给我的回信中说我向外发了垃圾邮件，并给了一个后缀是我的域名的地址和我正确的IP地址的邮箱说是这个邮箱向外发了垃圾邮件，但是问题是这个邮件地址的域名是我的但是我根本就没有这个用户名的邮箱，也就是说是其他垃圾邮件冒充或者利用了我的邮件服务器向外发垃圾邮件，我不知道这个问题要怎么样解决，你在网站上有介绍说“启用SMTP发信认证功能”，但是我的系统现在是已经启用了的，我不知道怎么还是发生了这样的事情。

备注我垃圾邮件系统的信件：

>This IP is listed because it has been sending spam to our traps.  It
appears a computer that sends/smarthosts through that IP is infected
with a mass-mailer trojan/malware/spyware.  Computers behind that IP
should be checked with a spyware removal tool such as Spybot Search and
Destroy, Adaware by Lavasoft and Hijackthis.

Please see: http://www.spamcop.net/fom-serve/cache/405.html

Once the spam stops, the IP will delist.


Received: from mail.qstmills.com (HELO qstmills.com) ([202.168.232.41])
by ; 02 Mar 2007 15:14:19 -0800
Message-ID: <91b8______________________017b@fruehlieeix>
From: "Rhona" <fruehlieeix@qstmills.com>（我们没有这个用户名）
To: "Brigid Patterson"
Cc: "Emeline" ,
       "Juliette Spencer" ,
       "Charley" ,
       "Thersa" ,
       "Sana Green" ,
       "Lorina Ford" ,
       "Rusty Kennedy"
Subject: Can This Be
Date: Sat, 03 Mar 2007 04:05:10 +0500
MIME-Version: 1.0
Content-Type: multipart/related;
       type="multipart/alternative";
       boundary="----=_NextPart_BB8_F2D3_53A2BC6A.9E6A72AF"
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.2627
X-MimeOLE: Produced By Microsoft MimeOLE V10.0.2627



Richard

Please include previous correspondence with replies

Tom wrote:
> This is Tom form IP address (202.168.232.41).Our IP is a email-address,no
> have any virus and spam,i don't know why always blocked it ,when I removed
> it ,sometime inside again.
>            Pls help me remove it from your black list
>
>
> Provide any additional details you feel are pertinent above.
> --
> This email generated from SpamCop email link
> Referer: http://www.spamcop.net/w3m?action=blcheck&ip=202.168.232.41
>
> Details:
> http://www.spamcop.net/admin?action=runquery;query=ipstats;param=202.168.232.41

rayer

一个是开身份认证,一个是要开防病毒功能

钉子

对。要检查是否允许中继和是否有病毒存在两方面。

bigfather

我的邮箱也有如此记录，请问如何解决：
照理来说这个时间段是没人发信的

Mon, 5 Mar 2007 00:05:14        Smtp登录. IP: 213.175.45.5 , Port 27570
Mon, 5 Mar 2007 00:05:49        HELO/EHLO 主机名通过验证: CZPHASITSMTP01.ITGROUP.CZ
Mon, 5 Mar 2007 00:06:06        [213.175.45.5] 关闭Smtp连接.
Mon, 5 Mar 2007 00:06:19        [213.175.45.5] 关闭连接.
Mon, 5 Mar 2007 00:54:17        Smtp登录. IP: 206.46.252.159 , Port 36030
Mon, 5 Mar 2007 00:54:19        [206.46.252.159] 关闭Smtp连接.
Mon, 5 Mar 2007 00:54:32        [206.46.252.159] 关闭连接.
Mon, 5 Mar 2007 01:02:38        Smtp登录. IP: 64.169.151.136 , Port 4926
Mon, 5 Mar 2007 01:02:39        [64.169.151.136] 关闭Smtp连接.
Mon, 5 Mar 2007 01:02:52        [64.169.151.136] 关闭连接.
Mon, 5 Mar 2007 01:04:34        Smtp登录. IP: 219.235.2.59 , Port 3193
Mon, 5 Mar 2007 01:04:34        Smtp登录. IP: 219.235.2.59 , Port 3866
Mon, 5 Mar 2007 01:04:47        [219.235.2.59] 关闭连接.
Mon, 5 Mar 2007 01:04:47        [219.235.2.59] 关闭连接.
Mon, 5 Mar 2007 02:19:01        Smtp登录. IP: 87.233.130.19 , Port 37428
Mon, 5 Mar 2007 02:19:05        [87.233.130.19] 关闭Smtp连接.
Mon, 5 Mar 2007 02:19:10        Smtp登录. IP: 202.75.223.136 , Port 3018
Mon, 5 Mar 2007 02:19:10        [202.75.223.136] 关闭Smtp连接.
Mon, 5 Mar 2007 02:19:18        [87.233.130.19] 关闭连接.
Mon, 5 Mar 2007 02:19:18        [202.75.223.136] 关闭连接.
Mon, 5 Mar 2007 02:24:31        Smtp登录. IP: 12.47.209.188 , Port 3066
Mon, 5 Mar 2007 02:24:40        [12.47.209.188] 关闭Smtp连接.
Mon, 5 Mar 2007 02:24:52        [12.47.209.188] 关闭连接.
Mon, 5 Mar 2007 02:39:12        Smtp登录. IP: 62.249.212.163 , Port 40254
Mon, 5 Mar 2007 02:39:14        [62.249.212.163] 关闭Smtp连接.
Mon, 5 Mar 2007 02:39:26        [62.249.212.163] 关闭连接.
Mon, 5 Mar 2007 02:41:25        Smtp登录. IP: 202.248.38.241 , Port 48729
Mon, 5 Mar 2007 02:41:44        [202.248.38.241] 关闭Smtp连接.
Mon, 5 Mar 2007 02:41:57        [202.248.38.241] 关闭连接.
Mon, 5 Mar 2007 03:04:04        Smtp登录. IP: 204.163.136.26 , Port 39072
Mon, 5 Mar 2007 03:04:09        Smtp登录. IP: 66.87.70.141 , Port 16967
Mon, 5 Mar 2007 03:04:10        [66.87.70.141] 关闭Smtp连接.
Mon, 5 Mar 2007 03:04:11        [204.163.136.26] 关闭Smtp连接.
Mon, 5 Mar 2007 03:04:24        [204.163.136.26] 关闭连接.
Mon, 5 Mar 2007 03:04:24        [66.87.70.141] 关闭连接.
Mon, 5 Mar 2007 03:06:23        Smtp登录. IP: 142.179.95.184 , Port 62605
Mon, 5 Mar 2007 03:06:27        [142.179.95.184] 关闭Smtp连接.
Mon, 5 Mar 2007 03:06:40        [142.179.95.184] 关闭连接.
Mon, 5 Mar 2007 03:27:15        Smtp登录. IP: 162.84.104.186 , Port 29570
Mon, 5 Mar 2007 03:27:19        [162.84.104.186] 关闭Smtp连接.
Mon, 5 Mar 2007 03:27:31        [162.84.104.186] 关闭连接.
Mon, 5 Mar 2007 03:28:11        Smtp登录. IP: 222.214.216.209 , Port 4002
Mon, 5 Mar 2007 03:29:27        [222.214.216.209] 关闭连接.
Mon, 5 Mar 2007 03:50:20        Smtp登录. IP: 201.71.128.3 , Port 48360
Mon, 5 Mar 2007 03:50:23        HELO/EHLO 主机名通过验证: SRV03-VSP.VSP.COM.BR
Mon, 5 Mar 2007 03:50:24        [201.71.128.3] 关闭Smtp连接.
Mon, 5 Mar 2007 03:50:36        [201.71.128.3] 关闭连接.

rayer

那是一些SMTP连接,是向你们系统内发信的

bigfather

OK 谢谢

tomtang

楼上的兄弟有说到“一个是开身份认证,一个是要开防病毒功能”，这两个我都有，而且也检查了，没有病毒。
但是“是否允许中继”是什么意思？是允许了中继也会出现这个问题吗？我是设置了一个中继服务器。

望兄弟们指教，这几天头发都急白了。

rayer

开防毒功能是说邮件系统的防毒功能,不是在服务器上装个防毒软件就能管用的

tomtang

"开防毒功能是说邮件系统的防毒功能",这个我知道，我安装的Macfee8.0的，而且完全按照官方网站的设置的。

tomtang

今天我在网上找到了一篇"避免上垃圾邮件“黑名单”“的文章（http://searchnetworking.techtarget.com.cn/tips/418/2164918.shtml）。在文中提到：”远离黑名单的关键是确保你的电子邮件系统没有打开一种开放转发(Open relay)功能“，并且给出了一个测试有没有开放转发功能的地方，但是给出的地方需要注册什么的很麻烦，我又搜到一个通过连接不需要注册的地方测试：http://www.ccert.edu.cn/spam/tools/tools.htm   ，我测试了我的IP，结果如下：


Mail relay testing Connecting to 202.168.232.41 for anonymous test ...
<<< 220 ESMTP on WinWebMail [3.7.1.2] ready.  http://www.winwebmail.net
>>> HELO www.abuse.net
<<< 250 HELO
Relay test 1>>> RSET
<<< 220 OK
>>> MAIL FROM:<spamtest@abuse.net>
<<< 250 OK
>>> RCPT TO:<securitytest@abuse.net>
<<< 550 Local user only or Authentication mechanism

Relay test 2>>> RSET
<<< 220 OK
>>> MAIL FROM:<spamtest>
<<< 501 input error.

Relay test 3>>> RSET
<<< 220 OK
>>> MAIL FROM:<>
<<< 250 OK
>>> RCPT TO:<securitytest@abuse.net>
<<< 550 Local user only or Authentication mechanism

Relay test 4>>> RSET
<<< 220 OK
>>> MAIL FROM:<spamtest@[202.168.232.41]>
<<< 250 OK
>>> RCPT TO:<securitytest@abuse.net>
<<< 550 Local user only or Authentication mechanism

Relay test 5>>> RSET
<<< 220 OK
>>> MAIL FROM:<spamtest@qstmills.com>
<<< 250 OK
>>> RCPT TO:<securitytest@abuse.net>
<<< 550 Local user only or Authentication mechanism

Relay test 6>>> RSET
<<< 220 OK
>>> MAIL FROM:<spamtest@[202.168.232.41]>
<<< 250 OK
>>> RCPT TO:<securitytest%abuse.net@[202.168.232.41]>
<<< 550 Local user only or Authentication mechanism

Relay test 7>>> RSET
<<< 220 OK
>>> MAIL FROM:<spamtest@[202.168.232.41]>
<<< 250 OK
>>> RCPT TO:<securitytest%abuse.net@qstmills.com>
<<< 250 OK, recipient accepted

Relay test resultHmmn, at first glance, host appeared to accept a message for relay.
THIS MAY OR MAY NOT MEAN THAT IT'S AN OPEN RELAY. Some systems appear to accept relay mail, but then reject messages internally rather than delivering them, but you cannot tell at this point whether the message will be relayed or not. You cannot tell if it is really an open relay without sending a test message; this anonymous user test DID NOT send a test message.



这个测试结果说我的邮件服务器不安全，完全可以模仿我的邮件地址外发邮件。我想我的问题应该就出在这open relay上。

    但是我在winwebmail的设置我没有找到相应的关闭relay的地方，但是我找到了Exchange Server 5.5 、Netscape Messaging 、Sendmail 的关闭方法。
    那位兄弟能解决这个问题，好像winwebmail的官方网站也没有说这个问题，是不是winwebmail的一个bug？

[ 本帖最后由 tomtang 于 2007-3-6 19:17 编辑 ]