邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: IMail 被用于发垃圾邮件的问题 [打印本页]

作者: Netcat 时间: 2008-4-24 16:59
标题: IMail 被用于发垃圾邮件的问题
打开IMail的日志文件，里面所看到的From和To信息都不是我服务器中的，但服务器已经设置了SMTP需要身份认证，请教如何能找出别人是如何通过我服务器发送的？或者如何去阻止这种情况？
IMail是使用的8.22

这是看到垃圾邮件的邮件头信息：
Received: from ladatco.com [127.0.0.1] by itrustsoft.com
  (SMTPD-8.22) id A922123C; Thu, 24 Apr 2008 02:00:02 +0800
Received: from unknown (27.65.242.47)
      by smtp.doneohx.com with ESMTP; Wed, 23 Apr 2008 15:56:26 -0300
Received: from mx03.listsystemsf.net ([Wed, 23 Apr 2008 15:42:52 -0300])
      by public.micromail.com.au with SMTP; Wed, 23 Apr 2008 15:42:52 -0300
Received: from mxs.perenter.com [93.88.136.44] by smtp.doneohx.com with ASMTP; Wed, 23 Apr 2008 15:42:35 -0300
Received: from rly04.hottestmile.com ([Wed, 23 Apr 2008 15:27:22 -0300])
      by webmail.halftomorrow.com with SMTP; Wed, 23 Apr 2008 15:27:22 -0300
Message-ID: <534e01c8a554$14855f20$5b4afc20@eisikit>
From: "Jose" <eisikit@ladatco.com>
To: "Abdul" <info@smartwish.co.uk>
Subject: I'm glad you asked me that question.
Date: Wed, 23 Apr 2008 15:09:52 -0300

下面是对应的IMail SMTP日志：
04:24 02:00 SMTPD(7921018400009a11) [127.0.0.1] MAIL FROM: <eisikit@ladatco.com>
04:24 02:00 SMTP-(628d00000a1017c7) Connect bigpond.com [61.9.168.122:25] (1)
04:24 02:00 SMTP-(628d00000a101622) Connect bluewin.ch [195.186.19.144:25] (1)
04:24 02:00 SMTP-(790900ad00009a0a) Stack connect fail "83.138.128.248"
04:24 02:00 SMTP-(790900ad00009a0a) Info - Adding elogos.co.uk to temporary skip list
04:24 02:00 SMTP-(790900ad00009a0a) Info - Skip list full, removing last entry
04:24 02:00 SMTP-(790900ad00009a0a) requeuing E:\Program\IPSwitch\IMail\spool\Q790900ad00009a0a.SMD R0 T1
04:24 02:00 SMTP-(790900ad00009a0a) finished E:\Program\IPSwitch\IMail\spool\Q790900ad00009a0a.SMD status=3
04:24 02:00 SMTPD(7921018400009a11) [127.0.0.1] RCPT TO: <info@smartwish.co.uk>
04:24 02:00 SMTPD(7921018400009a11) [x] looking up smartwish.co.uk in HOSTS
04:24 02:00 SMTPD(7921018400009a11) [127.0.0.1] DATA
04:24 02:00 SMTP-(628d00000a1017c7) 220 nskntingx06p.mx.bigpond.com ESMTP server ready Wed, 23 Apr 2008 17:59:57 +0000
04:24 02:00 SMTP-(628d00000a1017c7) >EHLO itrustsoft.com
04:24 02:00 SMTP-(628d00000a101622) 451 Connection not accepted from blacklisted IP address [61.129.35.232]
04:24 02:00 SMTP-(628d00000a101622) SMTP_DELIV_FAILED
04:24 02:00 SMTP-(628d00000a101622) >QUIT

[ 本帖最后由 Netcat 于 2008-4-24 17:00 编辑 ]

作者: dennishan 时间: 2008-4-24 18:53
127.0.0.1,透过Webmail发送的

作者: Netcat 时间: 2008-4-28 07:42
一是服务器并没有ladatco.com这个域，二是对方是大量群发，显然通过Webmail群发是不太可能的。

作者: 钉子 时间: 2008-4-29 01:16
你的服务器SMTP的中继设定情况是怎么样的。建议装一个ORF来查一下发送的LOG。

作者: lgj858 时间: 2008-4-30 23:34
查看一下smtp的安全设置

作者: Netcat 时间: 2008-5-1 01:30