Spam Schleuder ?

D

Dennisda

Registered User
Hallo,

ich möchte lieber auf Nummer sicher gehen.
Innerhalb von 30 min läuft der mailq mit bis zu über 1500 Einträge voll.
Nu so sehe die Einträge aus:

547A3801C1* 9740 Tue Feb 13 12:25:15 MAILER-DAEMON
name@Domain

50574800DB* 619 Tue Feb 13 12:21:22 wwwrun@Hostname
[email protected]

595A5800E1* 3319 Tue Feb 13 12:21:59 wwwrun@Hostname
[email protected]
Click to expand...

So nu, der Apache läuft auch unter wwwrun. Da habe ich den ganze Großen verdacht das ein Kontakt Formular als Spam Schleuder dient.

Nu ich möchte lieber auf nummer sicher gehen da in den Logs nüx zufinden ist.
Wie sieht Ihr das ?
Kann ich den Fluß Serverseitig stoppen ?
Beim zweiteren bin ich mir nicht so ganz sicher -_-
 
Hallo Dennis!

1. Stoppe Deinen MTA damit darüber kein Spam mehr versendet wird
2. Entferne die Spams aus der Warteschlange
3. Analysiere das Apachelogfile um Deinen Verdacht zu bestätigen
4. Entferne das unsichere Mailformular oder sichere es entsprechend ab

Gruß flyingoffice
 
Hallo flyingoffice,

1) gestoppt. Jedoch steht dieses in der Mailq:

BD54D34802A 945 Tue Feb 13 12:47:55 wwwrun

2F15634802B 945 Tue Feb 13 12:52:52 wwwrun

AD55734802C 10649 Tue Feb 13 12:53:53 wwwrun

55A8034802D 945 Tue Feb 13 12:55:00 wwwrun

C3D9034802E 930 Tue Feb 13 12:58:04 wwwrun

4E32934802F 9583 Tue Feb 13 12:59:21 wwwrun

20FB2348030 9319 Tue Feb 13 13:03:46 wwwrun

A1974348031 10000 Tue Feb 13 13:05:35 wwwrun
Click to expand...
2) Entfernt. Hinzuzufügen möchte ich noch das es Definitive Spam ist:

Code: 
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
72264800CE*   11069 Tue Feb 13 12:39:11  wwwrun@Meinhost
(host mailin-03.mx.aol.com[64.12.137.89] said: 421-:  (RLY:CS4) http://postmaster.info.aol.com/errors/421rlycs4.html  421 SERVICE NOT AVAILABLE)
                                         [email protected]
(host smtp1.accnorwalk.com[64.186.192.25] said: 450 4.3.2 <[email protected]>: Recipient address rejected: Try again later)
                                         [email protected]
(host mailin-02.mx.aol.com[205.188.155.89] said: 421-:  (RLY:CS4) http://postmaster.info.aol.com/errors/421rlycs4.html  421 SERVICE NOT AVAILABLE)
                                         [email protected]
              (Name service error for mailrecv.bigmailbox.com: Host not found)
                                         [email protected]
           (connect to a34-mta04.direcpc.com[66.82.4.105]: Connection refused)
                                         [email protected]
     (connect to relay.cisp.com[208.252.179.200]: server refused mail service)
                                         [email protected]
                    (Name service error for my.com: Host not found, try again)
                                         [email protected]
  (connect to cluster8a.us.messagelabs.com[216.82.248.44]: Connection refused)
                                         [email protected]
                     (connect to punkmail.com[64.40.116.41]: No route to host)
                                         [email protected]
         (connect to tetrafish.shentel.net[204.111.1.229]: Connection refused)
                                         [email protected]
              (Name service error for brainerd.net: Host not found, try again)
                                         [email protected]
(host g.mx.mail.yahoo.com[209.191.88.239] said: 451 Message temporarily deferred - [170])
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
(host mail.texinet.net[208.32.99.23] said: 451 4.7.1 Greylisting in action, please come back in 00:05:00)
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]
                                         [email protected]

EB64D800D1     2837 Tue Feb 13 12:41:54  MAILER-DAEMON
           (Name service error for jennyspeirs.com: Host not found, try again)
                                         [email protected]

-- 23 Kbytes in 2 Requests.

3) Die Log files sind soweit sauber. Jedoch hier mal die Mail.log:

Code: 
Feb 13 12:41:54 p15134871 postfix/cleanup[4819]: EB64D800D1: message-id=<20070213114154.EB64D800D1@meinhost>
Feb 13 12:41:54 p15134871 postfix/qmgr[25330]: EB64D800D1: from=<>, size=2837, nrcpt=1 (queue active)
Feb 13 12:41:55 p15134871 postfix/smtp[3758]: connect to clmboh-01.mgw.rr.com[65.24.7.14]: server refused mail service (port 25)
Feb 13 12:41:55 p15134871 postfix/smtpd[4847]: disconnect from unknown[58.173.224.110]
Feb 13 12:41:56 p15134871 postfix/smtp[4965]: connect to hrndva-01.mgw.rr.com[24.28.204.20]: server refused mail service (port 25)
Feb 13 12:41:57 p15134871 postfix/smtp[5006]: EB64D800D1: to=<[email protected]>, relay=none, delay=3, status=deferred (Name service error for jennyspeirs.com: Host not found, try again)
Feb 13 12:42:00 p15134871 postfix/smtp[2976]: connect to orngca-01.mgw.rr.com[66.75.160.147]: server refused mail service (port 25)
Feb 13 12:42:00 p15134871 postfix/smtp[3786]: connect to orngca-01.mgw.rr.com[66.75.160.130]: read timeout (port 25)
Feb 13 12:42:01 p15134871 postfix/smtp[2772]: connect to hrndva-01.mgw.rr.com[24.28.204.21]: server refused mail service (port 25)
Feb 13 12:42:01 p15134871 postfix/smtp[2772]: 4776D800DE: to=<[email protected]>, relay=none, delay=3346, status=deferred (connect to hrndva-01.mgw.rr.com[24.28.204.21]: server refused mail service)
Feb 13 12:42:01 p15134871 postfix/qmgr[25330]: warning: qmgr_active_corrupt: save corrupt file queue active id 4776D800DE: No such file or directory
Feb 13 12:42:01 p15134871 postfix/smtp[3786]: connect to hrndva-01.mgw.rr.com[24.28.204.21]: server refused mail service (port 25)
Feb 13 12:42:03 p15134871 postfix/smtp[3786]: connect to clmboh-01.mgw.rr.com[65.24.7.10]: server refused mail service (port 25)
Feb 13 12:42:03 p15134871 postfix/smtp[3785]: connect to orngca-02.mgw.rr.com[66.75.160.142]: server refused mail service (port 25)
Feb 13 12:42:03 p15134871 postfix/smtp[2662]: connect to orngca-02.mgw.rr.com[66.75.160.141]: server refused mail service (port 25)
Feb 13 12:42:04 p15134871 postfix/smtp[2976]: connect to clmboh-01.mgw.rr.com[65.24.7.14]: server refused mail service (port 25)
Feb 13 12:42:06 p15134871 postfix/smtp[4965]: connect to clmboh-01.mgw.rr.com[65.24.7.19]: server refused mail service (port 25)
Feb 13 12:42:08 p15134871 postfix/smtp[2662]: connect to clmboh-01.mgw.rr.com[65.24.7.19]: server refused mail service (port 25)
Feb 13 12:42:09 p15134871 postfix/smtpd[3999]: connect from host240-179-dynamic.55-82-r.retail.telecomitalia.it[82.55.179.240]
Feb 13 12:42:09 p15134871 postfix/smtpd[3999]: 41775800CF: client=host240-179-dynamic.55-82-r.retail.telecomitalia.it[82.55.179.240]
Feb 13 12:42:09 p15134871 postfix/cleanup[4831]: 41775800CF: message-id=<01c74f63$fe8f9dd0$6c822ecf@bristle'stoweling>
Feb 13 12:42:09 p15134871 postfix/qmgr[25330]: 41775800CF: from=<bristle'[email protected]>, size=3502, nrcpt=1 (queue active)
Feb 13 12:42:09 p15134871 postfix/smtp[2662]: connect to orngca-01.mgw.rr.com[66.75.160.147]: server refused mail service (port 25)
Feb 13 12:42:09 p15134871 postfix/smtpd[3999]: disconnect from host240-179-dynamic.55-82-r.retail.telecomitalia.it[82.55.179.240]
Feb 13 12:42:09 p15134871 postfix/local[4981]: 41775800CF: to=<[email protected]>, relay=local, delay=0, status=sent (mailbox)
F

4) derzeit in Arbeit.
 
Das einzigste was ich in der Error.log finden konnte ist dieser Eintrag:

[Feb 13 11:22:03 2007] [error] [Client Hier die IP] Client sent Http/1.1 request without hostname ( see RFC2616 section 14.23): /w00tw00.at.ISC.SANS.DFind:)
Click to expand...

Sonst halt das übliche, das Bilder nicht gefunden wurden.
 
Hallo!

Du hast jetzt aber hoffentlich nicht nur das error.log durchsucht. Suche mal in den Logs nach "POST".

Gruß flyingoffice
 
You must log in or register to reply here.
Back
Top