Qmail隊列堆積了很多郵件，是不是我被做成轉發器了？

Qmail隊列堆積了很多郵件，是不是我被做成轉發器了？

# more 496188
Received: (qmail 18536 invoked for bounce); 24 Mar 2010 20:56:22 -0000
Date: 24 Mar 2010 20:56:22 -0000
From: MAILER-DAEMON@mail.mail.com
To: ccerrfc@bossmail.de
Subject: failure notice

Hi. This is the qmail-send program at mail.mail.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<atul2007@rediffmail.com>:
Connected to 119.252.147.10 but greeting failed.
Remote host said: 451 delivery from a.b.c.d is deferred,repeatedly. Send again or check at http://www.commtouch.co
m/Site/Resources/Check_IP_Reputation.asp
I'm not going to try again; this message has been in the queue too long.

<atul582002@yahoo.com>:
Connected to 67.195.168.31 but greeting failed.
Remote host said: 421 4.7.0 Messages from a.b.c.d temporarily deferred due to user complaints - 4.16.55.1;
see http://postmaster.yahoo.com/421-ts01.html
I'm not going to try again; this message has been in the queue too long.

<atul75@rediffmail.com>:
Connected to 119.252.147.10 but greeting failed.
Remote host said: 451 delivery from a.b.c.d is deferred,repeatedly. Send again or check at http://www.commtouch.co
m/Site/Resources/Check_IP_Reputation.asp
I'm not going to try again; this message has been in the queue too long.

<atulag_2k6@yahoo.com>:
Connected to 98.137.54.237 but greeting failed.
Remote host said: 421 4.7.0 Messages from a.b.c.d temporarily deferred due to user complaints - 4.16.55.1;
see http://postmaster.yahoo.com/421-ts01.html
I'm not going to try again; this message has been in the queue too long.

<atulahire007@yahoo.com>:
Connected to 74.6.136.65 but greeting failed.
Connected to 74.6.136.65 but greeting failed.
Remote host said: 421 4.7.0 Messages from a.b.c.d temporarily deferred due to user complaints - 4.16.55.1;
see http://postmaster.yahoo.com/421-ts01.html
I'm not going to try again; this message has been in the queue too long.

<atularoadec@yahoo.co.in>:
Connected to 202.86.5.24 but greeting failed.
Remote host said: 421 4.7.0 Messages from a.b.c.d temporarily deferred due to user complaints - 4.16.55.1;
see http://postmaster.yahoo.com/421-ts01.html
I'm not going to try again; this message has been in the queue too long.

<atulbatraz@hotmail.com>:
65.54.188.110 does not like recipient.
Remote host said: 550 Requested action not taken: mailbox unavailable
Giving up on 65.54.188.110.

<atulc2@yahoo.com>:
Connected to 206.190.54.127 but greeting failed.
Remote host said: 421 4.7.0 Messages from a.b.c.d temporarily deferred due to user complaints - 4.16.55.1;
see http://postmaster.yahoo.com/421-ts01.html
I'm not going to try again; this message has been in the queue too long.

<atulgoel@rediffmail.com>:
Connected to 119.252.147.10 but greeting failed.
Remote host said: 451 delivery from a.b.c.d is deferred,repeatedly. Send again or check at http://www.commtouch.co
m/Site/Resources/Check_IP_Reputation.asp
I'm not going to try again; this message has been in the queue too long.

<atulhatwar@indiatimes.com>:
220.226.197.241 does not like recipient.
Remote host said: 452 sorry no PTR record found for your MTA please contact emailfeedback@indiatimes.com
Giving up on 220.226.197.241.
I'm not going to try again; this message has been in the queue too long.

<atulhatwar@usa.net>:
165.212.8.32 does not like recipient.
Remote host said: 550 <atulhatwar@usa.net>... User not known
<atul2112@gmail.com>:
209.85.216.93 failed after I sent the message.
Remote host said: 421-4.7.0 Our system has detected an unusual amount of
421-4.7.0 unsolicited mail originating from your IP address. To protect our
421-4.7.0 users from spam, mail sent from your IP address has been temporarily
421-4.7.0 blocked. Please visit http://www.google.com/mail/help/bulk_mail.html
421 4.7.0 to review our Bulk Email Senders Guidelines. 24si16279979pxi.29
I'm not going to try again; this message has been in the queue too long.

<atulk11@yahoo.com>:
Connected to 66.94.236.34 but greeting failed.
Remote host said: 421 4.7.0 Messages from a.b.c.d temporarily deferred due to user complaints - 4.16.55.1;
see http://postmaster.yahoo.com/421-ts01.html
I'm not going to try again; this message has been in the queue too long.

<atul44885@gmail.com>:
209.85.216.93 failed after I sent the message.
Remote host said: 421-4.7.0 Our system has detected an unusual amount of
421-4.7.0 unsolicited mail originating from your IP address. To protect our
421-4.7.0 users from spam, mail sent from your IP address has been temporarily
421-4.7.0 blocked. Please visit http://www.google.com/mail/help/bulk_mail.html
421 4.7.0 to review our Bulk Email Senders Guidelines. 29si16278497pxi.14
I'm not going to try again; this message has been in the queue too long.

<atulkane@iinvestor.com>:
64.14.239.195 does not like recipient.
Remote host said: 550 5.7.1 relaying not allowed to <atulkane@iinvestor.com> in "RCPT TO:<atulkane@iinvestor.com>"
Giving up on 64.14.239.195.

<atulkbhandari@netscape.net>:
Connected to 64.12.90.66 but greeting failed.
Remote host said: 421 4.7.1 : (DNS:NR) http://postmaster.info.aol.com/errors/421dnsnr.html
I'm not going to try again; this message has been in the queue too long.
<atulsaxena.mrt@gmail.com>:
209.85.216.9 failed after I sent the message.
Remote host said: 421-4.7.0 Our system has detected an unusual amount of
421-4.7.0 unsolicited mail originating from your IP address. To protect our
421-4.7.0 users from spam, mail sent from your IP address has been temporarily
421-4.7.0 blocked. Please visit http://www.google.com/mail/help/bulk_mail.html
421 4.7.0 to review our Bulk Email Senders Guidelines. 26si12856397pxi.79
I'm not going to try again; this message has been in the queue too long.

--- Below this line is a copy of the message.

Return-Path: <ccerrfc@bossmail.de>
Received: (qmail 27147 invoked by uid 89); 24 Mar 2010 01:39:19 -0000
Received: from unknown (HELO User) (market@78.83.168.231)
  by 0 with SMTP; 24 Mar 2010 01:39:19 -0000
Reply-To: <garysmith001@live.com>
From: "DR. Irene Smith"<ccerrfc@bossmail.de>
Subject: Urgent.....
Date: Wed, 24 Mar 2010 02:23:59 +0100
MIME-Version: 1.0
Content-Type: text/html;
        charset="_iso-2022-jp$ESC"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1081
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081

Attn: Beneficiary,
We wish to inform you that the diplomatic agent conveying the consignment box valued the sum of $10 Million United State
s Dollars misplaced your address and he is currently stranded at your International airport now. We required you reconfi
rm the following informations below so that he can deliver your consignment box to you today.

NAME:=======
ADDRESS:========
MOBILE NO.:========
NAME OF YOUR NEAREST AIRPORT:========
A COPY OF YOUR IDENTIFICATION:=======
Please do contact the diplomatic agent with the email below with the informations required.

Contact Person Mr. GARY SMITH MAIL: (garysmith001@live.com) He is waiting to hear from you today with the informations.N
OTE: The Diplomatic agent does not know that the content of the consignment box is $10 Millions United States Dollars an
d on no circumstances should you let him know the content.

The consignments was moved from here as family treasures, so never allow him to open the box.

Thanks.
GARY SMITH

怎麼解決這個問題呢？

# qmailctl queue
messages in queue: 4
messages in queue but not yet preprocessed: 0
25 Mar 2010 05:48:17 GMT  #490044  18925  <>
        remote  tgu@onoio.com
25 Mar 2010 06:05:43 GMT  #490025  6946  <>
        remote  coverss@rapidtorc.com
25 Mar 2010 05:48:24 GMT  #490054  4687  <>
        remote  lavalsrd@ebooks-planet.com
25 Mar 2010 05:43:41 GMT  #490036  8275  <>
        remote  jerwvre@rietoo.com

清除隊列后，出現的新郵件。

內容

# more 489999
Received: (qmail 31952 invoked by uid 89); 25 Mar 2010 06:06:31 -0000
Received: from unknown (HELO tonlaget.com) (113.91.174.32)
  by 0 with SMTP; 25 Mar 2010 06:06:31 -0000
Received-SPF: none (0: domain at tonlaget.com does not designate permitted sender hosts)
Received: from ACA0BF403DB946D by themathpage.com
  with SMTP id 0C8EE902; Mon, 29 Mar 2010 13:51:09 +0800
From: =?GB2312?B?XLTeINChveNc?= <dsbumton@tonlaget.com>
Subject: =?GB2312?B?wey1vNPQ0Ke8pMD4z8LK9Ly4teO93b62bmdzd2pyaQ==?=
To: "wanganliang" <wanganliang@mail.com>
Content-Type: text/html;
        charset="gb2312"
Content-Transfer-Encoding: 8bit
Date: Mon, 29 Mar 2010 13:51:17 +0800
X-Mailer: Microsoft Outlook Express 6.00.2800.1158

<HTML><HEAD><TITLE>dsbumton@tonlaget.com 304415 13:51:14</TITLE>
<META http-equiv=Content-Type content="text/html; charset=gb2312">

檢查信頭from、to是否是你的客戶域名，如果都不是，那就被人中繼了（當然也有可能是偽造信），先關閉郵件中繼功能在進一步確定。

如何關閉中繼

有人知道嗎

:em02::em05: 沒人啊

需要實際在伺服器中查看一下隊列中的郵件相信，做定量分析

這垃圾郵件真是夠頭疼的！！

顯然是被別人破解了某個賬號的密碼用來發垃圾郵件了。檢查日誌就能發現是那個賬號。

Tags: