我有一个Windows 2008 R2服务器。 我正在使用mailenable proffessional版本7.59。
我注意到在MTA日志上随机（不存在）的邮件帐户正在发送垃圾邮件。 电子邮件来自一个NULL邮局，但域扩展名是正确的。
例如。 域abc.com被configuration为mailenable作为邮局。 它只有[email protected]用户。 但是，在日志中，我看到使用smtp-out（2）发送邮件的[email protected]，
我试图追查这些电子邮件，看看他们是如何起源，但我没有成功。 由于它是smtp-out（2），我假设它们正在通过服务器上的脚本发送出去。 但我可能是错的。
我loggingphpmail，我扫描服务器的隐形程序，我试着mailenable消息跟踪。 但是我不能find任何东西。
有没有人有类似的经历？ 任何人都可以提出一个方法来抓住这个？
以下是我从/m.usgoabuse.net/获得的报告，显然这封电子邮件已经给垃圾邮件发送者了。 任何人都可以告诉这个电子邮件如何产生？
Received: from [209.143.155.230] by usgo.net (USGO MTA v5/:PGRlaWRyZS5yaXR0ZXJAcG93ZXJmaW5hbmNldGV4YXMuY29tPjxqa2lzY2hAbW5pbnRlci5uZXQ_) with SMTP id <20141125073414002607200015> for <[email protected]>; Tue, 25 Nov 2014 07:34:14 -0600 (CST) (envelope-from [email protected], notifiable emailhost server.powerfinancetexas.com) Received: from localhost (localhost [127.0.0.1]) by server.powerfinancetexas.com (Postfix) with ESMTP id A556B39852EE for <[email protected]>; Tue, 25 Nov 2014 07:15:44 -0600 (CST) X-Virus-Scanned: amavisd-new at powerfinancetexas.com Received: from server.powerfinancetexas.com ([127.0.0.1]) by localhost (server.powerfinancetexas.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g8EjglQmmqU3 for <[email protected]>; Tue, 25 Nov 2014 07:15:44 -0600 (CST) Received: from domaininmyserver.com (ns2.myserver.net [MYSERVERIP]) by server.powerfinancetexas.com (Postfix) with ESMTPSA id 2055639852D5 for <[email protected]>; Tue, 25 Nov 2014 07:15:44 -0600 (CST) Date: Tue, 25 Nov 2014 16:15:32 +0300 To: [email protected] From: WhatsApp Messaging Service <[email protected]> Reply-To: WhatsApp Messaging Service <[email protected]> Subject: 1 New Voicemail(s) Message-ID: <[email protected]> X-Priority: 3 X-Mailer: PHPMailer 5.2.6 (https://github.com/PHPMailer/PHPMailer/) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b1_92448898bcaeb02b41ce6d783c32762d" Content-Transfer-Encoding: 7bit --b1_92448898bcaeb02b41ce6d783c32762d Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable WhatsApp You have a new voicemail! Details: Time of Call: Nov-24 2014 06:19:22 Lenth of Call: 50sec Play *If you cannot play, move message to the "Inbox" folder. 2014 WhatsApp Inc --b1_92448898bcaeb02b41ce6d783c32762d Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable <!doctype html> <html> <body style=3D"font-family:Arial, Tahoma, sans-serif;"> <div style=3D"width:500px; height:274px;"> <div style=3D"margin:0px; padding:0px; height:85px; background:#27262b; line-height:75px; font-size:26px; color:#FFFFFF; padding-left:82px; font-= weight:bold;"> WhatsApp </div> <div style=3D"position:ralative;top:100px;background:#34af23; height:8px;= width:500px;"></div> <div align=3D"center" style=3D"font-size:18px;color:#5b5f62"> <br> <br> You have a new voicemail! </div> <div style=3D"padding:20px;"> <font color=3D"#40a9d8"><b>Details:</b></font> <div style=3D"padding:10px;"> <font color=3D"#00000">Time of Call:</font> Nov-24 2014 06:19:22<br> <font color=3D"#00000">Lenth of Call:</font> 50sec<br> <br> </div> </div> <div style=3D"margin:0px; padding:0px; height:180px;" align=3D"center"> <a href=3D"http://phamhongson.net/config.php?w=3DgV82A2+BchVQpCFkL3Jve9P3= 0KzpgPVhGeVFNBdjU9A=3D"=20 style=3D"display:block; width:167px; height:41px; line-height:41px;=20 font-size:26px; color:#ffffff; text-align:center; font-weight:bold; border-radius:20px; -moz-border-radius:20px; -webkit-border-radius:20px; background:#67c332; text-decoration:none;">Play</a> <div style=3D"height:67px; margin:0px; padding:10px;font-size:12px"> <font color=3D"#5b5f62"> *If you cannot play, move message to the "Inbox" folder. </font> </div> <p style=3D"height:30px;margin:0px;padding:10px;color:#FFFFFF; background:#393e43;font-size:12px"> 2014 WhatsApp Inc </p> </div> </div> </body> </html> --b1_92448898bcaeb02b41ce6d783c32762d-- 实际上这可能是不实际的，但是这是一个可行的策略：
启用进程跟踪审计来跟踪启动/停止到安全事件日志的进程。
安装Microsoftnetworking监视器并使用目标TCP端口25的筛选器捕获stream量。
查看捕获并与您的日志关联以查明exception的电子邮件stream量。
networking监视器将捕获发送stream量的程序的进程ID。 您可以使用安全事件日志确定发送违规stream量的stream程是如何开始的。