这里是攻击者如何来到我的服务器和生成大量的垃圾邮件的数据包捕获，我无法以任何方式阻止它。
220 mta1497.mail.ne1.yahoo.com ESMTP YSmtpProxy service ready EHLO amsonere.co.uk 250-mta1497.mail.ne1.yahoo.com 250-8BITMIME 250-SIZE 41943040 250 PIPELINING MAIL FROM:<[email protected]> 250 sender <[email protected]> ok RCPT TO:<[email protected]> 250 recipient <[email protected]> ok DATA 354 go ahead Received: (qmail 3346 invoked from network); 7 May 2013 16:31:47 +0100 Received: from dsl-189-139-37-42-dyn.prod-infinitum.com.mx (HELO vdatbgpawos) (189.139.37.42) by amsonere.co.uk with SMTP; 7 May 2013 16:31:46 +0100 From: "fegody zaneze" <[email protected]> To: <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]>, <[email protected]> Date: Tue, 7 May 2013 17:27:50 -0700 Subject: SHOWE RINGt itsjo b Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-2 nop, qi ruqifaz p http://metal-surface.fr/Knee-highs.html . 250 ok dirdel QUIT 221 mta1497.mail.ne1.yahoo.com 这是什么types的攻击？ 它来自数百个IP地址。 我无法阻止数千个IP地址。 我在Plesk上使用Qmail
这里是/ usr / loca / psa / var / log / maillog中的日志
May 8 20:19:31 argon qmail-queue-handlers[28923]: Handlers Filter before-queue for qmail started ... May 8 20:19:31 argon qmail-queue-handlers[28924]: Handlers Filter before-queue for qmail started ... May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28924]: hook_dir = '/var/qmail//handlers/before-queue' May 8 20:19:32 argon qmail-queue-handlers[28924]: recipient[3] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: recipient[4] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: recipient[5] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: recipient[6] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: recipient[7] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: recipient[8] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: recipient[9] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: [email protected] May 8 20:19:32 argon qmail-queue-handlers[28923]: hook_dir = '/var/qmail//handlers/before-queue' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[3] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[4] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[5] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[6] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[7] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[8] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[9] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[10] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: recipient[11] = '[email protected]' May 8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/[email protected]'
正如我所看到的不是攻击者来到您的服务器，其服务器发送邮件到雅虎。
您要么是开放中继，要么是利用弱密码，并使用SMTP身份validation注入邮件。