Назад | Перейти на главную страницу

как заблокировать почтовый спамер на сетевом уровне?

Вот захват пакета того, как злоумышленник подходит к моему серверу и генерирует огромное количество спама, я не могу заблокировать его никакими средствами.

 220 mta1497.mail.ne1.yahoo.com ESMTP YSmtpProxy service ready
EHLO amsonere.co.uk
250-mta1497.mail.ne1.yahoo.com
250-8BITMIME
250-SIZE 41943040
250 PIPELINING
MAIL FROM:<craigwright@straygoat.com>
250 sender <craigwright@straygoat.com> ok
RCPT TO:<ddogg_730@yahoo.com>
250 recipient <ddogg_730@yahoo.com> ok
DATA
354 go ahead
Received: (qmail 3346 invoked from network); 7 May 2013 16:31:47 +0100
Received: from dsl-189-139-37-42-dyn.prod-infinitum.com.mx (HELO vdatbgpawos) (189.139.37.42)
  by amsonere.co.uk with SMTP; 7 May 2013 16:31:46 +0100
From: "fegody zaneze" <craigwright@straygoat.com>
To: <ddogg_730@yahoo.com>, <ol.e.et.h.omas.rn.sp@gmail.com>, <foettle@hotmail.com>, <srandolph24@netscape.net>, <jerry.m.rodriguez@gmail.com>
Date: Tue, 7 May 2013 17:27:50 -0700
Subject: SHOWE RINGt itsjo b
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-2

nop, qi
ruqifaz p http://metal-surface.fr/Knee-highs.html
  .
250 ok dirdel
QUIT
221 mta1497.mail.ne1.yahoo.com

Что это за атака? он исходит с сотен IP-адресов. я не могу заблокировать тысячи IP-адресов. Я использую Qmail в Plesk

Вот логи в / usr / loca / psa / var / log / maillog

   May  8 20:19:31 argon qmail-queue-handlers[28923]: Handlers Filter before-queue for qmail started ...
May  8 20:19:31 argon qmail-queue-handlers[28924]: Handlers Filter before-queue for qmail started ...
May  8 20:19:32 argon qmail-queue-handlers[28924]: from=faw@straygoat.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=fl4pperj4ck@live.co.uk
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=charliemunoz@sbcglobal.net
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=juanjaviervb@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=tdcharris88@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=simoncsmyth@googlemail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=venanciog7@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=bedo_101_1@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: hook_dir = '/var/qmail//handlers/before-queue'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[3] = 'fl4pperj4ck@live.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/fl4pperj4ck@live.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[4] = 'charliemunoz@sbcglobal.net'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/charliemunoz@sbcglobal.net'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[5] = 'juanjaviervb@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/juanjaviervb@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[6] = 'tdcharris88@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/tdcharris88@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[7] = 'simoncsmyth@googlemail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/simoncsmyth@googlemail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[8] = 'venanciog7@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/venanciog7@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[9] = 'bedo_101_1@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/bedo_101_1@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: from=muju@straygoat.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=duligongcaonimei@sina.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=cclousingcci@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=bin1800dc@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=peggygonzalez964@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=buddiezno@aol.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=mick@sharnock.fsworld.co.uk
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=nmaurice.white871@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=saf509@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=veronica_lopez10@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: hook_dir = '/var/qmail//handlers/before-queue'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[3] = 'duligongcaonimei@sina.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/duligongcaonimei@sina.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[4] = 'cclousingcci@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/cclousingcci@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[5] = 'bin1800dc@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/bin1800dc@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[6] = 'peggygonzalez964@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/peggygonzalez964@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[7] = 'buddiezno@aol.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/buddiezno@aol.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[8] = 'mick@sharnock.fsworld.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/mick@sharnock.fsworld.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[9] = 'nmaurice.white871@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/nmaurice.white871@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[10] = 'saf509@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/saf509@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[11] = 'veronica_lopez10@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/veronica_lopez10@yahoo.com'

Как я вижу, это не злоумышленник, приходящий на ваш сервер, это ваш сервер, отправляющий почту на Yahoo.
Либо вы открываете ретранслятор, либо они используют слабый пароль и вводят почту с аутентификацией SMTP.