+- ispCP - Board - Support (http://www.isp-control.net/forum)
+-- Forum: ispCP Omega International Area (/forum-22.html)
+--- Forum: Spanish Corner (/forum-29.html)
+--- Thread: [Resuelto] Problema SPAM y Undelivered Mail Returned to Sender (/thread-15996.html)
Pages: 1 2
[Resuelto] Problema SPAM y Undelivered Mail Returned to Sender - Piradoxlanieve - 04-22-2012 02:09 AM
Hola pues el problema esta en que al parecer estoy enviando spam y no existen las direcciones
me llegan correos a la cuenta personal la que si existe con el asunto.
Undelivered Mail Returned to Sender
He probado probado con iptables a bloquear el trafico a la ip remota 203.188
tambien he mirado que no exista, ningun virus en la maquina (cliente y servidor, cgi raros, php en las webs)alguna idea?
PHP Code:
Apr 21 18:02:04 ks313332 postfix/qmgr[4822]: 687661AC5FE: to=<tommyqueen1700@yahoo.com.tw>, relay=none, delay=230062, delays=230061/0.04/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:04 ks313332 postfix/qmgr[4822]: 687661AC5FE: to=<u_n24@yahoo.com.tw>, relay=none, delay=230062, delays=230061/0.05/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:04 ks313332 postfix/qmgr[4822]: 687661AE26F: from=<planif@jcard5.com>, size=353, nrcpt=5 (queue active)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 687661AE26F: to=<kram22131424@yahoo.com.tw>, relay=none, delay=218648, delays=218648/0.06/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 687661AE26F: to=<lifeboat24@yahoo.com.tw>, relay=none, delay=218648, delays=218648/0.07/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 687661AE26F: to=<linmintsung59@yahoo.com.tw>, relay=none, delay=218648, delays=218648/0.08/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 687661AE26F: to=<love5399@yahoo.com.tw>, relay=none, delay=218648, delays=218648/0.08/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 687661AE26F: to=<lovenara99@yahoo.com.tw>, relay=none, delay=218648, delays=218648/0.09/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 681B71A643B: from=<planif@jcard5.com>, size=2525, nrcpt=5 (queue active)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 681B71A643B: to=<cherry357@yahoo.com.tw>, relay=none, delay=256049, delays=256049/0.01/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 681B71A643B: to=<chienshwe@yahoo.com.tw>, relay=none, delay=256049, delays=256049/0.01/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 681B71A643B: to=<chihchia@yahoo.com.tw>, relay=none, delay=256049, delays=256049/0.02/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 681B71A643B: to=<cnn44@yahoo.com.tw>, relay=none, delay=256049, delays=256049/0.02/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 681B71A643B: to=<cool.spp.love@yahoo.com.tw>, relay=none, delay=256049, delays=256049/0.03/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 61DFA1AA8F2: from=<planif@jcard5.com>, size=2510, nrcpt=4 (queue active)
Apr 21 18:02:05 ks313332 postfix/qmgr[4822]: 61DFA1AA8F2: to=<a007874@yahoo.com.tw>, relay=none, delay=251470, delays=251470/0.04/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
Grcias.
RE: Problema SPAM y Undelivered Mail Returned to Sender - kurgans - 04-22-2012 09:18 PM
No tienes nada mas que buscar en el log un id de mensaje ver que usuario hace el login y sabras quien de todos tiene posiblemente un troyano en pc local o que formulario web esta siendo usado.
RE: Problema SPAM y Undelivered Mail Returned to Sender - Piradoxlanieve - 04-22-2012 10:21 PM
en el log del mail.info?estoy mirando si hay alguna id pero no la veo en ese log
(04-22-2012 09:18 PM)kurgans Wrote: No tienes nada mas que buscar en el log un id de mensaje ver que usuario hace el login y sabras quien de todos tiene posiblemente un troyano en pc local o que formulario web esta siendo usado.
RE: Problema SPAM y Undelivered Mail Returned to Sender - kurgans - 04-23-2012 05:40 PM
Todos los correos tienen un id y esta en el log
Id -> Envio postfix/qmgr[32661]: 0A5003203159: from
Id - > Recipiente 0A5003203159: to=
RE: Problema SPAM y Undelivered Mail Returned to Sender - kurgans - 04-23-2012 08:19 PM
Este es tu id receptor 687661AC5FE: to=<tommyqueen1700@yahoo.com.tw>
Lo mismo que tienes ese id receptor, buscalo en el log desde el comienzo del log y llegaras a la linea
687661AC5FE: from=<usuario@quesea.com>
Y tendras al culpable
RE: Problema SPAM y Undelivered Mail Returned to Sender - Piradoxlanieve - 04-23-2012 09:47 PM
PHP Code:
Apr 23 08:00:55 ks313332 postfix/qmgr[470]: 8235A1AD1BF: from=<planif@jcard5.com>, size=2338, nrcpt=6 (queue active)
Apr 23 08:00:55 ks313332 postfix/qmgr[470]: 8235A1AD1BF: to=<3z1k@yahoo.com.tw>, relay=none, delay=361783, delays=361783/0.01/0/0, dsn=4.7.0, status=deferred (delivery temporarily suspended: host mx1.mail.tw.yahoo.com[203.188.197.119] refused to talk to me: 421 4.7.0 [TS01] Messages from 188.165.227.196 temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html)
(04-23-2012 08:19 PM)kurgans Wrote: Este es tu id receptor 687661AC5FE: to=<tommyqueen1700@yahoo.com.tw>
[/php]
Creo que te refieres a esto, el usuario ya esta localizado y el pc donde esta esa cuenta esta formateado, para mi que es algo de la web algun formulario que usa ese correo.
Lo mismo que tienes ese id receptor, buscalo en el log desde el comienzo del log y llegaras a la linea
687661AC5FE: from=<usuario@quesea.com>
Y tendras al culpable
RE: Problema SPAM y Undelivered Mail Returned to Sender - kurgans - 04-23-2012 11:25 PM
Pos ya sabes lo que hay, cuenta cortada, limpieza de la maquina donde esa cuenta y no te fies mucho de que cuando te digan que han limpiado lo hayan echo
un par de veces al dia mirar las colas y el meneo de envio de correo para verificarlo.
No creo que sea un formulario es mas si miras mas detenidamente el log seguramente encontraras el login
<id del corre>: client=unknown[ip del emisor], sasl_method=LOGIN, sasl_username=usuario@decorreo.tld
RE: Problema SPAM y Undelivered Mail Returned to Sender - Piradoxlanieve - 04-25-2012 06:57 PM
Lo unico que veo es:
Apr 25 10:52:21 ks313332 postfix/smtpd[21065]: warning: unknown[115.63.10.9]: SASL LOGIN authentication failed: authentication failure
El ordenador que usa la cuenta esta apagado y continua enviando spam hay alguna forma de desavtivar el dominio y los subdominios y alias y dejar solo activo el correo, ya no se que pensar.
(04-23-2012 11:25 PM)kurgans Wrote: Pos ya sabes lo que hay, cuenta cortada, limpieza de la maquina donde esa cuenta y no te fies mucho de que cuando te digan que han limpiado lo hayan echo
un par de veces al dia mirar las colas y el meneo de envio de correo para verificarlo.
No creo que sea un formulario es mas si miras mas detenidamente el log seguramente encontraras el login
<id del corre>: client=unknown[ip del emisor], sasl_method=LOGIN, sasl_username=usuario@decorreo.tld
RE: Problema SPAM y Undelivered Mail Returned to Sender - kurgans - 04-25-2012 08:41 PM
Quote:Apr 25 10:52:21 ks313332 postfix/smtpd[21065]: warning: unknown[115.63.10.9]: SASL LOGIN authentication failed: authentication failure
Es normal si el pc esta apagado o se ha cambiado la clave del correo, no esta mandando spam a no ser que tengas colas inyectadas.
Para borrar toda la cola postsupuer -d ALL
Y andando
RE: Problema SPAM y Undelivered Mail Returned to Sender - Piradoxlanieve - 04-25-2012 09:13 PM
Un correccion jeje:
Escribiste postsupuer -d ALL y es postsuper -d ALL
Pruebo si se soluciono, y comento.
postsuper: Deleted: 9961 messages
(04-25-2012 08:41 PM)kurgans Wrote:Quote:Apr 25 10:52:21 ks313332 postfix/smtpd[21065]: warning: unknown[115.63.10.9]: SASL LOGIN authentication failed: authentication failure
Es normal si el pc esta apagado o se ha cambiado la clave del correo, no esta mandando spam a no ser que tengas colas inyectadas.
Para borrar toda la cola postsupuer -d ALL
Y andando