垃圾邮件冒充本地帐户，MD不能过滤

codemoon · 发表于 2012-3-24 13:39:39

本帖最后由 codemoon 于 2012-3-24 13:41 编辑

大家好，小弟请教一个问题，近来有某些垃圾邮件发来，我方Mdaemon10.1过滤不了，请问如何是好？
我发现这邮件可以冒充我们的帐户，accounting@abc.com 这个帐户我们根本没有，但用户收到这封垃圾邮件之后，发信人就是这个帐户。

abc.com是我司邮件服务器，请大家帮忙看看两段Log，指教一下解决方案，万分感谢。
一、
Fri 2012-03-23 03:10:43: ----------
Fri 2012-03-23 03:12:23: Session 4193; child 1; thread 1232
Fri 2012-03-23 03:12:11: Accepting SMTP connection from [197.251.157.133:15374]
Fri 2012-03-23 03:12:11: Performing PTR lookup (133.157.251.197.IN-ADDR.ARPA)
Fri 2012-03-23 03:12:11: *  Error: *  名称服务器报告未知的域名
Fri 2012-03-23 03:12:11: *  No PTR records found
Fri 2012-03-23 03:12:11: ---- End PTR results
Fri 2012-03-23 03:12:11: --> 220 abc.com ESMTP MDaemon 10.1.1; Fri, 23 Mar 2012 03:12:11 +0800
Fri 2012-03-23 03:12:12: <-- EHLO [197.251.157.133]
Fri 2012-03-23 03:12:12: --> 250-abc.com Hello [197.251.157.133], pleased to meet you
Fri 2012-03-23 03:12:12: --> 250-ETRN
Fri 2012-03-23 03:12:12: --> 250-AUTH=LOGIN
Fri 2012-03-23 03:12:12: --> 250-AUTH LOGIN CRAM-MD5
Fri 2012-03-23 03:12:12: --> 250-8BITMIME
Fri 2012-03-23 03:12:12: --> 250 SIZE
Fri 2012-03-23 03:12:14: <-- MAIL FROM:<JoeySunseri@concap.de>
Fri 2012-03-23 03:12:14: Performing IP lookup (concap.de)
Fri 2012-03-23 03:12:14: *  D=concap.de TTL=(170) A=[82.165.72.82]
Fri 2012-03-23 03:12:14: *  P=001 S=002 D=concap.de TTL=(1320) MX=[aspmx.l.google.com]
Fri 2012-03-23 03:12:14: *  P=005 S=000 D=concap.de TTL=(1320) MX=[alt2.aspmx.l.google.com]
Fri 2012-03-23 03:12:14: *  P=005 S=003 D=concap.de TTL=(1320) MX=[alt1.aspmx.l.google.com]
Fri 2012-03-23 03:12:14: *  P=010 S=001 D=concap.de TTL=(1320) MX=[aspmx2.googlemail.com]
Fri 2012-03-23 03:12:14: *  D=concap.de TTL=(170) A=[82.165.72.82]
Fri 2012-03-23 03:12:14: *  D=concap.de TTL=(170) A=[82.165.72.82]
Fri 2012-03-23 03:12:14: *  D=concap.de TTL=(170) A=[82.165.72.82]
Fri 2012-03-23 03:12:14: *  D=concap.de TTL=(170) A=[82.165.72.82]
Fri 2012-03-23 03:12:14: ---- End IP lookup results
Fri 2012-03-23 03:12:14: Performing SPF lookup (concap.de / 197.251.157.133)
Fri 2012-03-23 03:12:14: *  Result: none; no SPF record in DNS
Fri 2012-03-23 03:12:14: ---- End SPF results
Fri 2012-03-23 03:12:14: --> 250 <JoeySunseri@concap.de>, Sender ok
Fri 2012-03-23 03:12:16: <-- RCPT TO: <fujiaxiong@abc.com>
Fri 2012-03-23 03:12:16: --> 250 <fujiaxiong@abc.com>, Recipient ok
Fri 2012-03-23 03:12:18: <-- DATA
Fri 2012-03-23 03:12:18: Creating temp file (SMTP): c:\mdaemon\queues\temp\md50000039149.tmp
Fri 2012-03-23 03:12:18: --> 354 Enter mail, end with <CRLF>.<CRLF>
Fri 2012-03-23 03:12:20: Message size: 4814 bytes
Fri 2012-03-23 03:12:20: Performing DKIM lookup
Fri 2012-03-23 03:12:20: *  File: c:\mdaemon\queues\temp\md50000039149.tmp
Fri 2012-03-23 03:12:20: *  Message-ID: 397212853.46646036426904@abc.com
Fri 2012-03-23 03:12:20: *  Result: neutral
Fri 2012-03-23 03:12:20: ---- End DKIM results
Fri 2012-03-23 03:12:20: Performing DomainKeys lookup (Sender: scan@abc.com)
Fri 2012-03-23 03:12:20: *  File: c:\mdaemon\queues\temp\md50000039149.tmp
Fri 2012-03-23 03:12:20: *  Message-ID: 397212853.46646036426904@abc.com
Fri 2012-03-23 03:12:20: *  Querying for policy: abc.com
Fri 2012-03-23 03:12:20: * Querying: _domainkey.abc.com ...
Fri 2012-03-23 03:12:20: * DNS: *  名称服务器报告未知的域名
Fri 2012-03-23 03:12:20: *  Result: neutral
Fri 2012-03-23 03:12:20: ---- End DomainKeys results
Fri 2012-03-23 03:12:20: Passing message through AntiVirus (Size: 4814)...
Fri 2012-03-23 03:12:20:
Fri 2012-03-23 03:12:20: ---- End AntiVirus results
Fri 2012-03-23 03:12:20: Passing message through Outbreak Protection...
Fri 2012-03-23 03:12:20: *  Message-ID: 397212853.46646036426904@abc.com
Fri 2012-03-23 03:12:20: *  Reference-ID: fgs=0
Fri 2012-03-23 03:12:20: *  Virus result: 0 - Clean
Fri 2012-03-23 03:12:20: *  Spam result: 1 - Clean
Fri 2012-03-23 03:12:20: *  IWF result: 0 - Clean
Fri 2012-03-23 03:12:20: ---- End Outbreak Protection results
Fri 2012-03-23 03:12:22: 邮件创建 successful：c:\mdaemon\queues\inbound\md50001334245.msg
Fri 2012-03-23 03:12:22: --> 250 Ok, message saved <Message-ID: 397212853.46646036426904@abc.com>
Fri 2012-03-23 03:12:23: <-- QUIT
Fri 2012-03-23 03:12:23: --> 221 See ya in cyberspace
Fri 2012-03-23 03:12:23: SMTP session successful (Bytes in/out: 4924/436)
Fri 2012-03-23 03:12:23: ----------

二、
Fri 2012-03-23 03:35:32: ----------
Fri 2012-03-23 03:41:47: Session 4206; child 1; thread 4076
Fri 2012-03-23 03:41:38: Accepting SMTP connection from [109.127.115.93:62961]
Fri 2012-03-23 03:41:38: Performing PTR lookup (93.115.127.109.IN-ADDR.ARPA)
Fri 2012-03-23 03:41:38: * Error: * 名称服务器报告未知的域名
Fri 2012-03-23 03:41:38: * No PTR records found
Fri 2012-03-23 03:41:38: ---- End PTR results
Fri 2012-03-23 03:41:38: --> 220 abc.com ESMTP MDaemon 10.1.1; Fri, 23 Mar 2012 03:41:38 +0800
Fri 2012-03-23 03:41:39: <-- EHLO PC
Fri 2012-03-23 03:41:39: Performing IP lookup (PC)
Fri 2012-03-23 03:41:39: * Error: * 名称服务器报告未知的域名
Fri 2012-03-23 03:41:39: ---- End IP lookup results
Fri 2012-03-23 03:41:39: --> 250-abc.com Hello PC, pleased to meet you
Fri 2012-03-23 03:41:39: --> 250-ETRN
Fri 2012-03-23 03:41:39: --> 250-AUTH=LOGIN
Fri 2012-03-23 03:41:39: --> 250-AUTH LOGIN CRAM-MD5
Fri 2012-03-23 03:41:39: --> 250-8BITMIME
Fri 2012-03-23 03:41:39: --> 250 SIZE
Fri 2012-03-23 03:41:41: <-- MAIL FROM:<NasirSans@emerytelcom.net>
Fri 2012-03-23 03:41:41: Performing IP lookup (emerytelcom.net)
Fri 2012-03-23 03:41:41: * D=emerytelcom.net TTL=(1100) A=[67.22.175.238]
Fri 2012-03-23 03:41:41: * P=050 S=000 D=emerytelcom.net TTL=(1222) MX=[mailpool.etv.net]
Fri 2012-03-23 03:41:41: * D=emerytelcom.net TTL=(1163) A=[67.22.175.238]
Fri 2012-03-23 03:41:41: ---- End IP lookup results
Fri 2012-03-23 03:41:41: Performing SPF lookup (emerytelcom.net / 109.127.115.93)
Fri 2012-03-23 03:41:41: * Result: none; no SPF record in DNS
Fri 2012-03-23 03:41:41: ---- End SPF results
Fri 2012-03-23 03:41:41: --> 250 <NasirSans@emerytelcom.net>, Sender ok
Fri 2012-03-23 03:41:42: <-- RCPT TO: <kwan@abc.com>
Fri 2012-03-23 03:41:42: --> 250 <kwan@abc.com>, Recipient ok
Fri 2012-03-23 03:41:43: <-- DATA
Fri 2012-03-23 03:41:43: Creating temp file (SMTP): c:\mdaemon\queues\temp\md50000039160.tmp
Fri 2012-03-23 03:41:43: --> 354 Enter mail, end with <CRLF>.<CRLF>
Fri 2012-03-23 03:41:45: Message size: 5486 bytes
Fri 2012-03-23 03:41:45: Performing DKIM lookup
Fri 2012-03-23 03:41:45: * File: c:\mdaemon\queues\temp\md50000039160.tmp
Fri 2012-03-23 03:41:45: * Message-ID: acbc01cd0820$c36e8bf0$5d737f6d@NasirSans
Fri 2012-03-23 03:41:45: * Result: neutral
Fri 2012-03-23 03:41:45: ---- End DKIM results
Fri 2012-03-23 03:41:45: Performing DomainKeys lookup (Sender: accounting@abc.com)
Fri 2012-03-23 03:41:45: * File: c:\mdaemon\queues\temp\md50000039160.tmp
Fri 2012-03-23 03:41:45: * Message-ID: acbc01cd0820$c36e8bf0$5d737f6d@NasirSans
Fri 2012-03-23 03:41:45: * Querying for policy: abc.com
Fri 2012-03-23 03:41:45: * Querying: _domainkey.abc.com ...
Fri 2012-03-23 03:41:46: * DNS: * 名称服务器报告未知的域名
Fri 2012-03-23 03:41:46: * Result: neutral
Fri 2012-03-23 03:41:46: ---- End DomainKeys results
Fri 2012-03-23 03:41:46: Passing message through AntiVirus (Size: 5486)...
Fri 2012-03-23 03:41:46:
Fri 2012-03-23 03:41:46: ---- End AntiVirus results
Fri 2012-03-23 03:41:46: Passing message through Outbreak Protection...
Fri 2012-03-23 03:41:46: * Message-ID: acbc01cd0820$c36e8bf0$5d737f6d@NasirSans
Fri 2012-03-23 03:41:46: * Reference-ID: fgs=0
Fri 2012-03-23 03:41:46: * Virus result: 0 - Clean
Fri 2012-03-23 03:41:46: * Spam result: 1 - Clean
Fri 2012-03-23 03:41:46: * IWF result: 0 - Clean
Fri 2012-03-23 03:41:46: ---- End Outbreak Protection results
Fri 2012-03-23 03:41:46: 邮件创建 successful：c:\mdaemon\queues\inbound\md50001334254.msg
Fri 2012-03-23 03:41:46: --> 250 Ok, message saved <Message-ID: acbc01cd0820$c36e8bf0$5d737f6d@NasirSans>
Fri 2012-03-23 03:41:47: <-- QUIT
Fri 2012-03-23 03:41:47: --> 221 See ya in cyberspace
Fri 2012-03-23 03:41:47: SMTP session successful (Bytes in/out: 5579/422)
Fri 2012-03-23 03:41:47: ----------

openkarl · 发表于 2012-4-2 14:01:59

我也碰到這類問題了，朋友你是怎麼解決的？
openkarl@163.com

codemoon · 发表于 2012-4-6 08:44:10

因为我看回过滤记录，MD说用户是白名单用户，所以即使发现是垃圾邮件也不拦截。
我只能想到把本地用户从白名单里移除了。把本地内网IP地址从可信主机里移除，然后还有很多安全设置里关于不过滤本地的选项都不勾选。

rosetea · 发表于 2012-5-16 06:51:15

codemoon 发表于 2012-4-6 08:44
因为我看回过滤记录，MD说用户是白名单用户，所以即使发现是垃圾邮件也不拦截。
我只能想到把本地用户从白 ...

这样设置后，好了吗？

yudong118 · 发表于 2012-5-17 11:04:31

关闭中继
开启SMTP前先POP
添加SPF记录

su30_mkk · 发表于 2012-5-24 12:33:18

我也碰到过类似的问题，发送垃圾邮件的是我们服务器上合法的邮件地址，但是这个人根本没有发送过类似的垃圾邮件。后来，我也是关闭了中继，最主要的措施是，开启smtp登录验证。最好在outlook等邮件客户端设置smtp发送需要登录，并且不要”和pop相同“，而要选择“用以下用户名和密码”的选项，然后输入用户名和密码。现在这种情况基本上没有了。

asjkdh · 发表于 2012-6-1 13:55:48

楼上的我想请问一下,怎么设置不同POP方式.在OUTLOOK中

starry · 发表于 2012-6-12 15:12:24

好象MD最近是有这问题啊...........
最近我的MD也是碰到过类似的问题，发送垃圾邮件的是我们服务器上合法的邮件地址，但是这个人根本没有发送过类似的垃圾邮件............................

关闭中继先....
然后加强用户密码.
再不行就要SMTP认证......................

arboreal · 发表于 2012-6-13 15:02:55

smtp验证|勾选当邮件来自本地帐户时，始终要求验证

Kyan · 发表于 2012-6-21 01:28:16

本帖最后由 Kyan 于 2012-6-21 01:34 编辑

事實上不是冒充的，攪局的和垃圾廣告大部來自大陸各地，它一秒鐘可連績發信至同一地址約二十封右左，昨天我還有收到（當然都被攔了），有的本身只有四個 IP，有的是整個網段的動態 IP，有 Log 可資證明。我現公佈近半個月來的來攪局的 IP 和其所屬單位如下：

121.16.0.0 - 121.23.255.255
China Unicom Hebei province network
China Unicom
China

122.10.0.0 - 122.10.127.255
SHIHUNET
China

122.64.0.0 - 122.95.255.255
China
China TieTong Telecommunications Corporation
Jinze Mansion, 2 Guangningbo Street,
Xicheng District, Beijing, China, 100032

122.136.0.0 - 122.143.255.255
China Unicom Jilin province network
China Unicom
China

122.188.0.0 - 122.191.255.255
UNICOM Hubei Province Network
China Unicom
No.21, Jin-Rong Street
Beijing 100033
China

123.128.0.0 - 123.135.255.255
China Unicom Shandong Province Network
China Unicom
China

60.12.105.160 - 60.12.105.191
China
beijingshuduzhuanxian,huzhouzhejiang

123.64.0.0 - 123.95.255.255
China
China TieTong Telecommunications Corporation
Jinze Mansion, 2 Guangningbo Street,
Xicheng District, Beijing, China, 100032
123.128.0.0 - 123.135.255.255
China Unicom Shandong Province Network
China Unicom
China

222.32.0.0 - 222.63.255.255
CHINA RAILWAY TELECOMMUNICATIONS CENTER
22F Yuetan Mansion,Xicheng District,Beijing,P.R.China
China
211.100.96.0 - 211.100.103.255
Mul-minding Net Technology Com. Ltd.
Rm.902,North Real Estate Building, Build. No.3, #81Yuan ,
ZiZhuyuan Rd, Haidian Dist., Beijing
China

42.4.0.0 - 42.7.255.255
UNICOM Liaoning Province Network
China Unicom
No.21, Jin-Rong Street
Beijing 100033
China

42.48.0.0 - 42.49.255.255
China Unicom HuNan province network
China Unicom
No.21,Jin-Rong Street,
Beijing 100033
China

42.50.0.0 - 42.50.255.255
ChongQing Broadcast & TV Broadband IP MAN
ChongQing Broadcast & TV Transfer Network Co. Ltd
China

42.51.0.0 - 42.51.127.255
Henan Telcom Union Technology Co., LTD
73, 18 Buliding, 93 Jingsan Road,
Zhengzhou City,Henan,China
China

42.52.0.0 - 42.55.255.255
UNICOM Liaoning Province Network
China Unicom
No.21, Jin-Rong Street
Beijing 100033
China

42.56.0.0 - 42.59.255.255
UNICOM Liaoning Province Network
China Unicom
No.21, Jin-Rong Street
Beijing 100033
China

222.160.0.0 - 222.163.255.255
China Unicom Jilin province network
China Unicom
China

124.172.192.0 - 124.172.255.255
World Crossing Telecom(GuangZhou) Ltd.
17/FL,International Bank Center,
191# DongFengXi Rd. Guangzhou, Guangdong
China

162.105.0.0 - 162.105.255.255
imported inetnum object for PEKING
China

116.16.0.0 - 116.31.255.255
CHINANET Guangdong province network
China Telecom
No.31,jingrong street
Beijing 100032
China

115.152.0.0 - 115.153.255.255
CHINANET JIANGXI PROVINCE NETWORK
China Telecom
No.31,jingrong street
Beijing 100032
China

121.204.0.0 - 121.207.255.255
CHINANET Fujian province network
China Telecom
7,East Street ,Fuzhou ,Fujian ,PRC
China

121.101.208.0 - 121.101.223.255
Beijing Sun Rise Technology CO.LTD
Tedatimes Center, Suite 1908, Tower4, No.15 Guanghua Road,
Chaoyang District, Beijing, 100026, PRC
China

61.177.0.0 - 61.177.255.255
CHINANET jiangsu province network
China Telecom
A12,Xin-Jie-Kou-Wai Street
Beijing 100088
China

211.64.0.0 - 211.127.255.255
China Internet Network Information Center
China

124.236.0.0 - 124.239.255.255
CHINANET hebei province network
China Telecom
No.31,jingrong street
Beijing 100032
311-85211771
311-85202145
China

115.24.0.0 - 115.24.15.255
~{I=Nw4sQ''~}
Shanxi University
Taiyuan, Shanxi 030006, China
China

115.25.0.0 - 115.25.63.255
~{11>)?F<<4sQ''~}
University of Science and Technology Beijing
Beijing 100083, China
China

115.26.0.0 - 115.26.15.255
~{Ll=rJP4sQ''Hm<~Q''T:~}
Tianjin Institute of Software Engineering
Tianjin 300387, China
China

115.27.0.0 - 115.27.255.255
~{11>)4sQ''PBT0GxP#T0Mx~}
Peking University New Campus Network
HaiDian YiHeYuanLu 5, Beijing 100871, China
China

115.28.0.0 - 115.29.255.255
HiChina Web Solutions (Beijing) Limited
2nd Floor,BLDG HP No.112 Jian Guo Street,Chaoyang District,Beijing
China

122.8.0.0 - 122.8.63.255
Yangzhou xunwei technology Corporation Limited
Jiangdu road 24, yangzhou city, jiangsu province
China

122.9.0.0 - 122.9.15.255
Hangzhou Yi-net Interlink Technologies co.,LTD
China

122.188.0.0 - 122.191.255.255
UNICOM Hubei Province Network
China Unicom
No.21, Jin-Rong Street
Beijing 100033
China

122.192.0.0 - 122.195.255.255
China Unicom Jiangsu province network
China Unicom
China

60.24.0.0 - 60.31.255.255
China
China Unicom Tianjin province network
China Unicom
China

219.142.0.0 - 219.142.127.255
Beijing Kuanjie Net communication technology Ltd
420, administration Mansion,
No.83 FuXing Road, Beijing
China

114.255.41.0 - 114.255.41.255
BUPT
Zhangjun zhangjun
Beijingshi haidianqu xitucheng lu 10hao
China

121.4.0.0 - 121.5.255.255
Beijing Founder Broadband Network Technology Co.,Ltd
Floor 5th,ZhongGuanCun FangZheng Building,No.298,Chengfu
Road,HaidianDistrict,Beijing
China

60.0.0.0 - 60.15.255.255
China Unicom Hebei Province Network
China Unicom
China

125.210.0.0 - 125.210.255.255
WASU TV & Communication Holding Co.,Ltd.
6/F, Jian Gong Building, NO.20 Wen San Road, Hangzhou
Zhejiang province, P.R.China 310012
China

219.152.0.0 - 219.159.255.255
China
China Unicom Henan province network
China Unicom

112.64.0.0 - 112.65.255.255
CHINA UNICOM Shanghai network
China Unicom
China

122.225.36.0 - 122.225.36.127
SHANGHAI RUSH TELECOM CO., LTD.
China

124.16.0.0 - 124.17.255.255
China Science & Technology Network
No.4,4th South Street, Zhong Guan Cun, Haidian District,
P.O.Box 349,Beijing 100080
China

124.133.26.0 - 124.133.26.127
inanwanjiaxuanyingnetbar
China

219.151.48.128 - 219.151.48.255
Tibet-naqu,jieduiwa road 18,customs
China

60.191.232.128 - 60.191.232.255
China
Shaoxing Dingqi Internet Science Co.,ltd

60.190.219.128 - 60.190.219.255
Ninbo Lanzhong Network Ltd
China

219.145.93.108 - 219.145.93.111
XI''AN YU CAI MIDDLE SCHOOL
Xi''an city, shaanxi
China

219.72.0.0 - 219.72.255.255
CITIC Networks Management Co.,Ltd.
6 XINYUANNANLU BEIJING
China

219.82.0.0 - 219.82.255.255
WASU TV & Communication Holding Co.,Ltd.
6/F, Jian Gong Building, NO.20 Wen San Road, Hangzhou,
Zhejiang province, P.R.China 310012
China

219.128.0.0 - 219.143.255.255
CHINANET Guangdong province network
Data Communication Division
China Telecom
China

219.145.93.108 - 219.145.93.111
XI''AN YU CAI MIDDLE SCHOOL
Xi''an city, shaanxi
China

180.152.0.0 - 180.159.255.255
CHINANET SHANGHAI PROVINCE NETWORK
China Telecom
No.31,jingrong street
Beijing 100032
China

111.72.0.0 - 111.79.255.255
CHINANET JIANGXI PROVINCE NETWORK
China Telecom
No.31,jingrong street
Beijing 100032
China

122.224.10.0 - 122.224.10.255
China
Ninbo Lanzhong Network Ltd

221.130.128.0 - 221.130.255.255
China
China Mobile Communications Corporation - shanghai

118.212.0.0 - 118.212.255.255
China Unicom Jiangxi province network
China Unicom
China

1.192.0.0 - 1.199.255.255
CHINANET henan province network
henan Telecom Corporation
97# Zhongyuan Street, Zhengzhou,henan,China
China

182.96.0.0 - 182.111.255.255
CHINANET JIANGXI PROVINCE NETWORK
China Telecom
No.31,jingrong street
Beijing 100032
China

114.113.144.0 - 114.113.159.255
Beijing Topnew Info&Tech co., LTD.
No.9, Jintaili, Chaoyang District,
Beijing, China 100026
China

60.0.0.0 - 60.15.255.255
China Unicom Hebei Province Network
China Unicom
China

60.16.0.0 - 60.23.255.255
China
China Unicom Liaoning province network
China Unicom

60.24.0.0 - 60.31.255.255
China
China Unicom Tianjin province network
China Unicom

60.160.0.0 - 60.175.255.255
CHINANET anhui province network
China Telecom
A12,Xin-Jie-Kou-Wai Street
Beijing 100088
China

60.180.0.0 - 60.180.255.255
China
CHINANET-ZJ Wenzhou node network
Zhejiang Telecom

60.190.0.0 - 60.190.255.255
China
Nahu International Education investment Co.,LTD

112.0.0.0 - 112.63.255.255
China Mobile Communications Corporation
Mobile Communications Network Operator in China
Internet Service Provider in China
China

		自动登录	找回密码
密码			会员注册

[求助] 垃圾邮件冒充本地帐户，MD不能过滤

相关帖子

点评