Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is the packet capture of how the attacker is coming to my server and generating Huge amount of spam, i am not able to block it by any means.

 220 mta1497.mail.ne1.yahoo.com ESMTP YSmtpProxy service ready
EHLO amsonere.co.uk
250-mta1497.mail.ne1.yahoo.com
250-8BITMIME
250-SIZE 41943040
250 PIPELINING
MAIL FROM:<craigwright@straygoat.com>
250 sender <craigwright@straygoat.com> ok
RCPT TO:<ddogg_730@yahoo.com>
250 recipient <ddogg_730@yahoo.com> ok
DATA
354 go ahead
Received: (qmail 3346 invoked from network); 7 May 2013 16:31:47 +0100
Received: from dsl-189-139-37-42-dyn.prod-infinitum.com.mx (HELO vdatbgpawos) (189.139.37.42)
  by amsonere.co.uk with SMTP; 7 May 2013 16:31:46 +0100
From: "fegody zaneze" <craigwright@straygoat.com>
To: <ddogg_730@yahoo.com>, <ol.e.et.h.omas.rn.sp@gmail.com>, <foettle@hotmail.com>, <srandolph24@netscape.net>, <jerry.m.rodriguez@gmail.com>
Date: Tue, 7 May 2013 17:27:50 -0700
Subject: SHOWE RINGt itsjo b
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-2

nop, qi
ruqifaz p http://metal-surface.fr/Knee-highs.html
  .
250 ok dirdel
QUIT
221 mta1497.mail.ne1.yahoo.com

What type of attack is this? it is coming from hundreds of IP addresses. i cannot block thousands of IP addresses. I am using Qmail on Plesk

Here are logs in /usr/loca/psa/var/log/maillog

   May  8 20:19:31 argon qmail-queue-handlers[28923]: Handlers Filter before-queue for qmail started ...
May  8 20:19:31 argon qmail-queue-handlers[28924]: Handlers Filter before-queue for qmail started ...
May  8 20:19:32 argon qmail-queue-handlers[28924]: from=faw@straygoat.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=fl4pperj4ck@live.co.uk
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=charliemunoz@sbcglobal.net
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=juanjaviervb@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=tdcharris88@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=simoncsmyth@googlemail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=venanciog7@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=bedo_101_1@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: hook_dir = '/var/qmail//handlers/before-queue'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[3] = 'fl4pperj4ck@live.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/fl4pperj4ck@live.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[4] = 'charliemunoz@sbcglobal.net'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/charliemunoz@sbcglobal.net'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[5] = 'juanjaviervb@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/juanjaviervb@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[6] = 'tdcharris88@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/tdcharris88@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[7] = 'simoncsmyth@googlemail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/simoncsmyth@googlemail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[8] = 'venanciog7@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/venanciog7@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[9] = 'bedo_101_1@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/bedo_101_1@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: from=muju@straygoat.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=duligongcaonimei@sina.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=cclousingcci@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=bin1800dc@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=peggygonzalez964@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=buddiezno@aol.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=mick@sharnock.fsworld.co.uk
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=nmaurice.white871@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=saf509@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=veronica_lopez10@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: hook_dir = '/var/qmail//handlers/before-queue'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[3] = 'duligongcaonimei@sina.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/duligongcaonimei@sina.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[4] = 'cclousingcci@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/cclousingcci@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[5] = 'bin1800dc@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/bin1800dc@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[6] = 'peggygonzalez964@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/peggygonzalez964@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[7] = 'buddiezno@aol.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/buddiezno@aol.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[8] = 'mick@sharnock.fsworld.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/mick@sharnock.fsworld.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[9] = 'nmaurice.white871@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/nmaurice.white871@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[10] = 'saf509@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/saf509@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[11] = 'veronica_lopez10@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/veronica_lopez10@yahoo.com'
share|improve this question
5  
You're running an open relay. Stop doing that. –  ceejayoz May 7 '13 at 15:55

1 Answer 1

As i see that's not the attacker coming to your server, its your server sending the mail to yahoo.
You either are open relay, or they are exploiting a weak password and injecting the mail's with SMTP auth.

share|improve this answer
    
how to investigate that what is doing this? any idea? –  Farhan May 7 '13 at 16:33
1  
Not sure how qmail logs auth's, so maybe do a packet capture (tcpdump -n -i interface host YOUR.SERVER.IP and port 25 ), and see if the SMTP conversations have any AUTH PLAIN lines, if yes, run the arguments through a base64 decoder to get the usernames used for SMTP auth –  Sandor Marton May 7 '13 at 16:55
    
maybe do a grep for 'smtp_auth' in /usr/local/psa/var/log/maillog –  Sandor Marton May 7 '13 at 16:56
    
I have edited the question, the logs for maillog, if you can look into it? –  Farhan May 8 '13 at 19:21
    
Looks like you are relaying without them doing any auth. But i don't really use Plesk with qmail, so i'm not sure if smtp_auth supposed to show up in the log or not. Maybe switch to postfix if you don't have any custom config ( via ssh : /usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component postfix ) –  Sandor Marton May 8 '13 at 21:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.