Hot answers tagged spam
Yes, they are trying. And failing. You can tell that they are failing by looking at the return code -400 - bad request means that your server is basically saying "No way I'm going to let you do that". Which, in this context, is a good thing.
I have a lot of respect for Jenny's answer, but I thought I had to add this: It's an attempt to do a shellshock attack (with grateful thanks to Iain for pointing this out). Provided you've patched your server against this vulnerability, the web server returns a 400, which takes it microseconds of CPU, and thinks no further on the matter. But you write ...
If you don't have much outgoing mail, I'd setup a packet capture on port 25 (SMTP) do check if something else than your mail server is sending suspicious mails to the Internet. As the Spamhaus page speaks of an "Open proxy", did you try portscanning your server from the Internet to see if there is any service that should not be there? For example a Squid ...
I am a (little) vivid anti-spam fighter myself. And because of many problems as you encounter, I ended up doing the dirty things myself, years ago. Now, this is not an answer to your particular question, but to your particular problem. So please don't downvote because of this. How I solved this problem was to modify the sa_filter-post.pl script, used by ...
I would recommend using a free 3rd party ESP, as they take extra steps to ensure abuse handled and monitored they have a higher reputation with receivers. Personally I like MandrillApp which you could easily use for free, there are many others, be sure to avoid ESP's that use purchased Lists, and Word to the Wise has some other great suggestions as well!
Easy-n-Good way Hire good postmaster and hostmaster, they can fast and easy fix all your noob mistakes (alot of) Hard-n-Glorious way RTFM, beсome competent postmaster and hostmaster and do The Right Things (tm) Your current (related and unrelated) errors Never point MX to CNAME, only to A @ MX mail mail CNAME some.name is BAD @ MX mail ...
Only top voted, non community-wiki answers of a minimum length are eligible