0

When I run the command mailq on my site a get an output like this:

B8D90603E86F4     3422 Wed Apr 12 14:04:14  info@tk-atlant.ru
(host alt1.gmail-smtp-in.l.google.com[209.85.202.26] said: 421-4.7.0 [vvv.xxx.yyy.zzz       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. g3si9112268wmc.148 - gsmtp (in reply to end of DATA command))
                                         brushalinder03@gmail.com
                                         brushdude@gmail.com
                                         brushesc@gmail.com
                                         brushfreeman@gmail.com
                                         brushing001@gmail.com
                                         brushing1289@gmail.com
                                         brushing222@gmail.com
                                         brushing2@gmail.com
                                         brushmark444@gmail.com
                                         brusholf@gmail.com
                                         brushpenart@gmail.com
                                         brushroom@gmail.com
                                         brushton34@gmail.com
                                         brushton51089@gmail.com
                                         brushton@gmail.com
                                         brushwerx@gmail.com
                                         brushyhollowtrails@gmail.com
                                         brusine@gmail.com
                                         bruska13@gmail.com
                                         bruskbog@gmail.com
                                         bruski27@gmail.com
                                         bruskidickens@gmail.com
                                         brusnac@gmail.com
                                         brusnak@gmail.com
                                         brusojessie@gmail.com
                                         brusse1.62@gmail.com
                                         brusseau44@gmail.com
                                         brussell.russell52@gmail.com
                                         brussell104@gmail.com
                                         brussell1167@gmail.com
                                         brussell22@gmail.com
                                         brussell2326@gmail.com
                                         brussell495@gmail.com
                                         brussell588@gmail.com
                                         brussell719@gmail.com
                                         brussell8899@gmail.com
                                         brussell8998@gmail.com
                                         brussell@gmail.com
                                         brussellsacks@gmail.com
                                         brussellv@gmail.com
                                         brussina@gmail.com
                                         brusso13@gmail.com
                                         brusso2892@gmail.com
                                         brusso530@gmail.com
                                         brusson@gmail.com
                                         brust411@gmail.com
                                         brustbaby6986@gmail.com
                                         brustflorida1989@gmail.com
                                         brusther1@gmail.com
                                         brustin29@gmail.com

4E8F2603E86EB     6067 Wed Apr 12 14:04:13  MAILER-DAEMON
(host mx.yandex.net[213.180.193.89] said: 451 4.7.1 Sorry, the service is currently unavailable. Please come back later. 1492020260-fQSwdIJrgP-4KMuQhZW (in reply to end of DATA command))
                                         info@tk-atlant.ru

where vvv.xxx.yyy.zzz is my ip address

When I search for spam on the mail.log I've got this

Apr 12 14:13:44 mail postfix/smtp[30705]: 1ADDD603E8E77: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. q34si10070519uaq.158 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:44 mail postfix/smtp[30699]: 2EAB4603E86FC: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. f7si1701964uaf.125 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:45 mail postfix/smtp[30701]: 1F131603E8E50: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. g126si7977133vkg.204 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:45 mail postfix/smtp[30691]: 1BD69603E8D97: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. v5si2114982uaf.147 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:45 mail postfix/smtp[30681]: 23144603E8AA0: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. g72si7067092vki.93 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:45 mail postfix/smtp[30678]: 2F334603E8A90: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. w66si10076884vke.101 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:47 mail postfix/smtp[30686]: 299DA603E8DA5: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. c187si10068708vkd.194 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:47 mail postfix/smtp[30700]: 22329603E8E45: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. k20si7240125uaf.60 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:48 mail postfix/smtp[30710]: 27917603E8DAB: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. x38si10023076uax.138 - gsmtp (in reply to end of DATA command)
Apr 12 14:13:49 mail postfix/smtp[30709]: 2E36E603E8DA7: host gmail-smtp-in.l.google.com[108.177.11.27] said: 421-4.7.0 [190.202.87.1       4] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0  https://support.google.com/mail/?p=UnsolicitedRateLimitError to 421 4.7.0 review our Bulk Email Senders Guidelines. k129si10052482vkf.49 - gsmtp (in reply to end of DATA command)

Pleasse any suggestion to stop this

1
  • First: stop postfix. Second: Your server has been compromised.
    – Jenny D
    Apr 12, 2017 at 18:47

1 Answer 1

2

See this thread perhaps one of:

If it came from elsewhere and was relayed to somewhere else entirely, postfix is currently functioning as an open relay. This is very, very bad and you should tighten up your smtpd_recipient_restrictions and smtpd_client_restrictions settings in /etc/postfix/main.cf.

If it came in from localhost, it's very likely that one webhosting user or another has been compromised with a php script that sends out spam on demand. Use the find command to look for .php files that were recently added or altered, then take a good look at any suspicious names.

Not the answer you're looking for? Browse other questions tagged or ask your own question.