hi
need help in figuring this out please. i had a spamming issue because one of the email ids on my server ([email protected]) was compromised. The spammer used that account to send out emails and there were several email in the queue which could not be delivered because ISPs were blocking my server. The puzzling part is that some other customer ([email protected]) was sending a normal legitimate email at that time and immediately he recd a bounce message in reply to the message he was sending (with spammer's message content in it) i simply could not figure out why [email protected] recd the bounced message because he had nothing to do with any of the spam sent out. such an incident is has occurred for the first time since i am using qmail toaster. this version of qmailtoaster is around 2=3 years old. i am worried that my qmailtoaster is going bad. i checked the qmail logs and it shows as such ############### Log of the message that my customer [email protected] was sending ############### 2010-09-24 12:49:01.625452500 new msg 3769080 2010-09-24 12:49:01.625454500 info msg 3769080: bytes 7798 from <[email protected]> qp 22528 uid 89 2010-09-24 12:49:01.630609500 starting delivery 1825351: msg 3769080 to local [email protected] 2010-09-24 12:49:01.641607500 delivery 1825351: success: did_0+0+1/ 2010-09-24 12:49:03.816986500 starting delivery 1826524: msg 3769080 to remote [email protected] ############### Log of the message that my customer [email protected] recd. ############### 2010-09-24 12:49:25.776281500 new msg 3769078 2010-09-24 12:49:25.776323500 info msg 3769078: bytes 16953 from <> qp 27665 uid 7796 2010-09-24 12:49:25.819064500 end msg 3769078 2010-09-24 12:49:25.809005500 starting delivery 1829817: msg 3769078 to local [email protected] 2010-09-24 12:49:25.818938500 delivery 1829817: success: did_0+0+1/ #################### -----Original Message----- From: [email protected] [mailto:[email protected]] Sent: Friday, September 24, 2010 12:49 PM To: [email protected] Subject: failure notice Hi. This is the qmail-send program at ns1.myserver.com. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. <[email protected]>: Sorry, I couldn't find any host named cwusa.com. (#5.1.2) <[email protected]>: User and password not set, continuing without authentication. 65.198.216.200 does not like recipient. Remote host said: 550 #5.1.0 Address rejected [email protected] Giving up on 65.198.216.200. <[email protected]>: User and password not set, continuing without authentication. 65.55.92.136 does not like recipient. Remote host said: 550 Requested action not taken: mailbox unavailable Giving up on 65.55.92.136. <[email protected]>: User and password not set, continuing without authentication. 130.160.4.236 does not like recipient. Remote host said: 550 #5.1.0 Address rejected [email protected] Giving up on 130.160.4.236. <[email protected]>: User and password not set, continuing without authentication. 62.254.123.243 does not like recipient. Remote host said: 550 Administrative prohibition - unable to validate recipient Giving up on 62.254.123.243. <[email protected]>: User and password not set, continuing without authentication. 64.196.112.26 does not like recipient. Remote host said: 554 Service unavailable; Client host [ns1.corpmailserver.com] blocked using Barracuda Reputation; http://bbl.barracudacentral.com/q.cgi?ip=72.35.70.2 Giving up on 64.196.112.26. <[email protected]>: User and password not set, continuing without authentication. 205.196.178.24 does not like recipient. Remote host said: 550 5.7.1 Requested action not taken: mailbox not available Giving up on 205.196.178.24. <[email protected]>: User and password not set, continuing without authentication. 74.125.148.10 does not like recipient. Remote host said: 550 No such user - psmtp Giving up on 74.125.148.10. <[email protected]>: User and password not set, continuing without authentication. 206.209.126.4 does not like recipient. Remote host said: 554 Service unavailable; Client host [ns1.corpmailserver.com] blocked using Barracuda Reputation; http://www.barracudanetworks.com/reputation/?r=1&ip=72.35.70.2 Giving up on 206.209.126.4. <[email protected]>: User and password not set, continuing without authentication. 192.55.228.12 does not like recipient. Remote host said: 554 Service unavailable; Client host [ns1.corpmailserver.com] blocked using Barracuda Reputation; http://bbl.barracudacentral.com/q.cgi?ip=72.35.70.2 Giving up on 192.55.228.12. <[email protected]>: User and password not set, continuing without authentication. 216.82.241.147 does not like recipient. Remote host said: 550 Invalid recipient <[email protected]> (#5.1.1) Giving up on 216.82.241.147. --- Below this line is a copy of the message. Return-Path: <[email protected]> Received: (qmail 22528 invoked by uid 89); 24 Sep 2010 07:19:01 -0000 Received: by simscan 1.3.1 ppid: 20381, pid: 21938, t: 0.9811s scanners: attach: 1.3.1 clamav: 0.96.1/m:52 Received: from unknown (HELO dss145) ([email protected]@59.163.21.131) by ns2.corpmailserver.com with ESMTPA; 24 Sep 2010 07:19:00 -0000 From: "Username" <[email protected]> To: "'Username1'" <[email protected]> Cc: "'Username2'" <[email protected]> References: <009801cb5953$d7c09030$8741b0...@[email protected]> <c8be17b1.c8e7%[email protected]> In-Reply-To: <c8be17b1.c8e7%[email protected]> Subject: RE: Quick Update Date: Fri, 24 Sep 2010 12:49:50 +0530 Message-ID: <006b01cb5bb8$e21554f0$a63ffe...@[email protected]> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_006C_01CB5BE6.FBCD90F0" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: ActZUUTiRTccNZWOS5CaKe69gpOrxwAAl6jgAAHrbj0Al1apAA== Content-Language: en-us This is a multi-part message in MIME format. ------=_NextPart_000_006C_01CB5BE6.FBCD90F0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit --------------------------------------------------------------------------------- Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! --------------------------------------------------------------------------------- Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
