Eu tenho um CentOS 6 em um servidor dedicado. Eu sou o único com acesso shell a ele. Eu hospedo 2 Wordpress e alguns sites PHP simples lá. Minha empresa de hospedagem acabou de me enviar um email dizendo que bloqueou minha porta 25 porque estou enviando spam.
# cat /var/log/maillog
Jul 11 16:43:28 stock postfix/smtp[31689]: 2D55610D3EE: to=<[email protected]>, relay=mail.athoise.com[217.16.10.3]:25, delay=0.53, delays=0.04/0/0.42/0.07, dsn=5.1.1, status=bounced (host mail.athoise.com[217.16.10.3] said: 550 5.1.1 <[email protected]>: Recipient address rejected: User unknown in virtual mailbox table (in reply to RCPT TO command))
Jul 11 16:43:28 stock postfix/qmgr[15611]: 2D55610D3EE: removed
Jul 11 16:45:09 stock postfix/qmgr[15611]: C836D10D3AA: from=<>, size=15048, nrcpt=1 (queue active)
Jul 11 16:45:40 stock postfix/smtp[31836]: connect to syad.net[208.91.197.27]:25: Connection timed out
Jul 11 16:45:40 stock postfix/smtp[31836]: C836D10D3AA: to=<[email protected]>, relay=none, delay=424757, delays=424727/0.02/30/0, dsn=4.4.1, status=deferred (connect to syad.net[208.91.197.27]:25: Connection timed out)
Jul 11 16:45:48 stock postfix/anvil[31682]: statistics: max connection rate 1/60s for (smtp:92.84.169.239) at Jul 11 16:42:27
Jul 11 16:45:48 stock postfix/anvil[31682]: statistics: max connection count 1 for (smtp:92.84.169.239) at Jul 11 16:42:27
Jul 11 16:45:48 stock postfix/anvil[31682]: statistics: max cache size 1 at Jul 11 16:42:27
Jul 11 16:50:09 stock postfix/qmgr[15611]: AC61110D254: from=<[email protected]>, size=54804, nrcpt=1 (queue active)
Jul 11 16:50:57 stock postfix/smtp[32061]: AC61110D254: host gmail-smtp-in.l.google.com[2a00:1450:400c:c05::1b] said: 421-4.7.0 [2001:41d0:2:a9e5::1 15] Our system has detected an unusual rate 421-4.7.0 of unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. ej4si5267528wid.3 - gsmtp (in reply to end of DATA command)
Jul 11 16:51:42 stock postfix/smtp[32061]: AC61110D254: to=<MY REAL EMAIL ADDRESS WAS HERE>, orig_to=<MY REAL EMAIL ADDRESS WAS HERE>, relay=gmail-smtp-in.l.google.com[173.194.67.26]:25, delay=1438, delays=1345/0.02/62/32, dsn=4.7.0, status=deferred (host gmail-smtp-in.l.google.com[173.194.67.26] said: 421-4.7.0 [188.165.222.229 15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. fr7si4416957wib.79 - gsmtp (in reply to end of DATA command))
Jul 11 16:55:09 stock postfix/qmgr[15611]: 51C0910D03F: from=<[email protected]>, size=55141, nrcpt=1 (queue active)
Jul 11 16:55:38 stock postfix/smtp[32284]: 51C0910D03F: host gmail-smtp-in.l.google.com[2a00:1450:400c:c05::1a] said: 421-4.7.0 [2001:41d0:2:a9e5::1 15] Our system has detected an unusual rate 421-4.7.0 of unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. pi9si4491273wjb.81 - gsmtp (in reply to end of DATA command)
Jul 11 16:56:09 stock postfix/smtp[32284]: 51C0910D03F: to=<MY REAL EMAIL ADDRESS WAS HERE>, orig_to=<MY REAL EMAIL ADDRESS WAS HERE>, relay=gmail-smtp-in.l.google.com[173.194.67.26]:25, delay=80376, delays=80316/0.02/50/11, dsn=4.7.0, status=deferred (host gmail-smtp-in.l.google.com[173.194.67.26] said: 421-4.7.0 [188.165.222.229 15] Our system has detected an unusual rate of 421-4.7.0 unsolicited mail originating from your IP address. To protect our 421-4.7.0 users from spam, mail sent from your IP address has been temporarily 421-4.7.0 rate limited. Please visit 421-4.7.0 http://www.google.com/mail/help/bulk_mail.html to review our Bulk 421 4.7.0 Email Senders Guidelines. hj12si4501206wib.8 - gsmtp (in reply to end of DATA command))
Jul 11 17:00:09 stock postfix/qmgr[15611]: 64DEB10D2B9: from=<>, size=4743, nrcpt=1 (queue active)
Jul 11 17:00:11 stock postfix/smtp[32552]: 64DEB10D2B9: to=<[email protected]>, relay=none, delay=84582, delays=84580/0.02/1.9/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=primesentry.com type=MX: Host not found, try again)
Jul 11 17:05:49 stock dovecot: pop3-login: Disconnected (tried to use disabled plaintext auth): rip=92.45.136.23, lip=188.165.222.229
Jul 11 17:06:17 stock dovecot: pop3-login: Disconnected (tried to use disabled plaintext auth): rip=92.45.136.23, lip=188.165.222.229
Jul 11 17:10:09 stock postfix/qmgr[15611]: 3E11910D212: from=<[email protected]>, size=58247, nrcpt=1 (queue active)
Todos os itens acima são SPAM. Como posso descobrir de onde está sendo enviado? É um buraco no WordPress, é algum script malicioso de alguma forma instalado no meu servidor? É outra coisa?
Qualquer ajuda muito apreciada. Obrigado.
No seu registro, parece que as mensagens foram originalmente enviadas para um endereço de e-mail no seu servidor, que está configurado para encaminhar para um endereço do Gmail.
Como as mensagens são spam, elas estão sendo vistas assim quando você as envia de volta.
Minha recomendação seria não encaminhar as mensagens dessa maneira, e simplesmente recebê-las aqui e lidar com elas aqui. A maioria de nós tem vários endereços de e-mail para lidar, e isso não é muito inconveniente.