You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rodney Richison <ro...@rcrcomputing.com> on 2004/06/22 15:51:54 UTC
help reading logs - stop spam run
Have found in my postfix logs where someone is sending one email to alot
of non-existant users. This domain is not on the local machine. Thus,
this machine accepts the mail and attempts to deliver it.
I've two questions.
Which ip sent it?
65.100.126.213? Determined by the 8BD3844165?
Ideas on how to stop it
Logs below.
*****
Jun 21 16:22:07 lists postfix/smtpd[19397]: connect from 65-100-126-213.albq.qwest.net[65.100.126.213]
Jun 21 16:22:07 lists postfix/smtpd[19397]: 8BD3844165: client=65-100-126-213.albq.qwest.net[65.100.126.213]
Jun 21 16:22:11 lists postfix/smtpd[19289]: disconnect from intm-dl.sparklist.com[64.62.197.83]
Jun 21 16:22:12 lists postfix/cleanup[19398]: 8BD3844165: message-id=<df...@dslextreme.com>
Jun 21 16:22:12 lists postfix/qmgr[1094]: 8BD3844165: from=<xe...@dslextreme.com>, size=887, nrcpt=40 (queue active)
Jun 21 16:22:12 lists postfix/smtpd[19397]: disconnect from 65-100-126-213.albq.qwest.net[65.100.126.213]
Jun 21 16:22:12 lists postfix/smtpd[19289]: connect from cw-1-mx-232.knllc.net[208.128.178.232]
Jun 21 16:22:13 lists postfix/smtpd[19289]: 0B2B644166: client=cw-1-mx-232.knllc.net[208.128.178.232]
Jun 21 16:22:13 lists postfix/cleanup[19398]: 0B2B644166: message-id=<20...@lists.rcrnet.net>
Jun 21 16:22:13 lists postfix/qmgr[1094]: 0B2B644166: from=<pa...@curvycrutch.com>, size=2414, nrcpt=1 (queue active)
Jun 21 16:22:13 lists postfix/smtpd[19289]: disconnect from cw-1-mx-232.knllc.net[208.128.178.232]
Jun 21 16:22:14 lists postfix/smtpd[19352]: connect from localhost.localdomain[127.0.0.1]
Jun 21 16:22:14 lists postfix/smtpd[19352]: 589B344167: client=localhost.localdomain[127.0.0.1]
Jun 21 16:22:14 lists postfix/cleanup[19398]: 589B344167: message-id=<df...@dslextreme.com>
Jun 21 16:22:14 lists postfix/qmgr[1094]: 589B344167: from=<xe...@dslextreme.com>, size=1100, nrcpt=40 (queue active)
Jun 21 16:22:14 lists postfix/smtpd[19352]: disconnect from localhost.localdomain[127.0.0.1]
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<0....@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<ac...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<ac...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<BA...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<BK...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<Bo...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<bo...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<cr...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<da...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<da...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<DK...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<dp...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<el...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<g....@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<ho...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<ia...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<jb...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<jr...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<mg...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<ml...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<Or...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<or...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<PB...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<ra...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<RB...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<ro...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<Sw...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<TS...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<tu...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165: to=<wa...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<0....@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '0.02AF26EA@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3DBK31@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3DBobbieSueL@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3DDKSTint@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3Dg.j.beckvermit@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3DPBoffa4843@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3DRBosler2@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3DSwansales@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3DTSteele39@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3Dturtlesue34@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for '3Dwarrenet@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<ac...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'accounting@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<ac...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'actravel@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<BA...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'BAY1-F301hMMmWgrA6e0001181b@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<BK...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'BK31@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<Bo...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'BobbieSueL@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<bo...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'bounced-oum-54527480-1570@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<cr...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'cra@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<da...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'dac@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<da...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'dad@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<DK...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'DKSTint@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<dp...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'dp@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<el...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'eleniotto@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<g....@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'g.j.beckvermit@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<ho...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'hotelandtravelindex@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<ia...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'ia@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<jb...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'jbaxter@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<jr...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'jrb@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<mg...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'mgm@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<ml...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'mlb@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<Or...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'OrderExchanges@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<or...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'orders@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<PB...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'PBoffa4843@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<ra...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'ranchlml@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<RB...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'RBosler2@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<ro...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'rockiestix@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<Sw...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'Swansales@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<TS...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'TSteele39@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<tu...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'turtlesue34@rcrnet.net' (in reply to RCPT TO command))
Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167: to=<wa...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local mailbox for 'warrenet@rcrnet.net' (in reply to RCPT TO command))
--
------------------------------------
Rodney Richison
rodney@rcrcomputing.com
118 N. Broadway
PO Box 566
Cleveland, OK 74020
RCR Computing - RCRnet
http://www.rcrnet.net
tel: 918-358-1111
fax: 918-358-1112
------------------------------------
Re: help reading logs - stop spam run
Posted by Ralf Guenthner <gu...@alphatel.de>.
> Have found in my postfix logs where someone is sending one email to alot
> of non-existant users. This domain is not on the local machine. Thus,
> this machine accepts the mail and attempts to deliver it.
If the domain in question is not on your server, why is it trying to
deliver the mails? That would make this server an open relay and you
should fix that ASAP. Or maybe I'm missing the context here??
Regards
Ralf G.
Re: help reading logs - stop spam run
Posted by Andy <an...@stronzo.d2g.com>.
Ohohoh,
you should rapidly change your setup of Postfix. These mails which are
mentioned in "sent" are all bounces of your Postfix, containing probably
some sort of worms like sober etc.
Postfix in versions below 2.x (don't know exactly) bounces all messages to
unknown local users _with_ (!!!) attachments.
So if somebody faked the sending adress, this faked sender will get the
worms!
I tell you this because I had this shit some weeks ago too.
Solution:
-Upgrade Postfix
-define local_recipient_maps (--> postfix.org)
-in addition you can limit the size of bounces to something like 3KB or so:
bounce_size_limit = 3000 (in main.cf, available at Postfix 2.+)
HTH,
Andy
Quoting Rodney Richison <ro...@rcrcomputing.com>:
> Have found in my postfix logs where someone is sending one email to alot
> of non-existant users. This domain is not on the local machine. Thus,
> this machine accepts the mail and attempts to deliver it.
>
> I've two questions.
> Which ip sent it?
>
> 65.100.126.213? Determined by the 8BD3844165?
>
> Ideas on how to stop it
>
> Logs below.
> *****
>
> Jun 21 16:22:07 lists postfix/smtpd[19397]: connect from
> 65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:07 lists postfix/smtpd[19397]: 8BD3844165:
> client=65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:11 lists postfix/smtpd[19289]: disconnect from
> intm-dl.sparklist.com[64.62.197.83]
>
> Jun 21 16:22:12 lists postfix/cleanup[19398]: 8BD3844165:
> message-id=<df...@dslextreme.com>
> Jun 21 16:22:12 lists postfix/qmgr[1094]: 8BD3844165:
> from=<xe...@dslextreme.com>, size=887, nrcpt=40 (queue active)
> Jun 21 16:22:12 lists postfix/smtpd[19397]: disconnect from
> 65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:12 lists postfix/smtpd[19289]: connect from
> cw-1-mx-232.knllc.net[208.128.178.232]
> Jun 21 16:22:13 lists postfix/smtpd[19289]: 0B2B644166:
> client=cw-1-mx-232.knllc.net[208.128.178.232]
> Jun 21 16:22:13 lists postfix/cleanup[19398]: 0B2B644166:
> message-id=<20...@lists.rcrnet.net>
> Jun 21 16:22:13 lists postfix/qmgr[1094]: 0B2B644166:
> from=<pa...@curvycrutch.com>, size=2414, nrcpt=1 (queue active)
> Jun 21 16:22:13 lists postfix/smtpd[19289]: disconnect from
> cw-1-mx-232.knllc.net[208.128.178.232]
> Jun 21 16:22:14 lists postfix/smtpd[19352]: connect from
> localhost.localdomain[127.0.0.1]
> Jun 21 16:22:14 lists postfix/smtpd[19352]: 589B344167:
> client=localhost.localdomain[127.0.0.1]
> Jun 21 16:22:14 lists postfix/cleanup[19398]: 589B344167:
> message-id=<df...@dslextreme.com>
> Jun 21 16:22:14 lists postfix/qmgr[1094]: 589B344167:
> from=<xe...@dslextreme.com>, size=1100, nrcpt=40 (queue active)
> Jun 21 16:22:14 lists postfix/smtpd[19352]: disconnect from
> localhost.localdomain[127.0.0.1]
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<0....@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1],
> delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok:
> queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ac...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ac...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<BA...@rcrnet.net>,
> relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok,
> id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<BK...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<Bo...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<bo...@rcrnet.net>,
> relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok,
> id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<cr...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<da...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<da...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<DK...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<dp...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<el...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<g....@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ho...@rcrnet.net>, relay=localhost[127.0.0.1],
> delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok:
> queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ia...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<jb...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<jr...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<mg...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ml...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<Or...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<or...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<PB...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ra...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<RB...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ro...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<Sw...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<TS...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<tu...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<wa...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<0....@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '0.02AF26EA@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for '3DBK31@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DBobbieSueL@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DDKSTint@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3Dg.j.beckvermit@rcrnet.net' (in reply to RCPT
> TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DPBoffa4843@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DRBosler2@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DSwansales@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DTSteele39@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3Dturtlesue34@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3Dwarrenet@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ac...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'accounting@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ac...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'actravel@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<BA...@rcrnet.net>,
> relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host
> 65.16.101.124[65.16.101.124] said: 503 No local mailbox for
> 'BAY1-F301hMMmWgrA6e0001181b@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<BK...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'BK31@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<Bo...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'BobbieSueL@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<bo...@rcrnet.net>,
> relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host
> 65.16.101.124[65.16.101.124] said: 503 No local mailbox for
> 'bounced-oum-54527480-1570@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<cr...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'cra@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<da...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'dac@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<da...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'dad@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<DK...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'DKSTint@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<dp...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'dp@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<el...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'eleniotto@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<g....@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'g.j.beckvermit@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ho...@rcrnet.net>,
> relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host
> 65.16.101.124[65.16.101.124] said: 503 No local mailbox for
> 'hotelandtravelindex@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ia...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'ia@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<jb...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'jbaxter@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<jr...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'jrb@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<mg...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'mgm@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ml...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'mlb@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<Or...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'OrderExchanges@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<or...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'orders@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<PB...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'PBoffa4843@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ra...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'ranchlml@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<RB...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'RBosler2@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ro...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'rockiestix@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<Sw...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'Swansales@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<TS...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'TSteele39@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<tu...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'turtlesue34@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<wa...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'warrenet@rcrnet.net' (in reply to RCPT TO
> command))
>
>
> --
>
>
> ------------------------------------
> Rodney Richison
> rodney@rcrcomputing.com
> 118 N. Broadway
> PO Box 566
> Cleveland, OK 74020
>
> RCR Computing - RCRnet
> http://www.rcrnet.net
> tel: 918-358-1111
> fax: 918-358-1112
> ------------------------------------
>
was: Re: help reading logs - stop spam run now: ...then unblock
dyn-IPs.......
Posted by Andy <an...@stronzo.d2g.com>.
And, Rodney, blocking whole DynIP-ranges makes no big sense, especially with
a well working setup of spamassassin in combination with amavisd-new or
similar.
My answer to you so would never reach you:
This is the Postfix program at host stronzo.d2g.com.
I'm sorry to have to inform you that your message could not be
be delivered .........
<ro...@rcrcomputing.com>: host lists.rcrnet.net[65.16.101.126] said: 554
Service unavailable; Client host [80.131.95.228] blocked using
dul.dnsbl.sorbs.net; Dynamic IP Address See:
http://www.dnsbl.sorbs.net/cgi-bin/lookup?IP=80.131.95.228 (in reply to
RCPT TO command)
This topic is somewhat elder, but more and more urgent.
Andy
Received: from localhost (unknown [127.0.0.1])
by stronzo.d2g.com (Postfix) with ESMTP id 7DF3124253;
Tue, 22 Jun 2004 17:53:13 +0200 (CEST)
Received: from stronzo.d2g.com ([127.0.0.1])
by localhost (kowalski [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
id 08324-01; Tue, 22 Jun 2004 17:53:12 +0200 (CEST)
Received: from localhost (unknown [127.0.0.1])
by stronzo.d2g.com (Postfix) with ESMTP id 66E6324251;
Tue, 22 Jun 2004 17:53:12 +0200 (CEST)
Received: from work (work [192.168.0.1]) by stronzo.d2g.com (Horde) with
HTTP for <an...@stronzo.d2g.com>; Tue, 22 Jun 2004 17:53:12 +0200
Message-ID: <20...@stronzo.d2g.com>
Date: Tue, 22 Jun 2004 17:53:12 +0200
From: Andy <an...@stronzo.d2g.com>
To: Rodney Richison <ro...@rcrcomputing.com>
Cc: spamassassin <sp...@incubator.apache.org>
Subject: Re: help reading logs - stop spam run
References: <40...@rcrcomputing.com>
In-Reply-To: <40...@rcrcomputing.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
User-Agent: Internet Messaging Program (IMP) 4.0-cvs
X-Virus-Scanned: by amavisd-new at stronzo.d2g.com
Ohohoh,
you should rapidly change your setup of Postfix. These mails which are
mentioned in "sent" are all bounces of your Postfix, containing probably
some sort of worms like sober etc.
Postfix in versions below 2.x (don't know exactly) bounces all messages to
unknown local users _with_ (!!!) attachments.
So if somebody faked the sending adress, this faked sender will get the
worms!
I tell you this because I had this shit some weeks ago too.
Solution:
-Upgrade Postfix
-define local_recipient_maps (--> postfix.org)
-in addition you can limit the size of bounces to something like 3KB or so:
bounce_size_limit = 3000 (in main.cf, available at Postfix 2.+)
HTH,
Andy
Quoting Rodney Richison <ro...@rcrcomputing.com>:
> Have found in my postfix logs where someone is sending one email to alot
> of non-existant users. This domain is not on the local machine. Thus,
> this machine accepts the mail and attempts to deliver it.
>
> I've two questions.
> Which ip sent it?
>
> 65.100.126.213? Determined by the 8BD3844165?
>
> Ideas on how to stop it
>
> Logs below.
> *****
>
> Jun 21 16:22:07 lists postfix/smtpd[19397]: connect from
> 65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:07 lists postfix/smtpd[19397]: 8BD3844165:
> client=65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:11 lists postfix/smtpd[19289]: disconnect from
> intm-dl.sparklist.com[64.62.197.83]
>
> Jun 21 16:22:12 lists postfix/cleanup[19398]: 8BD3844165:
> message-id=<df...@dslextreme.com>
> Jun 21 16:22:12 lists postfix/qmgr[1094]: 8BD3844165:
> from=<xe...@dslextreme.com>, size=887, nrcpt=40 (queue active)
> Jun 21 16:22:12 lists postfix/smtpd[19397]: disconnect from
Quoting Rodney Richison <ro...@rcrcomputing.com>:
> Have found in my postfix logs where someone is sending one email to alot
> of non-existant users. This domain is not on the local machine. Thus,
> this machine accepts the mail and attempts to deliver it.
>
> I've two questions.
> Which ip sent it?
>
> 65.100.126.213? Determined by the 8BD3844165?
>
> Ideas on how to stop it
>
> Logs below.
> *****
>
> Jun 21 16:22:07 lists postfix/smtpd[19397]: connect from
> 65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:07 lists postfix/smtpd[19397]: 8BD3844165:
> client=65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:11 lists postfix/smtpd[19289]: disconnect from
> intm-dl.sparklist.com[64.62.197.83]
>
> Jun 21 16:22:12 lists postfix/cleanup[19398]: 8BD3844165:
> message-id=<df...@dslextreme.com>
> Jun 21 16:22:12 lists postfix/qmgr[1094]: 8BD3844165:
> from=<xe...@dslextreme.com>, size=887, nrcpt=40 (queue active)
> Jun 21 16:22:12 lists postfix/smtpd[19397]: disconnect from
> 65-100-126-213.albq.qwest.net[65.100.126.213]
> Jun 21 16:22:12 lists postfix/smtpd[19289]: connect from
> cw-1-mx-232.knllc.net[208.128.178.232]
> Jun 21 16:22:13 lists postfix/smtpd[19289]: 0B2B644166:
> client=cw-1-mx-232.knllc.net[208.128.178.232]
> Jun 21 16:22:13 lists postfix/cleanup[19398]: 0B2B644166:
> message-id=<20...@lists.rcrnet.net>
> Jun 21 16:22:13 lists postfix/qmgr[1094]: 0B2B644166:
> from=<pa...@curvycrutch.com>, size=2414, nrcpt=1 (queue active)
> Jun 21 16:22:13 lists postfix/smtpd[19289]: disconnect from
> cw-1-mx-232.knllc.net[208.128.178.232]
> Jun 21 16:22:14 lists postfix/smtpd[19352]: connect from
> localhost.localdomain[127.0.0.1]
> Jun 21 16:22:14 lists postfix/smtpd[19352]: 589B344167:
> client=localhost.localdomain[127.0.0.1]
> Jun 21 16:22:14 lists postfix/cleanup[19398]: 589B344167:
> message-id=<df...@dslextreme.com>
> Jun 21 16:22:14 lists postfix/qmgr[1094]: 589B344167:
> from=<xe...@dslextreme.com>, size=1100, nrcpt=40 (queue active)
> Jun 21 16:22:14 lists postfix/smtpd[19352]: disconnect from
> localhost.localdomain[127.0.0.1]
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<0....@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1],
> delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok:
> queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<3D...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ac...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ac...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<BA...@rcrnet.net>,
> relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok,
> id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<BK...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<Bo...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<bo...@rcrnet.net>,
> relay=localhost[127.0.0.1], delay=7, status=sent (250 2.6.0 Ok,
> id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<cr...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<da...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<da...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<DK...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<dp...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<el...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<g....@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ho...@rcrnet.net>, relay=localhost[127.0.0.1],
> delay=7, status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok:
> queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ia...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<jb...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<jr...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<mg...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ml...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7, status=sent
> (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<Or...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<or...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<PB...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ra...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<RB...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<ro...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<Sw...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<TS...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<tu...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19348]: 8BD3844165:
> to=<wa...@rcrnet.net>, relay=localhost[127.0.0.1], delay=7,
> status=sent (250 2.6.0 Ok, id=19224-06, from MTA: 250 Ok: queued as
> 589B344167)
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<0....@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '0.02AF26EA@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for '3DBK31@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DBobbieSueL@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DDKSTint@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3Dg.j.beckvermit@rcrnet.net' (in reply to RCPT
> TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DPBoffa4843@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DRBosler2@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DSwansales@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3DTSteele39@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3Dturtlesue34@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<3D...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for '3Dwarrenet@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ac...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'accounting@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ac...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'actravel@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<BA...@rcrnet.net>,
> relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host
> 65.16.101.124[65.16.101.124] said: 503 No local mailbox for
> 'BAY1-F301hMMmWgrA6e0001181b@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<BK...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'BK31@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<Bo...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'BobbieSueL@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<bo...@rcrnet.net>,
> relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host
> 65.16.101.124[65.16.101.124] said: 503 No local mailbox for
> 'bounced-oum-54527480-1570@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<cr...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'cra@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<da...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'dac@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<da...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'dad@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<DK...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'DKSTint@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<dp...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'dp@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<el...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'eleniotto@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<g....@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'g.j.beckvermit@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ho...@rcrnet.net>,
> relay=65.16.101.124[65.16.101.124], delay=0, status=bounced (host
> 65.16.101.124[65.16.101.124] said: 503 No local mailbox for
> 'hotelandtravelindex@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ia...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'ia@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<jb...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'jbaxter@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<jr...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'jrb@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<mg...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'mgm@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ml...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'mlb@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<Or...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'OrderExchanges@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<or...@rcrnet.net>, relay=65.16.101.124[65.16.101.124], delay=0,
> status=bounced (host 65.16.101.124[65.16.101.124] said: 503 No local
> mailbox for 'orders@rcrnet.net' (in reply to RCPT TO command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<PB...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'PBoffa4843@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ra...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'ranchlml@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<RB...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'RBosler2@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<ro...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'rockiestix@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<Sw...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'Swansales@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<TS...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'TSteele39@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<tu...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'turtlesue34@rcrnet.net' (in reply to RCPT TO
> command))
> Jun 21 16:22:14 lists postfix/smtp[19407]: 589B344167:
> to=<wa...@rcrnet.net>, relay=65.16.101.124[65.16.101.124],
> delay=0, status=bounced (host 65.16.101.124[65.16.101.124] said: 503
> No local mailbox for 'warrenet@rcrnet.net' (in reply to RCPT TO
> command))
>
>
> --
>
>
> ------------------------------------
> Rodney Richison
> rodney@rcrcomputing.com
> 118 N. Broadway
> PO Box 566
> Cleveland, OK 74020
>
> RCR Computing - RCRnet
> http://www.rcrnet.net
> tel: 918-358-1111
> fax: 918-358-1112
> ------------------------------------
>
Re: help reading logs - stop spam run
Posted by Steve Prior <sp...@geekster.com>.
Sounds like your machine is an open email relay and should be powered
off until you figure out how to properly administer it. You should never accept
email from a non local machine (unless you've made a specific exception)
for delivery to a machine that isn't yours - machines that allow this are
a large conduit of spam on the net.
Steve
Rodney Richison wrote:
> Have found in my postfix logs where someone is sending one email to alot
> of non-existant users. This domain is not on the local machine. Thus,
> this machine accepts the mail and attempts to deliver it.
>
> I've two questions.
> Which ip sent it?
> 65.100.126.213? Determined by the 8BD3844165?
>
> Ideas on how to stop it