Dotaz: Server využívaný pro rozesílání SPAMU

[halva-jr]

Dobrý den,

pár dní zpátky někda začal pravděpodobně náš server využívat k rozesílání SPAMU. Vypadá to, že od soboty. Za den je totiž rozeslaných cca 12 000 e-mailů a to určitě není správně. Můžete mi prosím poradit co a jak nastavit nainstalovat pro zamezení. Provider už nadává a vyhrožuje odpojením, což se mu ani nedivím. Používám debian squeeze, postfix, antivir clamav.

Díky za pomoc

Odpovědi

[ebik]

Odeslaných z postfixu? Jestli to posílají přes postfix (z venku), tak vypnout a naučit se jak si nastavit SMTP server tak aby nebyl Open Relay. (Prostě SMTP smí odesílat do světa zprávy pouze ověřených uživatelů (do vnitřní sítě ať přijímá co chce))

Pokud to přes ten postfix jde z vnitřní sítě, tak odvirovat počítač, který tomu postfixu ty majly dává, eventuelně zabezpečit odesílání pošty tak, aby se uživatelé z vnitřní sítě museli ověřovat.

Pokud to jde přímo z toho serveru (ať už přes postfix nebo přímo), tak zjistit kdo to spustil - buď vám to někdo hacknul, nebo máte správce, který chce spam rozesílat.

Prostě vámi podané informace rozhodně na popis situace nestačí.

[halva-jr]

Odeslaných z postfixu? Jestli to posílají přes postfix (z venku), tak vypnout a naučit se jak si nastavit SMTP server tak aby nebyl Open Relay. (Prostě SMTP smí odesílat do světa zprávy pouze ověřených uživatelů (do vnitřní sítě ať přijímá co chce))

Je to odeslané z postfixu, ale Open Relay by mělo být zakázané.

Pokud to přes ten postfix jde z vnitřní sítě, tak odvirovat počítač, který tomu postfixu ty majly dává, eventuelně zabezpečit odesílání pošty tak, aby se uživatelé z vnitřní sítě museli ověřovat.

Ale jak přijdu na to, který to posílá?

Pokud to jde přímo z toho serveru (ať už přes postfix nebo přímo), tak zjistit kdo to spustil - buď vám to někdo hacknul, nebo máte správce, který chce spam rozesílat.

Jediný administrátor jsem já osobně a vím stoprocentně že jsem nic nespustil.

[Jendа]

Ale jak přijdu na to, který to posílá?

Podíváš se do logu… /var/log/mail.log

[halva-jr]

OK USA Už je mám stažený takže projdu.

[halva-jr]

Tak procházím logy a úplně moudrý z toho nejsem Jsou tam nějaký www-data, ale že by to byly jen weby to se říct nedá. Je toho teda kupa, to zas jo. Schválně Vám posílám jednu minutu Jestli vy z toho budete moudřejší. Já z toho moc nevyčetl.

Díky

Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7946047853: from=www-data@server2.org, size=5031, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/smtp[18058]:	connect to cluster5.eu.messagelabs.com[85.158.139.163]:25: Connection refused
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7EB1518D03C: from=www-data@server2.org, size=5020, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	75A7B18C7F3: from=www-data@server2.org, size=5071, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7C8E546E1C: from=www-data@server2.org, size=5511, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7791846D32: from=www-data@server2.org, size=5490, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	70B3818C9BD: from=www-data@server2.org, size=5061, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7BA6046E75: from=www-data@server2.org, size=5511, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7DCCF467B8: from=www-data@server2.org, size=5072, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	743C246A8E: from=www-data@server2.org, size=5066, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7052547959: from=www-data@server2.org, size=5013, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7DEFC46611: from=www-data@server2.org, size=5049, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7A2F418C1FB: from=www-data@server2.org, size=5079, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/smtp[18067]:	connect to cluster5.eu.messagelabs.com[85.158.136.83]:25: Connection refused
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	74144471C7: from=www-data@server2.org, size=5520, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7E0B218C21A: from=www-data@server2.org, size=5040, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	7A44218C2D9: from=www-data@server2.org, size=5040, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/bounce[18048	]: 93364470EC: sender non-delivery notification: 52E9B465EA
Dec	16	11:56:00	server2	postfix/smtp[18057]:	6ABB8468C5: to=k.arkinstall@tiscali.co.uk, relay=mxgb1.opaltelecom.net[62.24.139.61]:25, delay=4662, delays=4661/0.98/0.13/0, dsn=4.0.0, status=deferred (host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx7gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:00	server2	postfix/error[18027]	: C374F46DA2: to=geggman1@bellsouth.net, relay=none, delay=92965, delays=92965/0.01/0/0.3, dsn=4.0.0, status=deferred (delivery temporarily suspended: host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 550-212.96.185.188 blocked by ldap:ou=rblmx,dc=att,dc=net 550 Error - Blocked for abuse. See http://att.net/blocks)
Dec	16	11:56:00	server2	postfix/smtp[18045]:	B49E8470F7: to=k.scott@downslaw.co.uk, relay=cluster5.eu.messagelabs.com[85.158.138.179]:25, delay=4514, delays=4513/0.8/0.27/0.33, dsn=5.0.0, status=bounced (host cluster5.eu.messagelabs.com[85.158.138.179] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	93364470EC: removed
Dec	16	11:56:00	server2	postfix/smtp[18070]:	connect to cluster8.eu.messagelabs.com[85.158.140.211]:25: Connection refused
Dec	16	11:56:00	server2	postfix/cleanup[1805	2]: 22644465E7: message-id=20131216105600.22644465E7@server2.halva.org
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	52E9B465EA: from=, size=7540, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/error[18030]	: CFC6F18C2AC: to=geford2@bellsouth.net, relay=none, delay=92971, delays=92971/0.01/0/0.33, dsn=4.0.0, status=deferred (delivery temporarily suspended: host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 550-212.96.185.188 blocked by ldap:ou=rblmx,dc=att,dc=net 550 Error - Blocked for abuse. See http://att.net/blocks)
Dec	16	11:56:00	server2	postfix/error[18032]	: 2BA1846CFC: to=genasmith@bellsouth.net, relay=none, delay=92797, delays=92797/0/0/0.27, dsn=4.0.0, status=deferred (delivery temporarily suspended: host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 550-212.96.185.188 blocked by ldap:ou=rblmx,dc=att,dc=net 550 Error - Blocked for abuse. See http://att.net/blocks)
Dec	16	11:56:00	server2	postfix/smtp[18046]:	B2CB046E6A: to=k.cleminson@fnc.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.3]:25, delay=4631, delays=4630/0.81/0.38/0.34, dsn=5.0.0, status=bounced (host cluster8.eu.messagelabs.com[85.158.137.3] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:00	server2	postfix/smtp[18037]:	B47744712C: to=k.sperous@gmail.tv, relay=none, delay=4502, delays=4501/0.9/0.73/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=gmail.tv type=MX: Host not found, try again)
Dec	16	11:56:00	server2	postfix/smtp[18051]:	66C8846F7D: to=k.phillips@bathchron.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.3]:25, delay=4533, delays=4531/0.94/0.41/0.44, dsn=5.0.0, status=bounced (host cluster8.eu.messagelabs.com[85.158.137.3] said: 550 Invalid recipient k.phillips@bathchron.co.uk (#5.1.1) (in reply to RCPT TO command))
Dec	16	11:56:00	server2	postfix/error[18069]	: 257E646DEB: to=gemh@bellsouth.net, relay=none, delay=92893, delays=92893/0.09/0/0.16, dsn=4.0.0, status=deferred (delivery temporarily suspended: host gateway-f1.isp.att.net[204.127.217.16] refused to talk to me: 550-212.96.185.188 blocked by ldap:ou=rblmx,dc=att,dc=net 550 Error - Blocked for abuse. See http://att.net/blocks)
Dec	16	11:56:00	server2	postfix/smtp[18038]:	BF77847039: to=k.middleton@googlemail.co.uk, relay=none, delay=4548, delays=4547/0.92/0.76/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=googlemail.co.uk type=MX: Host not found, try again)
Dec	16	11:56:00	server2	postfix/smtp[18072]:	connect to cluster2.eu.messagelabs.com[85.158.136.51]:25: Connection refused
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	22644465E7: from=, size=7698, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/bounce[18048	]: B49E8470F7: sender non-delivery notification: 22644465E7
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	B49E8470F7: removed
Dec	16	11:56:00	server2	postfix/cleanup[1805	2]: 38993465EC: message-id=20131216105600.38993465EC@server2.halva.org
Dec	16	11:56:00	server2	postfix/smtp[18041]:	connect to suse.be[130.57.5.70]:25: Connection refused
Dec	16	11:56:00	server2	postfix/cleanup[1808	3]: 42099465FD: message-id=20131216105600.42099465FD@server2.halva.org
Dec	16	11:56:00	server2	postfix/smtp[18053]:	6674A46631: to=k.elder@hackingashton.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.3]:25, delay=4619, delays=4617/0.98/0.58/0.33, dsn=2.0.0, status=sent (250 ok 1387191360 qp 5587 server-9.tower-38.messagelabs.com!1387191359!3153213!1)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	6674A46631: removed
Dec	16	11:56:00	server2	postfix/bounce[18060	]: B2CB046E6A: sender non-delivery notification: 38993465EC
Dec	16	11:56:00	server2	postfix/smtp[18080]:	connect to cluster5.eu.messagelabs.com[193.109.254.3]:25: Connection refused
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	42099465FD: from=, size=7554, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	B2CB046E6A: removed
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	38993465EC: from=, size=7690, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/local[18077]	: 52E9B465EA: to=www-data@server2.org, relay=local, delay=1.1, delays=0.86/0.07/0/0.15, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	52E9B465EA: removed
Dec	16	11:56:00	server2	postfix/bounce[18068	]: 66C8846F7D: sender non-delivery notification: 42099465FD
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	66C8846F7D: removed
Dec	16	11:56:00	server2	postfix/smtp[18041]:	636B547137: to=k.slepliebliern@suse.be, relay=none, delay=4508, delays=4506/1.5/0.36/0, dsn=4.4.1, status=deferred (connect to suse.be[130.57.5.70]:25: Connection refused)
Dec	16	11:56:00	server2	postfix/smtp[18084]:	connect to london.com[204.74.99.100]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18053]:	connect to cluster8.eu.messagelabs.com[85.158.139.51]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18061]:	6BF2146DA8: to=k.rawlinson@independent.co.uk, relay=cluster5.eu.messagelabs.com[85.158.138.179]:25, delay=4524, delays=4522/1.4/0.23/0.25, dsn=5.0.0, status=bounced (host cluster5.eu.messagelabs.com[85.158.138.179] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:00	server2	postfix/smtp[18058]:	6D13D46B79: to=k.guest@independent.co.uk, relay=cluster5.eu.messagelabs.com[85.158.138.179]:25, delay=4603, delays=4601/1.4/0.33/0.23, dsn=5.0.0, status=bounced (host cluster5.eu.messagelabs.com[85.158.138.179] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:00	server2	postfix/cleanup[1805	2]: 67E3C465EA: message-id=20131216105600.67E3C465EA@server2.halva.org
Dec	16	11:56:00	server2	postfix/cleanup[1808	3]: 68E7E465F6: message-id=20131216105600.68E7E465F6@server2.halva.org
Dec	16	11:56:00	server2	postfix/smtp[18053]:	connect to cluster8.eu.messagelabs.com[85.158.139.35]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18076]:	connect to cluster3.eu.messagelabs.com[85.158.136.35]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18041]:	connect to cluster5.eu.messagelabs.com[85.158.139.163]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18084]:	A86D018D085: to=mortons@london.com, relay=none, delay=84487, delays=84485/1.7/0.1/0, dsn=4.4.1, status=deferred (connect to london.com[204.74.99.100]:25: Connection refused)
Dec	16	11:56:00	server2	postfix/local[18082]	: 22644465E7: to=www-data@server2.org, relay=local, delay=0.34, delays=0.03/0.22/0/0.1, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	22644465E7: removed
Dec	16	11:56:00	server2	postfix/smtp[18043]:	B815218C065: host mail.friko.pl[193.203.99.99] said: 451 4.3.0 www-data@server2.org: Temporary lookup failure (in reply to RCPT TO command)
Dec	16	11:56:00	server2	postfix/smtp[18053]:	connect to cluster8.eu.messagelabs.com[85.158.140.195]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18085]:	connect to cluster5.eu.messagelabs.com[85.158.136.83]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18076]:	connect to cluster3.eu.messagelabs.com[85.158.139.3]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18041]:	connect to cluster5.eu.messagelabs.com[85.158.136.83]:25: Connection refused
Dec	16	11:56:00	server2	postfix/bounce[18060	]: 6D13D46B79: sender non-delivery notification: 68E7E465F6
Dec	16	11:56:00	server2	postfix/smtp[18074]:	49AC646D6F: to=k.barker@tiscali.co.uk, relay=mxgb1.opaltelecom.net[62.24.139.61]:25, delay=4656, delays=4654/1.7/0.27/0, dsn=4.0.0, status=deferred (host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx6gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:00	server2	postfix/bounce[18048	]: 6BF2146DA8: sender non-delivery notification: 67E3C465EA
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	6D13D46B79: removed
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	6BF2146DA8: removed
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	67E3C465EA: from=, size=7745, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	68E7E465F6: from=, size=7716, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/smtp[18053]:	connect to cluster8.eu.messagelabs.com[85.158.139.19]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18076]:	connect to cluster3.eu.messagelabs.com[194.106.220.35]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18039]:	950B746E53: host fimx1.d-fence.eu[81.17.201.44] said: 450 4.7.1 jyrki.makinen@noretron.fi: Recipient address rejected: Try again later (in reply to RCPT TO command)
Dec	16	11:56:00	server2	postfix/smtp[18041]:	connect to cluster5.eu.messagelabs.com[193.109.255.99]:25: Connection refused
Dec	16	11:56:00	server2	postfix/local[18082]	: 38993465EC: to=www-data@server2.org, relay=local, delay=0.35, delays=0.16/0.1/0/0.1, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	38993465EC: removed
Dec	16	11:56:00	server2	postfix/smtp[18053]:	connect to cluster8.eu.messagelabs.com[85.158.140.211]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18045]:	connect to novell.com.au[130.57.5.70]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18086]:	connect to suse.be[130.57.5.70]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18045]:	433DB46E7C: to=k.hieyouflour@novell.com.au, relay=none, delay=4592, delays=4590/1.7/0.42/0, dsn=4.4.1, status=deferred (connect to novell.com.au[130.57.5.70]:25: Connection refused)
Dec	16	11:56:00	server2	postfix/smtp[18053]:	A2DA846DAF: to=k.searle@newhallschool.co.uk, relay=none, delay=4514, delays=4512/1.7/0.27/0, dsn=4.4.1, status=deferred (connect to cluster8.eu.messagelabs.com[85.158.140.211]:25: Connection refused)
Dec	16	11:56:00	server2	postfix/local[18082]	: 67E3C465EA: to=www-data@server2.org, relay=local, delay=0.23, delays=0.11/0.04/0/0.07, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	67E3C465EA: removed
Dec	16	11:56:00	server2	postfix/smtp[18067]:	6599B466F2: to=k.greer@alcar.co.uk, relay=cluster5.eu.messagelabs.com[195.245.230.51]:25, delay=4606, delays=4604/1.5/0.23/0.39, dsn=5.0.0, status=bounced (host cluster5.eu.messagelabs.com[195.245.230.51] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:00	server2	postfix/smtp[18086]:	A7144470BF: to=k.seashiew@suse.be, relay=none, delay=4514, delays=4512/1.8/0.23/0, dsn=4.4.1, status=deferred (connect to suse.be[130.57.5.70]:25: Connection refused)
Dec	16	11:56:00	server2	postfix/cleanup[1808	3]: A8918465EA: message-id=20131216105600.A8918465EA@server2.halva.org
Dec	16	11:56:00	server2	postfix/smtp[18099]:	connect to fips.pab.asn-wien.ac.at[193.171.62.57]:25: No route to host
Dec	16	11:56:00	server2	postfix/local[18082]	: 68E7E465F6: to=www-data@server2.org, relay=local, delay=0.32, delays=0.11/0.12/0/0.08, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	68E7E465F6: removed
Dec	16	11:56:00	server2	postfix/smtp[18058]:	A1FD346C95: host smtp-ca.kcn.org.uk[194.80.21.33] refused to talk to me: 554 smtp-ca.kcn.org.uk
Dec	16	11:56:00	server2	postfix/bounce[18048	]: 6599B466F2: sender non-delivery notification: A8918465EA
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	6599B466F2: removed
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	A8918465EA: from=, size=7680, nrcpt=1 (queue active)
Dec	16	11:56:00	server2	postfix/smtp[18080]:	A348F46C59: to=k.dutta@independent.co.uk, relay=cluster5.eu.messagelabs.com[85.158.138.179]:25, delay=4621, delays=4619/1.7/0.24/0.33, dsn=2.0.0, status=sent (250 ok 1387191360 qp 30927 server-5.tower-169.messagelabs.com!1387191360!2420385!1)
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	A348F46C59: removed
Dec	16	11:56:00	server2	postfix/smtp[18057]:	4F59C18D081: to=c.cardno@btopenorld.com, relay=btopenorld.com[98.124.198.1]:25, delay=84485, delays=84483/1.7/0.6/0, dsn=4.4.2, status=deferred (lost connection with btopenorld.com[98.124.198.1] while receiving the initial server greeting)
Dec	16	11:56:00	server2	postfix/smtp[18070]:	6549B46FA6: to=k.clarke@hackingashton.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.19]:25, delay=4632, delays=4630/1.6/0.35/0.34, dsn=5.0.0, status=bounced (host cluster8.eu.messagelabs.com[85.158.137.19] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:00	server2	postfix/smtp[18053]:	DDE1C4701D: to=k.leah@tiscali.co.uk, relay=mxgb1.opaltelecom.net[62.24.139.61]:25, delay=4564, delays=4562/1.9/0.12/0, dsn=4.0.0, status=deferred (host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:00	server2	postfix/cleanup[1805	2]: CD7A3465ED: message-id=20131216105600.CD7A3465ED@server2.halva.org
Dec	16	11:56:00	server2	postfix/smtp[18100]:	DF71718CD6C: to=mimi@tiscali.co.uk, relay=mxgb1.opaltelecom.net[62.24.139.61]:25, delay=84537, delays=84535/1.9/0.11/0, dsn=4.0.0, status=deferred (host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:00	server2	postfix/smtp[18057]:	connect to cluster8.eu.messagelabs.com[85.158.139.35]:25: Connection refused
Dec	16	11:56:00	server2	postfix/smtp[18072]:	4F1F546CE0: to=k-moth@bdp.co.uk, relay=cluster2.eu.messagelabs.com[195.245.230.131]:25, delay=4675, delays=4672/1.6/0.36/0.35, dsn=5.0.0, status=bounced (host cluster2.eu.messagelabs.com[195.245.230.131] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:00	server2	postfix/local[18082]	: A8918465EA: to=www-data@server2.org, relay=local, delay=0.25, delays=0.11/0/0/0.14, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:00	server2	postfix/qmgr[12867]:	A8918465EA: removed
Dec	16	11:56:00	server2	postfix/cleanup[1808	3]: E6B5D465EA: message-id=20131216105600.E6B5D465EA@server2.halva.org
Dec	16	11:56:01	server2	postfix/error[18069]	: 35A4547980: to=adelehowitt@tiscali.co.uk, relay=none, delay=84393, delays=84391/1.5/0/0.16, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/error[18032]	: 373FA46EF9: to=k-bailey@tiscali.co.uk, relay=none, delay=4679, delays=4678/1.1/0/0.15, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/smtp[18074]:	D292546A30: to=jww@onetel.com, relay=mx3.onetel.net.uk[62.24.202.3]:25, delay=4747, delays=4745/1.8/0.35/0, dsn=4.4.2, status=deferred (lost connection with mx3.onetel.net.uk[62.24.202.3] while receiving the initial server greeting)
Dec	16	11:56:01	server2	postfix/error[18030]	: 3C4B318D171: to=beverley.clarke@tiscali.co.uk, relay=none, delay=84492, delays=84491/1.1/0/0.16, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/smtp[18108]:	F3A5746AF6: to=barbro.rodin@tibro.se, relay=vsp.tibro.se[195.198.115.38]:25, delay=160390, delays=160388/1.9/0.11/0, dsn=4.0.0, status=deferred (host vsp.tibro.se[195.198.115.38] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation)
Dec	16	11:56:01	server2	postfix/smtp[18041]:	A215446C07: to=k.bullen@brighton.ac.uk, relay=cluster5.eu.messagelabs.com[195.245.230.51]:25, delay=4643, delays=4641/1.8/0.34/0.27, dsn=5.0.0, status=bounced (host cluster5.eu.messagelabs.com[195.245.230.51] said: 550 Invalid recipient k.bullen@brighton.ac.uk (#5.1.1) (in reply to RCPT TO command))
Dec	16	11:56:01	server2	postfix/error[18027]	: 5C93B46F25: to=k.padmore@tiscali.co.uk, relay=none, delay=4538, delays=4536/1.6/0/0.16, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/error[18112]	: 7EB1518D03C: to=clean@tiscali.co.uk, relay=none, delay=84525, delays=84524/0.88/0/0.13, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/bounce[18048	]: 6549B46FA6: sender non-delivery notification: CD7A3465ED
Dec	16	11:56:01	server2	postfix/bounce[18068	]: 4F1F546CE0: sender non-delivery notification: E6B5D465EA
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	E6B5D465EA: from=, size=7663, nrcpt=1 (queue active)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	6549B46FA6: removed
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	CD7A3465ED: from=, size=7733, nrcpt=1 (queue active)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	4F1F546CE0: removed
Dec	16	11:56:01	server2	postfix/smtp[18067]:	E1C1A4780C: to=robert.walls@onetel.com, relay=mx3.onetel.net.uk[62.24.202.3]:25, delay=84435, delays=84433/1.9/0.27/0, dsn=4.4.2, status=deferred (lost connection with mx3.onetel.net.uk[62.24.202.3] while receiving the initial server greeting)
Dec	16	11:56:01	server2	postfix/smtp[18116]:	connect to cluster5.eu.messagelabs.com[193.109.254.3]:25: Connection refused
Dec	16	11:56:01	server2	postfix/cleanup[1805	2]: 10E3C465E7: message-id=20131216105601.10E3C465E7@server2.halva.org
Dec	16	11:56:01	server2	postfix/smtp[18106]:	connect to novell.info[130.57.5.70]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18085]:	A566947121: to=k.shaw@brighton.ac.uk, relay=cluster5.eu.messagelabs.com[195.245.230.51]:25, delay=4513, delays=4511/1.8/0.27/0.35, dsn=5.0.0, status=bounced (host cluster5.eu.messagelabs.com[195.245.230.51] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:01	server2	postfix/cleanup[1808	3]: 22E2646604: message-id=20131216105601.22E2646604@server2.halva.org
Dec	16	11:56:01	server2	postfix/error[18069]	: 7BA6046E75: to=k.hodgenia@tiscali.co.uk, relay=none, delay=4592, delays=4591/1/0/0.12, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/error[18027]	: 7C8E546E1C: to=k.davie750@tiscali.co.uk, relay=none, delay=4627, delays=4626/1/0/0.12, dsn=4.0.0, status=deferred (delivery temporarily suspended: host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx8gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/bounce[18048	]: A215446C07: sender non-delivery notification: 10E3C465E7
Dec	16	11:56:01	server2	postfix/local[18082]	: E6B5D465EA: to=www-data@server2.org, relay=local, delay=0.24, delays=0.07/0.04/0/0.12, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	A215446C07: removed
Dec	16	11:56:01	server2	postfix/smtp[18106]:	F40D246DA5: to=k.gliecoucroun@novell.info, relay=none, delay=4609, delays=4607/1.9/0.37/0, dsn=4.4.1, status=deferred (connect to novell.info[130.57.5.70]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	10E3C465E7: from=, size=7527, nrcpt=1 (queue active)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	E6B5D465EA: removed
Dec	16	11:56:01	server2	postfix/smtp[18058]:	A1FD346C95: to=k.douglas@homewood.kent.sch.uk, relay=smtp-ma.kcn.org.uk[194.80.20.33]:25, delay=4623, delays=4621/1.8/0.66/0, dsn=4.0.0, status=deferred (host smtp-ma.kcn.org.uk[194.80.20.33] refused to talk to me: 554 smtp-ma.kcn.org.uk)
Dec	16	11:56:01	server2	postfix/smtp[18094]:	D8C1846CBF: to=k.anderson@jamesjones.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.19]:25, delay=4665, delays=4663/1.9/0.35/0.31, dsn=2.0.0, status=sent (250 ok 1387191361 qp 10765 server-6.tower-39.messagelabs.com!1387191360!5087320!1)
Dec	16	11:56:01	server2	postfix/bounce[18066	]: A566947121: sender non-delivery notification: 22E2646604
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	22E2646604: from=, size=7692, nrcpt=1 (queue active)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	D8C1846CBF: removed
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	A566947121: removed
Dec	16	11:56:01	server2	postfix/smtp[18094]:	connect to php.nl[213.136.19.29]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18119]:	connect to suse.be[130.57.5.70]:25: Connection refused
Dec	16	11:56:01	server2	postfix/local[18082]	: CD7A3465ED: to=www-data@server2.org, relay=local, delay=0.46, delays=0.21/0.18/0/0.07, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	CD7A3465ED: removed
Dec	16	11:56:01	server2	postfix/smtp[18101]:	connect to php.org[69.43.160.154]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18094]:	0B50446BEB: to=k.cheastrostruld@php.nl, relay=none, delay=4636, delays=4634/2.2/0.05/0, dsn=4.4.1, status=deferred (connect to php.nl[213.136.19.29]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18119]:	041FD468ED: to=k.ghoqoutous@suse.be, relay=none, delay=4610, delays=4608/2.1/0.23/0, dsn=4.4.1, status=deferred (connect to suse.be[130.57.5.70]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18101]:	E4AAC46C60: to=k.feceat@php.org, relay=none, delay=4617, delays=4615/1.9/0.62/0, dsn=4.4.1, status=deferred (connect to php.org[69.43.160.154]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18058]:	07B8F46DEE: to=k.fitzgibbon1@talktalk.net, relay=mx-c1.talktalk.net[62.24.202.3]:25, delay=4616, delays=4614/2.2/0.13/0, dsn=4.4.2, status=deferred (lost connection with mx-c1.talktalk.net[62.24.202.3] while receiving the initial server greeting)
Dec	16	11:56:01	server2	postfix/local[18082]	: 10E3C465E7: to=www-data@server2.org, relay=local, delay=0.37, delays=0.12/0.12/0/0.12, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	10E3C465E7: removed
Dec	16	11:56:01	server2	postfix/smtp[18074]:	connect to jxxx.com[121.78.127.249]:25: Connection refused
Dec	16	11:56:01	server2	postfix/local[18082]	: 22E2646604: to=www-data@server2.org, relay=local, delay=0.35, delays=0.04/0.24/0/0.07, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	22E2646604: removed
Dec	16	11:56:01	server2	postfix/smtp[18116]:	06014470FC: to=k.rooney@independent.co.uk, relay=cluster5.eu.messagelabs.com[85.158.138.179]:25, delay=4521, delays=4518/2/0.21/0.34, dsn=2.0.0, status=sent (250 ok 1387191361 qp 13352 server-3.tower-169.messagelabs.com!1387191361!1035104!1)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	06014470FC: removed
Dec	16	11:56:01	server2	postfix/smtp[18094]:	1D2D546863: host smtp-fe.ballou.se[91.189.40.102] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:01	server2	postfix/smtp[18074]:	011ED47AB5: to=axxxxxxxx@jxxx.com, relay=none, delay=161336, delays=161333/2.1/0.43/0, dsn=4.4.1, status=deferred (connect to jxxx.com[121.78.127.249]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18119]:	connect to novell.com.au[130.57.5.70]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18085]:	0196F18C5D5: to=vanessa.petitpaws@tinyworld.co.uk, relay=mxgb1.opaltelecom.net[62.24.139.61]:25, delay=85754, delays=85751/2.1/0.37/0, dsn=4.0.0, status=deferred (host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx16gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:01	server2	postfix/smtp[18127]:	connect to mx.email.com.cn[60.28.13.230]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18143]:	connect to mail.llandrillo.ac.uk[194.83.16.3]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18119]:	1543F470AA: to=k.plokreagh@novell.com.au, relay=none, delay=4533, delays=4531/2.3/0.23/0, dsn=4.4.1, status=deferred (connect to novell.com.au[130.57.5.70]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18094]:	1D2D546863: host smtp-fe.ballou.se[91.189.40.103] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:01	server2	postfix/smtp[18070]:	8D07B47132: to=k.sneabiel@gmail.be, relay=none, delay=4505, delays=4502/2/0.74/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=gmail.be type=MX: Host not found, try again)
Dec	16	11:56:01	server2	postfix/smtp[18127]:	0E69A18C021: to=k.slobrouchin@apache.cn, relay=none, delay=4509, delays=4506/2.2/0.42/0, dsn=4.4.1, status=deferred (connect to mx.email.com.cn[60.28.13.230]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18128]:	060FB46F98: to=k.kelly@msnorthwest.co.uk, relay=cluster5.eu.messagelabs.com[195.245.230.51]:25, delay=4579, delays=4576/2.2/0.17/0.26, dsn=2.0.0, status=sent (250 ok 1387191361 qp 3784 server-7.tower-33.messagelabs.com!1387191361!1498853!1)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	060FB46F98: removed
Dec	16	11:56:01	server2	postfix/smtp[18143]:	125A646CB1: to=k.hatton@llandrillo.ac.uk, relay=none, delay=4599, delays=4596/2.2/0.18/0, dsn=4.4.1, status=deferred (connect to mail.llandrillo.ac.uk[194.83.16.3]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18117]:	07A1C470E8: to=k.robson@surrey.ac.uk, relay=cluster2.eu.messagelabs.com[195.245.230.131]:25, delay=4522, delays=4519/2/0.29/0.35, dsn=5.0.0, status=bounced (host cluster2.eu.messagelabs.com[195.245.230.131] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:01	server2	postfix/cleanup[1805	2]: AB5C9465EA: message-id=20131216105601.AB5C9465EA@server2.halva.org
Dec	16	11:56:01	server2	postfix/smtp[18094]:	1D2D546863: host smtp-fe.ballou.se[91.189.40.101] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:01	server2	postfix/smtp[18123]:	0C6A9470A8: to=k.potts@bbk.ac.uk, relay=cluster2.eu.messagelabs.com[195.245.230.131]:25, delay=4533, delays=4530/2.1/0.32/0.33, dsn=2.0.0, status=sent (250 ok 1387191361 qp 16682 server-2.tower-78.messagelabs.com!1387191361!20199804!1)
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	0C6A9470A8: removed
Dec	16	11:56:01	server2	postfix/bounce[18066	]: 07A1C470E8: sender non-delivery notification: AB5C9465EA
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	07A1C470E8: removed
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	AB5C9465EA: from=, size=7693, nrcpt=1 (queue active)
Dec	16	11:56:01	server2	postfix/smtp[18150]:	5900018D1A6: to=jackiequail@talktalk.net, relay=mx-c1.talktalk.net[62.24.202.3]:25, delay=84485, delays=84483/2.3/0.11/0, dsn=4.4.2, status=deferred (lost connection with mx-c1.talktalk.net[62.24.202.3] while receiving the initial server greeting)
Dec	16	11:56:01	server2	postfix/smtp[18140]:	connect to netaccessman.com[69.43.161.176]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18125]:	connect to netaccessman.com[69.43.161.176]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18085]:	connect to kulsar.co.uk[81.142.101.76]:25: Connection refused
Dec	16	11:56:01	server2	postfix/smtp[18094]:	1D2D546863: host smtp-fe.ballou.se[91.189.40.84] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:01	server2	postfix/smtp[18125]:	08CFA46A5F: to=jyhycewile@netaccessman.com, relay=none, delay=4724, delays=4721/2.1/0.63/0, dsn=4.4.1, status=deferred (connect to netaccessman.com[69.43.161.176]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18140]:	1EFC547098: to=jyletovudo@netaccessman.com, relay=none, delay=4719, delays=4716/2.2/0.39/0, dsn=4.4.1, status=deferred (connect to netaccessman.com[69.43.161.176]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18153]:	3860C18CA53: to=suerose@talktalk.net, relay=mx-c1.talktalk.net[62.24.202.3]:25, delay=84389, delays=84386/2.3/0.14/0, dsn=4.4.2, status=deferred (lost connection with mx-c1.talktalk.net[62.24.202.3] while receiving the initial server greeting)
Dec	16	11:56:01	server2	postfix/local[18082]	: AB5C9465EA: to=www-data@server2.org, relay=local, delay=0.2, delays=0.07/0/0/0.13, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:01	server2	postfix/qmgr[12867]:	AB5C9465EA: removed
Dec	16	11:56:01	server2	postfix/smtp[18085]:	5765C477D5: to=egoslin@kulsar.co.uk, relay=none, delay=84439, delays=84437/2.3/0.21/0, dsn=4.4.1, status=deferred (connect to kulsar.co.uk[81.142.101.76]:25: Connection refused)
Dec	16	11:56:01	server2	postfix/smtp[18158]:	C31F2472A2: host smtp-fe.ballou.se[91.189.40.106] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:01	server2	postfix/smtp[18094]:	1D2D546863: to=barbro@freker.se, relay=smtp-fe.ballou.se[91.189.40.83]:25, delay=160452, delays=160449/2.2/0.55/0, dsn=4.0.0, status=deferred (host smtp-fe.ballou.se[91.189.40.83] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation)
Dec	16	11:56:01	server2	postfix/smtp[18169]:	connect to cluster8.eu.messagelabs.com[85.158.140.195]:25: Connection refused
Dec	16	11:56:02	server2	postfix/smtp[18158]:	C31F2472A2: host smtp-fe.ballou.se[91.189.40.83] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:02	server2	postfix/smtp[18085]:	2574946E04: to=k.grzywacz@mail.iw.lodz.pl, relay=mail.iw.lodz.pl[212.191.5.40]:25, delay=4605, delays=4603/2/0.11/0, dsn=4.4.2, status=deferred (lost connection with mail.iw.lodz.pl[212.191.5.40] while receiving the initial server greeting)
Dec	16	11:56:02	server2	postfix/smtp[18158]:	C31F2472A2: host smtp-fe.ballou.se[91.189.40.104] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:02	server2	postfix/smtp[18039]:	950B746E53: to=jyrki.makinen@noretron.fi, relay=fimx1.d-fence.eu[81.17.201.54]:25, delay=4699, delays=4695/0.58/2.6/0.65, dsn=4.7.1, status=deferred (host fimx1.d-fence.eu[81.17.201.54] said: 450 4.7.1 jyrki.makinen@noretron.fi: Recipient address rejected: Try again later (in reply to RCPT TO command))
Dec	16	11:56:02	server2	postfix/smtp[18147]:	5200746E15: to=k.dobie@jamesjones.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.3]:25, delay=4626, delays=4623/2.3/0.3/0.36, dsn=2.0.0, status=sent (250 ok 1387191362 qp 5948 server-9.tower-38.messagelabs.com!1387191361!3153225!1)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	5200746E15: removed
Dec	16	11:56:02	server2	postfix/smtp[18128]:	34534470E1: to=k.robertson@odi.org.uk, relay=cluster8.eu.messagelabs.com[85.158.137.3]:25, delay=4523, delays=4520/2.3/0.31/0.21, dsn=5.0.0, status=bounced (host cluster8.eu.messagelabs.com[85.158.137.3] said: 550 Invalid recipient k.robertson@odi.org.uk (#5.1.1) (in reply to RCPT TO command))
Dec	16	11:56:02	server2	postfix/smtp[18174]:	274A546F82: to=k.clifford@lineone.net, relay=mxgb1.opaltelecom.net[62.24.139.61]:25, delay=4633, delays=4631/2/0.13/0, dsn=4.0.0, status=deferred (host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx9gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:02	server2	postfix/smtp[18126]:	connect to btintemet.com[67.229.62.166]:25: Connection refused
Dec	16	11:56:02	server2	postfix/smtp[18158]:	C31F2472A2: host smtp-fe.ballou.se[91.189.40.82] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation
Dec	16	11:56:02	server2	postfix/smtp[18150]:	C40CF47057: to=k.niewiadomski@vivadent.com.pl, relay=none, delay=4545, delays=4543/1.9/0.37/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=vivadent.com.pl type=MX: Host not found, try again)
Dec	16	11:56:02	server2	postfix/cleanup[1808	3]: 3B2EE465EA: message-id=20131216105602.3B2EE465EA@server2.halva.org
Dec	16	11:56:02	server2	postfix/smtp[18145]:	5FE864688F: to=k.dreacroupris@gmail.tv, relay=none, delay=4624, delays=4621/2.3/0.74/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=gmail.tv type=MX: Host not found, try again)
Dec	16	11:56:02	server2	postfix/smtp[18126]:	064E447086: to=k.owens@btintemet.com, relay=none, delay=4540, delays=4537/2.1/1/0, dsn=4.4.1, status=deferred (connect to btintemet.com[67.229.62.166]:25: Connection refused)
Dec	16	11:56:02	server2	postfix/bounce[18048	]: 34534470E1: sender non-delivery notification: 3B2EE465EA
Dec	16	11:56:02	server2	postfix/smtp[18158]:	C31F2472A2: to=auktion@pybackman.se, relay=smtp-fe.ballou.se[91.189.40.85]:25, delay=161990, delays=161987/1.9/0.56/0, dsn=4.0.0, status=deferred (host smtp-fe.ballou.se[91.189.40.85] refused to talk to me: 521 212.96.185.188 blocked by GlobalView, see http://www.commtouch.com/check-ip-reputation)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	3B2EE465EA: from=, size=7517, nrcpt=1 (queue active)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	34534470E1: removed
Dec	16	11:56:02	server2	postfix/smtp[18174]:	connect to cluster2.eu.messagelabs.com[193.109.255.147]:25: Connection refused
Dec	16	11:56:02	server2	postfix/smtp[18095]:	DC8B1467AB: host in1-smtp.messagingengine.com[66.111.4.73] said: 451 4.7.1 kateogley@fastmail.fm: Recipient address rejected: User is over quota, try again later (in reply to RCPT TO command)
Dec	16	11:56:02	server2	postfix/local[18082]	: 3B2EE465EA: to=www-data@server2.org, relay=local, delay=0.17, delays=0.1/0/0/0.07, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	3B2EE465EA: removed
Dec	16	11:56:02	server2	postfix/smtp[18134]:	0BD4A46ECA: host cacpnet.com.s6a1.psmtp.com[64.18.5.10] said: 451 Can't connect to cacpnet.com - psmtp (in reply to RCPT TO command)
Dec	16	11:56:02	server2	postfix/smtp[18185]:	connect to novell.org[130.57.5.70]:25: Connection refused
Dec	16	11:56:02	server2	postfix/smtp[18094]:	28D1547014: to=k.l.saunders@brighton.ac.uk, relay=cluster5.eu.messagelabs.com[195.245.230.51]:25, conn_use=2, delay=4567, delays=4565/2/0.09/0.43, dsn=5.0.0, status=bounced (host cluster5.eu.messagelabs.com[195.245.230.51] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:02	server2	postfix/cleanup[1805	2]: 83F16465EC: message-id=20131216105602.83F16465EC@server2.halva.org
Dec	16	11:56:02	server2	postfix/smtp[18185]:	2E59446C56: to=k.gliglelm@novell.org, relay=none, delay=4610, delays=4608/2.1/0.41/0, dsn=4.4.1, status=deferred (connect to novell.org[130.57.5.70]:25: Connection refused)
Dec	16	11:56:02	server2	postfix/smtp[18165]:	C2C2346E62: to=k.harmer@vam.ac.uk, relay=cluster8.eu.messagelabs.com[85.158.137.19]:25, delay=4600, delays=4597/2/0.3/0.35, dsn=5.0.0, status=bounced (host cluster8.eu.messagelabs.com[85.158.137.19] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:02	server2	postfix/cleanup[1808	3]: 8D362465ED: message-id=20131216105602.8D362465ED@server2.halva.org
Dec	16	11:56:02	server2	postfix/bounce[18066	]: 28D1547014: sender non-delivery notification: 83F16465EC
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	28D1547014: removed
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	83F16465EC: from=, size=7728, nrcpt=1 (queue active)
Dec	16	11:56:02	server2	postfix/smtp[18039]:	connect to suse.jp[130.57.5.70]:25: Connection refused
Dec	16	11:56:02	server2	postfix/smtp[18149]:	386CF18C398: host mx.dca.untd.com[64.136.44.37] refused to talk to me: 550 Access denied:...38a9c825b125f5f5ad65e579796d21014521456d1d999d7c99b928e10d8968c8911dfc59c189f945694d58819d1cc5edcdf58ca17cb995ec6cad11dcd52828d12c65b881f98d85380c7c98ecfce8595968c15dc56889a109891c256c...
Dec	16	11:56:02	server2	postfix/smtp[18169]:	CF9F646ABA: to=k.ainslie@jamesjones.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.3]:25, delay=4668, delays=4665/2/0.35/0.41, dsn=2.0.0, status=sent (250 ok 1387191362 qp 17131 server-12.tower-38.messagelabs.com!1387191362!3248573!1)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	8D362465ED: from=, size=7673, nrcpt=1 (queue active)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	CF9F646ABA: removed
Dec	16	11:56:02	server2	postfix/bounce[18060	]: C2C2346E62: sender non-delivery notification: 8D362465ED
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	C2C2346E62: removed
Dec	16	11:56:02	server2	postfix/smtp[18039]:	7791846D32: to=k.pradran@suse.jp, relay=none, delay=4533, delays=4531/2.2/0.41/0, dsn=4.4.1, status=deferred (connect to suse.jp[130.57.5.70]:25: Connection refused)
Dec	16	11:56:02	server2	postfix/smtp[18154]:	387A818C37D: host mx.dca.untd.com[64.136.44.37] refused to talk to me: 550 Access denied:...2039b9c8c1c8a5a5491c68e8e85d099c1c09ac0955084c0c08bd3cfc48a9f5b9ad554d2811a9e5c5d1a845794cd8dd0021a5f8980cbdb8c98849413d913c3ce1b11c7d79e52565cd6c0c35c94d952828f511d9ddf5a998dca9d8c888...
Dec	16	11:56:02	server2	postfix/smtp[18057]:	8219946FB5: to=jxg@fordsimey.co.uk, relay=cluster8.eu.messagelabs.com[85.158.137.19]:25, delay=4743, delays=4739/2/0.32/1.5, dsn=5.0.0, status=bounced (host cluster8.eu.messagelabs.com[85.158.137.19] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:02	server2	postfix/local[18082]	: 83F16465EC: to=www-data@server2.org, relay=local, delay=0.21, delays=0.08/0.04/0/0.09, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	83F16465EC: removed
Dec	16	11:56:02	server2	postfix/cleanup[1805	2]: B7985465EA: message-id=20131216105602.B7985465EA@server2.halva.org
Dec	16	11:56:02	server2	postfix/smtp[18147]:	2A2E018D1EB: to=zm@surrey.ac.uk, relay=cluster2.eu.messagelabs.com[85.158.137.99]:25, delay=84464, delays=84461/2.2/0.29/0.29, dsn=5.0.0, status=bounced (host cluster2.eu.messagelabs.com[85.158.137.99] said: 553-Message filtered. Please see the FAQs section on spam 553-at http://www.messagelabs.com/support/ for more 553 information. (#5.7.1) (in reply to end of DATA command))
Dec	16	11:56:02	server2	postfix/local[18082]	: 8D362465ED: to=www-data@server2.org, relay=local, delay=0.26, delays=0.04/0.14/0/0.08, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	8D362465ED: removed
Dec	16	11:56:02	server2	postfix/cleanup[1808	3]: CB938465F6: message-id=20131216105602.CB938465F6@server2.halva.org
Dec	16	11:56:02	server2	postfix/bounce[18060	]: 8219946FB5: sender non-delivery notification: B7985465EA
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	B7985465EA: from=, size=7679, nrcpt=1 (queue active)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	8219946FB5: removed
Dec	16	11:56:02	server2	postfix/smtp[18174]:	7946047853: to=alexyang@deloitte.co.uk, relay=cluster2.eu.messagelabs.com[195.245.230.131]:25, delay=84422, delays=84420/2.2/0.41/0.28, dsn=2.0.0, status=sent (250 ok 1387191362 qp 16820 server-2.tower-78.messagelabs.com!1387191362!20199806!1)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	CB938465F6: from=, size=7185, nrcpt=1 (queue active)
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	7946047853: removed
Dec	16	11:56:02	server2	postfix/bounce[18068	]: 2A2E018D1EB: sender non-delivery notification: CB938465F6
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	2A2E018D1EB: removed
Dec	16	11:56:02	server2	postfix/local[18213]	: B7985465EA: to=www-data@server2.org, relay=local, delay=0.21, delays=0.11/0.04/0/0.06, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:02	server2	postfix/qmgr[12867]:	B7985465EA: removed
Dec	16	11:56:03	server2	postfix/local[18082]	: CB938465F6: to=www-data@server2.org, relay=local, delay=0.19, delays=0.03/0.1/0/0.06, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:03	server2	postfix/qmgr[12867]:	CB938465F6: removed
Dec	16	11:56:03	server2	postfix/smtp[18134]:	0BD4A46ECA: to=ataylor@cacpnet.com, relay=cacpnet.com.s6a2.psmtp.com[64.18.5.11]:25, delay=162306, delays=162301/2.2/1.9/0.51, dsn=4.0.0, status=deferred (host cacpnet.com.s6a2.psmtp.com[64.18.5.11] said: 451 Can't connect to cacpnet.com - psmtp (in reply to RCPT TO command))
Dec	16	11:56:03	server2	postfix/smtp[18149]:	386CF18C398: to=genaangel@juno.com, relay=mx.vgs.untd.com[64.136.52.37]:25, delay=92820, delays=92815/2.3/2.2/0, dsn=4.0.0, status=deferred (host mx.vgs.untd.com[64.136.52.37] refused to talk to me: 550 Access denied:...3f00a9ed21edc90050857d3838b5743439399d74d90990640995ad0540a4fda92dd955d0b1a4601131654dd59035948444e5f46d6495a089dd2091b030adade4bd850dd5609d81f1c1648d895599d0d0fdb11d94fda46d54a435eddd...)
Dec	16	11:56:03	server2	postfix/smtp[18154]:	387A818C37D: to=gem_06@juno.com, relay=mx.vgs.untd.com[64.136.52.37]:25, delay=92827, delays=92822/2.3/2.2/0, dsn=4.0.0, status=deferred (host mx.vgs.untd.com[64.136.52.37] refused to talk to me: 550 Access denied:...5089258d2c8dec896c85f981813d353175cd0585bcddb5c9ddc859d1bd7de525d5bce178e97d5c5819fcd818b56545f838680100c9c8e84c0c91c109a5595969a88595185c05d99c7cc9a14ce1797878e5e96d45e57d00217d658d0c...)
Dec	16	11:56:03	server2	postfix/smtp[18109]:	821D818CF29: to=missmndale@ahoo.co.uk, relay=none, delay=84379, delays=84374/2/3.1/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=ahoo.co.uk type=MX: Host not found, try again)
Dec	16	11:56:04	server2	postfix/smtp[18076]:	4F80E46C2C: to=k.darcy@kavli.co.uk, relay=cluster3.eu.messagelabs.com[85.158.137.67]:25, delay=4630, delays=4624/1.7/0.61/3.2, dsn=2.0.0, status=sent (250 ok 1387191364 qp 26950 server-2.tower-139.messagelabs.com!1387191360!25519136!1)
Dec	16	11:56:04	server2	postfix/qmgr[12867]:	4F80E46C2C: removed
Dec	16	11:56:04	server2	postfix/smtp[18095]:	DC8B1467AB: to=kateogley@fastmail.fm, relay=in1-smtp.messagingengine.com[66.111.4.72]:25, delay=3304, delays=3299/1.9/3.3/0.21, dsn=4.7.1, status=deferred (host in1-smtp.messagingengine.com[66.111.4.72] said: 451 4.7.1 kateogley@fastmail.fm: Recipient address rejected: User is over quota, try again later (in reply to RCPT TO command))
Dec	16	11:56:05	server2	postfix/smtp[18059]:	6B8F447850: to=kelly@hotmail.co, relay=none, delay=84425, delays=84418/1.4/5.2/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=hotmail.co type=MX: Host not found, try again)
Dec	16	11:56:06	server2	postfix/smtp[18117]:	CA83747076: to=k.noakes@lineone.net, relay=mxgb1.opaltelecom.net[62.24.139.61]:25, delay=4550, delays=4543/1.9/4.8/0, dsn=4.0.0, status=deferred (host mxgb1.opaltelecom.net[62.24.139.61] refused to talk to me: 554-public.mx5gb1.int.opaltelecom.net 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.)
Dec	16	11:56:07	server2	postfix/smtp[18166]:	CB8B3467D6: host mx1.idnet.net[212.69.36.17] said: 454 4.7.1 Temp Spam Reject; Client host [212.96.185.188] deferred using hostkarma.junkemailfilter.com=127.0.0.2; Black listed at hostkarma http://ipadmin.junkemailfilter.com/remove.php?ip=212.96.185.188 (in reply to RCPT TO command)
Dec	16	11:56:07	server2	postfix/smtpd[17995]	: connect from mail2.bemta3.messagelabs.com[195.245.230.35]
Dec	16	11:56:08	server2	postfix/smtpd[17995]	: 172F3465E7: client=mail2.bemta3.messagelabs.com[195.245.230.35]
Dec	16	11:56:08	server2	postfix/cleanup[1805	2]: 172F3465E7: message-id=
Dec	16	11:56:08	server2	postfix/qmgr[12867]:	172F3465E7: from=, size=4259, nrcpt=1 (queue active)
Dec	16	11:56:08	server2	postfix/smtpd[17995]	: disconnect from mail2.bemta3.messagelabs.com[195.245.230.35]
Dec	16	11:56:08	server2	postfix/local[18077]	: 42099465FD: to=www-data@server2.org, relay=local, delay=8.2, delays=0.09/0.07/0/8.1, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:08	server2	postfix/qmgr[12867]:	42099465FD: removed
Dec	16	11:56:13	server2	postfix/smtpd[18232]	: connect from localhost[127.0.0.1]
Dec	16	11:56:13	server2	postfix/smtpd[18232]	: 2FDC2465EA: client=localhost[127.0.0.1]
Dec	16	11:56:13	server2	postfix/cleanup[1808	3]: 2FDC2465EA: message-id=20131216105613.2FDC2465EA@server2.halva.org
Dec	16	11:56:13	server2	postfix/qmgr[12867]:	2FDC2465EA: from=, size=4782, nrcpt=1 (queue active)
Dec	16	11:56:13	server2	amavis[17614]: (1761	4-01) Passed CLEAN, [195.245.230.35] [195.245.230.38]  - www-data@server2.org, mail_id: R93KFUgDwPmh, Hits: -2.985, size: 4257, queued_as: 2FDC2465EA, 5009 ms
Dec	16	11:56:13	server2	postfix/smtp[18228]:	172F3465E7: to=www-data@server2.org, relay=127.0.0.1[127.0.0.1]:10024, delay=5.3, delays=0.23/0.02/0.02/5, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=17614-01, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 2FDC2465EA)
Dec	16	11:56:13	server2	postfix/qmgr[12867]:	172F3465E7: removed
Dec	16	11:56:13	server2	postfix/local[18213]	: 2FDC2465EA: to=www-data@server2.org, relay=local, delay=0.16, delays=0.09/0/0/0.07, dsn=2.0.0, status=sent (delivered to command: procmail -a "$EXTENSION")
Dec	16	11:56:13	server2	postfix/qmgr[12867]:	2FDC2465EA: removed
Dec	16	11:56:15	server2	postfix/smtp[18137]:	1498218C853: host vscan-b.ucl.ac.uk[144.82.100.151] said: 451 Could not complete recipient verify callout (in reply to RCPT TO command)
Dec	16	11:56:22	server2	postfix/smtp[18166]:	CB8B3467D6: to=plevy@idnet.net.uk, relay=mx2.idnet.net[212.69.40.49]:25, delay=351100, delays=351077/2/11/10, dsn=4.7.1, status=deferred (host mx2.idnet.net[212.69.40.49] said: 454 4.7.1 Temp Spam Reject; Client host [212.96.185.188] deferred using hostkarma.junkemailfilter.com=127.0.0.2; Black listed at hostkarma http://ipadmin.junkemailfilter.com/remove.php?ip=212.96.185.188 (in reply to RCPT TO command))
Dec	16	11:56:22	server2	postfix/smtp[18063]:	6911746EA6: to=k.flospen@suse.cn, relay=none, delay=4636, delays=4612/1.4/23/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=suse.cn type=MX: Host not found, try again)
Dec	16	11:56:22	server2	postfix/smtp[18111]:	8880746FC0: to=k.klabriecis@suse.cn, relay=none, delay=4597, delays=4573/2/22/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=suse.cn type=MX: Host not found, try again)
Dec	16	11:56:26	server2	postfix/smtp[18053]:	connect to mailgate.disabilitydirectderby.co.uk[93.97.22.241]:25: No route to host
Dec	16	11:56:26	server2	postfix/smtp[18053]:	8E2DD46A67: host relay-1.mail.demon.net[194.217.242.9] said: 450 4.1.1 katen@disabilitydirectderby.co.uk: Recipient address rejected: unverified address: connect to mailgate.disabilitydirectderby.co.uk[93.97.22.241]: Connection timed out (in reply to RCPT TO command)
Dec	16	11:56:27	server2	postfix/smtp[18053]:	8E2DD46A67: to=katen@disabilitydirectderby.co.uk, relay=relay-2.mail.demon.net[194.217.242.9]:25, delay=3331, delays=3302/2/26/0.1, dsn=4.1.1, status=deferred (host relay-2.mail.demon.net[194.217.242.9] said: 450 4.1.1 katen@disabilitydirectderby.co.uk: Recipient address rejected: unverified address: connect to mailgate.disabilitydirectderby.co.uk[93.97.22.241]: Connection timed out (in reply to RCPT TO command))
Dec	16	11:56:28	server2	postfix/smtp[18026]:	connect to feeney.co.uk[216.8.179.23]:25: Connection timed out
Dec	16	11:56:28	server2	postfix/smtp[18026]:	9831918CEE1: to=pete@feeney.co.uk, relay=none, delay=84406, delays=84376/0.09/30/0, dsn=4.4.1, status=deferred (connect to feeney.co.uk[216.8.179.23]:25: Connection timed out)
Dec	16	11:56:28	server2	postfix/smtp[18035]:	connect to ixir.com[212.252.113.103]:25: Connection timed out
Dec	16	11:56:28	server2	postfix/smtp[18035]:	9012F46AAE: to=aspaksoy@ixir.com, relay=none, delay=162584, delays=162554/0.42/30/0, dsn=4.4.1, status=deferred (connect to ixir.com[212.252.113.103]:25: Connection timed out)
Dec	16	11:56:28	server2	postfix/smtp[18036]:	connect to gateway.net[207.200.74.38]:25: Connection timed out
Dec	16	11:56:28	server2	postfix/smtp[18040]:	connect to liverpoolfc.net[54.194.122.94]:25: Connection timed out
Dec	16	11:56:29	server2	postfix/smtp[18040]:	B2B6018CE8E: to=flynnt@liverpoolfc.net, relay=none, delay=84475, delays=84445/0.6/30/0, dsn=4.4.1, status=deferred (connect to liverpoolfc.net[54.194.122.94]:25: Connection timed out)
Dec	16	11:56:29	server2	postfix/smtp[18044]:	connect to mail.jspsolicitors.co.uk[217.34.46.184]:25: Connection timed out
Dec	16	11:56:29	server2	postfix/smtp[18044]:	B260D4708C: to=k.overton@jspsolicitors.co.uk, relay=none, delay=4567, delays=4537/0.77/30/0, dsn=4.4.1, status=deferred (connect to mail.jspsolicitors.co.uk[217.34.46.184]:25: Connection timed out)
Dec	16	11:56:29	server2	postfix/smtp[18050]:	connect to otmail.co.uk[208.73.210.233]:25: Connection timed out
Dec	16	11:56:29	server2	postfix/smtp[18042]:	connect to hotail.com[64.4.6.100]:25: Connection timed out
Dec	16	11:56:29	server2	postfix/smtp[18031]:	connect to palm.shu.ac.uk[143.52.10.24]:25: Connection timed out
Dec	16	11:56:29	server2	postfix/smtp[18050]:	BEDD74784D: to=neilorcaroline@otmail.co.uk, relay=none, delay=84450, delays=84419/0.89/30/0, dsn=4.4.1, status=deferred (connect to otmail.co.uk[208.73.210.233]:25: Connection timed out)
Dec	16	11:56:29	server2	postfix/smtp[18049]:	connect to mx6.mail.tiscali.co.uk[212.74.100.152]:25: Connection timed out
Dec	16	11:56:29	server2	postfix/smtp[18031]:	92E984699D: to=k.lawson@shu.ac.uk, relay=none, delay=4593, delays=4562/0.5/31/0, dsn=4.4.1, status=deferred (connect to palm.shu.ac.uk[143.52.10.24]:25: Connection timed out)
Dec	16	11:56:29	server2	postfix/smtp[18137]:	1498218C853: to=qmailr@egon.stats.ucl.ac.uk, relay=vscan-a.ucl.ac.uk[144.82.100.150]:25, delay=351538, delays=351507/2.2/18/10, dsn=4.0.0, status=deferred (host vscan-a.ucl.ac.uk[144.82.100.150] said: 451 Could not complete recipient verify callout (in reply to RCPT TO command))
Dec	16	11:56:30	server2	postfix/smtp[18038]:	connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18037]:	connect to t-online.ch[217.6.164.164]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18051]:	connect to hem.passagen.se[91.196.241.100]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18038]:	413BD46749: to=katgirl6@ukonline.co.uk, relay=none, delay=3296, delays=3264/1.7/30/0, dsn=4.4.1, status=deferred (connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out)
Dec	16	11:56:30	server2	postfix/smtp[18046]:	connect to mcscns.cc.telcordia.com[128.96.183.28]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18037]:	connect to t-online.ch[62.153.159.104]:25: Connection refused
Dec	16	11:56:30	server2	postfix/smtp[18051]:	4E89146E59: to=asylum@hem.passagen.se, relay=none, delay=162366, delays=162334/1.7/30/0, dsn=4.4.1, status=deferred (connect to hem.passagen.se[91.196.241.100]:25: Connection timed out)
Dec	16	11:56:30	server2	postfix/smtp[18037]:	4117C46C6A: to=k.cirielac@t-online.ch, relay=none, delay=4663, delays=4631/1.7/30/0, dsn=4.4.1, status=deferred (connect to t-online.ch[62.153.159.104]:25: Connection refused)
Dec	16	11:56:30	server2	postfix/smtp[18061]:	connect to greenday.co.uk[199.59.243.109]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18089]:	connect to mail.hjberry.co.uk[81.136.153.112]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18043]:	connect to s2.friko.pl[193.203.99.112]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18084]:	connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18090]:	connect to hotmal.co.uk[212.227.87.14]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18089]:	ABF0318CCB0: to=jayne.mackenzie@hjberry.co.uk, relay=none, delay=84491, delays=84459/1.8/30/0, dsn=4.4.1, status=deferred (connect to mail.hjberry.co.uk[81.136.153.112]:25: Connection timed out)
Dec	16	11:56:30	server2	postfix/smtp[18084]:	D25B746DE8: to=k.folkard@ukonline.co.uk, relay=none, delay=4644, delays=4612/1.8/30/0, dsn=4.4.1, status=deferred (connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out)
Dec	16	11:56:30	server2	postfix/smtp[18090]:	A664D46C26: to=k-oreilly@hotmal.co.uk, relay=none, delay=4704, delays=4672/1.9/30/0, dsn=4.4.1, status=deferred (connect to hotmal.co.uk[212.227.87.14]:25: Connection timed out)
Dec	16	11:56:30	server2	postfix/smtp[18046]:	421A7469EA: host mx7.telcordia.com[192.4.253.110] refused to talk to me: 421 Service not available, closing transmission channel
Dec	16	11:56:30	server2	postfix/smtp[18091]:	connect to mx5.mail.tiscali.co.uk[212.74.100.151]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18097]:	connect to HOTMAL.COM[65.55.39.10]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18045]:	connect to mx6.mail.tiscali.co.uk[212.74.100.152]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18099]:	connect to maila.pabw.at[62.116.143.21]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18086]:	connect to merseymail.com[82.98.86.171]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18086]:	E0BF646DAD: to=k.hickey@merseymail.com, relay=none, delay=4623, delays=4591/1.9/30/0, dsn=4.4.1, status=deferred (connect to merseymail.com[82.98.86.171]:25: Connection timed out)
Dec	16	11:56:30	server2	postfix/smtp[18099]:	DEB9446F74: to=atg@pab.asn-wien.ac.at, relay=none, delay=162285, delays=162253/1.9/30/0, dsn=4.4.1, status=deferred (connect to maila.pabw.at[62.116.143.21]:25: Connection timed out)
Dec	16	11:56:30	server2	postfix/smtp[18107]:	connect to kainclothing.com[199.59.243.105]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18046]:	421A7469EA: host mx5.telcordia.com[192.4.253.105] refused to talk to me: 421 Service not available, closing transmission channel
Dec	16	11:56:30	server2	postfix/smtp[18100]:	connect to mx2.mail.tiscali.co.uk[212.74.100.148]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18115]:	connect to homeworking.org.uk[82.98.86.171]:25: Connection timed out
Dec	16	11:56:30	server2	postfix/smtp[18114]:	connect to mx11.mailcontroller.co.uk[194.116.198.95]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18080]:	connect to email.co[82.98.86.171]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18115]:	8183C18D038: to=ann.foga@homeworking.org.uk, relay=none, delay=84535, delays=84503/2/30/0, dsn=4.4.1, status=deferred (connect to homeworking.org.uk[82.98.86.171]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18072]:	connect to mx4.mail.tiscali.co.uk[212.74.100.150]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18080]:	83C1D46F47: to=atenga@email.co, relay=none, delay=162296, delays=162264/2/30/0, dsn=4.4.1, status=deferred (connect to email.co[82.98.86.171]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18108]:	connect to mail.usitmail.com[216.46.184.45]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18108]:	0C20C47B30: to=ayjay@usitmail.com, relay=none, delay=161323, delays=161291/2.1/30/0, dsn=4.4.1, status=deferred (connect to mail.usitmail.com[216.46.184.45]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18046]:	421A7469EA: host mx4.telcordia.com[192.4.253.106] refused to talk to me: 421 Service not available, closing transmission channel
Dec	16	11:56:31	server2	postfix/smtp[18046]:	connect to dnsmx1pya.telcordia.com[128.96.20.31]:25: Connection refused
Dec	16	11:56:31	server2	postfix/smtp[18131]:	connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18041]:	connect to 17gib.fsnet.co[95.211.117.206]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18046]:	421A7469EA: to=asytnyk@mcscns.cc.telcordia.com, relay=none, delay=162364, delays=162331/1.7/31/0, dsn=4.4.1, status=deferred (connect to dnsmx1pya.telcordia.com[128.96.20.31]:25: Connection refused)
Dec	16	11:56:31	server2	postfix/smtp[18131]:	05A02467B1: to=katguest@ukonline.co.uk, relay=none, delay=3296, delays=3264/2.2/30/0, dsn=4.4.1, status=deferred (connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18135]:	connect to btconnect.co[213.123.20.106]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18135]:	1EB074702E: to=k.mchale@btconnect.co, relay=none, delay=4581, delays=4549/2.2/30/0, dsn=4.4.1, status=deferred (connect to btconnect.co[213.123.20.106]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18133]:	connect to php.ph[173.212.56.176]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18133]:	036C346F0B: to=k.loublouh@php.ph, relay=none, delay=4590, delays=4558/2.2/30/0, dsn=4.4.1, status=deferred (connect to php.ph[173.212.56.176]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18058]:	connect to gomersall1.fsnet.co[95.211.117.206]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18148]:	connect to williamhoe.karoo.co[82.98.86.164]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18119]:	connect to hgwalker.co.uk.vc[91.195.240.135]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18152]:	connect to homail.co.uk[212.227.87.14]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18148]:	5373A18C5E0: to=williamhoe@williamhoe.karoo.co, relay=none, delay=85720, delays=85688/2.3/30/0, dsn=4.4.1, status=deferred (connect to williamhoe.karoo.co[82.98.86.164]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18119]:	3C0E24688D: to=katescruby@hgwalker.co.uk.vc, relay=none, delay=3312, delays=3280/2.3/30/0, dsn=4.4.1, status=deferred (connect to hgwalker.co.uk.vc[91.195.240.135]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18152]:	3540A467A8: to=kates.curios@homail.co.uk, relay=none, delay=3315, delays=3283/2.3/30/0, dsn=4.4.1, status=deferred (connect to homail.co.uk[212.227.87.14]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18160]:	connect to capitallaw.co.uk.vc[91.195.240.135]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18123]:	connect to hotmai.co.uk[65.55.39.10]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18143]:	connect to msn.se[94.245.115.230]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18164]:	connect to capitallaw.co.uk.vc[91.195.240.135]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18160]:	C687E46EC5: to=k.morgan@capitallaw.co.uk.vc, relay=none, delay=4578, delays=4546/1.9/30/0, dsn=4.4.1, status=deferred (connect to capitallaw.co.uk.vc[91.195.240.135]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18143]:	C4D0E46E88: to=atacda92@msn.se, relay=none, delay=162354, delays=162322/1.9/30/0, dsn=4.4.1, status=deferred (connect to msn.se[94.245.115.230]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18164]:	C9EA146EA5: to=k.ifill@capitallaw.co.uk.vc, relay=none, delay=4618, delays=4586/1.9/30/0, dsn=4.4.1, status=deferred (connect to capitallaw.co.uk.vc[91.195.240.135]:25: Connection timed out)
Dec	16	11:56:31	server2	postfix/smtp[18125]:	connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out
Dec	16	11:56:31	server2	postfix/smtp[18125]:	C9D0318C6BC: to=krista.charters@ukonline.co.uk, relay=none, delay=85676, delays=85644/2/30/0, dsn=4.4.1, status=deferred (connect to ukonline.co.uk[87.84.222.86]:25: Connection timed out)
Dec	16	11:56:32	server2	postfix/smtp[18172]:	connect to clarke7779.fsnet.co[95.211.117.206]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18173]:	connect to atbud.se[83.226.173.117]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18173]:	2150246EDC: to=atbud.post@atbud.se, relay=none, delay=162330, delays=162298/2/30/0, dsn=4.4.1, status=deferred (connect to atbud.se[83.226.173.117]:25: Connection timed out)
Dec	16	11:56:32	server2	postfix/smtp[18153]:	connect to mail.activemail.co.uk[195.188.53.46]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18085]:	connect to wanadoo.co.uk[195.92.249.131]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18085]:	2AE684666E: to=katewills@wanadoo.co.uk, relay=none, delay=3302, delays=3270/2.1/30/0, dsn=4.4.1, status=deferred (connect to wanadoo.co.uk[195.92.249.131]:25: Connection timed out)
Dec	16	11:56:32	server2	postfix/smtp[18200]:	connect to cornhill.co.uk[165.160.13.20]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18128]:	connect to cornhill.co.uk[165.160.15.20]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18203]:	connect to capitallaw.co.uk.vc[91.195.240.135]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18150]:	connect to aol.cm[109.123.194.85]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18203]:	74144471C7: to=k.walsh@capitallaw.co.uk.vc, relay=none, delay=4511, delays=4479/2.2/30/0, dsn=4.4.1, status=deferred (connect to capitallaw.co.uk.vc[91.195.240.135]:25: Connection timed out)
Dec	16	11:56:32	server2	postfix/smtp[18126]:	connect to pmm.dnx.co.uk[195.10.226.216]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18196]:	connect to mx.ngfl.ac.uk[212.69.226.15]:25: Connection timed out
Dec	16	11:56:32	server2	postfix/smtp[18150]:	7052547959: to=vivgellini@aol.cm, relay=none, delay=84432, delays=84400/2.2/30/0, dsn=4.4.1, status=deferred (connect to aol.cm[109.123.194.85]:25: Connection timed out)
Dec	16	11:56:32	server2	postfix/smtp[18126]:	7A44218C2D9: to=pam@pmm.dnx.co.uk, relay=none, delay=350775, delays=350743/2.2/30/0, dsn=4.4.1, status=deferred (connect to pmm.dnx.co.uk[195.10.226.216]:25: Connection timed out)
Dec	16	11:56:32	server2	postfix/smtp[18106]:	0DA0547BE6: to=azapel@gawab.com, relay=none, delay=161261, delays=161228/2.2/31/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=gawab.com type=MX: Host not found, try again)
Dec	16	11:56:33	server2	postfix/smtp[18033]:	9EF8646E96: to=atahorses@alltel.net, relay=none, delay=162354, delays=162319/0.36/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=alltel.net type=MX: Host not found, try again)
Dec	16	11:56:36	server2	postfix/smtp[18101]:	1FCA646887: to=mon.christopher@heatex.co.uk, relay=none, delay=351642, delays=351605/2.2/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=heatex.co.uk type=MX: Host not found, try again)
Dec	16	11:56:36	server2	postfix/smtp[18195]:	24CB618C0BF: to=owugkik2ivlubnyrlvaeaaaaa@heatex.co.uk, relay=none, delay=352751, delays=352715/2.1/34/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=heatex.co.uk type=MX: Host not found, try again)
Dec	16	11:56:36	server2	postfix/smtp[18161]:	CDED818C2C5: to=quinn_wsneed_80@heatex.co.uk, relay=none, delay=352005, delays=351968/1.9/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=heatex.co.uk type=MX: Host not found, try again)
Dec	16	11:56:36	server2	postfix/smtp[18116]:	59E9146768: to=r.barnett@chesterzoo.co.uk, relay=none, delay=350959, delays=350922/2.3/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=chesterzoo.co.uk type=MX: Host not found, try again)
Dec	16	11:56:36	server2	postfix/smtp[18127]:	3276A18C357: to=rail@explorers.co.uk, relay=none, delay=352515, delays=352478/2.3/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=explorers.co.uk type=MX: Host not found, try again)
Dec	16	11:56:36	server2	postfix/smtp[18157]:	CE76118C48C: to=customer.service@caroline-hesse.co.uk, relay=none, delay=351857, delays=351820/1.9/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=caroline-hesse.co.uk type=MX: Host not found, try again)
Dec	16	11:56:36	server2	postfix/smtp[18140]:	C413B18CC19: to=pearshaped@theladsmag.co.uk, relay=none, delay=351921, delays=351884/2/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=theladsmag.co.uk type=MX: Host not found, try again)
Dec	16	11:56:37	server2	postfix/smtp[18202]:	7DCCF467B8: to=photo@londonercontacts.co.uk, relay=none, delay=350527, delays=350490/2.2/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=londonercontacts.co.uk type=MX: Host not found, try again)
Dec	16	11:56:37	server2	postfix/smtp[18205]:	7E0B218C21A: to=roma_a@rfdc.ac.uk, relay=none, delay=350874, delays=350837/2.2/35/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=rfdc.ac.uk type=MX: Host not found, try again)
Dec	16	11:56:41	server2	postfix/smtp[18074]:	5AAF018C234: lost connection with mx21.mailcontroller.co.uk[194.116.198.32] while receiving the initial server greeting
Dec	16	11:56:57	server2	postfix/smtpd[17995]	: warning: 88.86.101.3: address not listed for hostname www4.toplist.cz
Dec	16	11:56:57	server2	postfix/smtpd[17995]	: connect from unknown[88.86.101.3]
Dec	16	11:56:57	server2	postfix/smtpd[17995]	: 83C00465E7: client=unknown[88.86.101.3]
Dec	16	11:56:57	server2	postfix/cleanup[1805	2]: 83C00465E7: message-id=20131216105657.43029B060@www4.toplist.cz
Dec	16	11:56:57	server2	postfix/qmgr[12867]:	83C00465E7: from=report@toplist.cz, size=2130, nrcpt=1 (queue active)
Dec	16	11:56:57	server2	postfix/smtpd[17995]	: disconnect from unknown[88.86.101.3]
Dec	16	11:56:58	server2	postfix/smtp[18036]:	connect to gateway.net[64.12.89.186]:25: Connection timed out
Dec	16	11:56:59	server2	postfix/smtp[18042]:	connect to hotail.com[65.55.39.10]:25: Connection timed out
Dec	16	11:56:59	server2	postfix/smtp[18049]:	connect to mx1.mail.tiscali.co.uk[212.74.100.147]:25: Connection timed out
Dec	16	11:56:59	server2	postfix/smtp[18042]:	6964946E5F: to=a.tammelin@hotail.com, relay=none, delay=162375, delays=162314/0.94/60/0, dsn=4.4.1, status=deferred (connect to hotail.com[65.55.39.10]:25: Connection timed out)

[Chulda]

nabouranej web.

Někdo se naboural do webu a nahrál si tam vlastní skript. Už nevím, jestli ten spamuje nebo skrz něj. Našel bych si novější soubory nebo co tam nemá co dělat. A pak se podívat, skrz co se tam dostal (jinak to tam bude za chvíli znovu)

[Chulda]

nebo to jde najít tak, že do php.ini (php 5.3+) se přidá:

mail.add_x_header = On
mail.log = /var/log/phpmail.log

http://php.net/manual/en/mail.configuration.php

[halva-jr]

Díky. Takže jsem prošel logy všech webů a zaměřil jsem se na 11:56:00 16.12., kdy se podle mailů odesílalo něco z www-data. V tu dobu jsem nikde nic podezřelého neobjevil. Tak jsem prošel všechny weby a ani žádný nový soubor jsem v nich neobjevil. Jen jsem našel v jednom webu ve složce tmp strašný množství souborů nesmyslně pojmenovaných. A nejstarší byl z 15. nebo 16. prosince (už nevím). Tak jsem je všechny smazal a během chvilky tam byl další nový soubor. Práva pro zápis tam měli všichni. Tak jsem všem zakázal všechno pro tuto složku. Myslíte, že to mohlo být touto složkou? Nebo je moje úvaha úplně špatná?

[MMMMMMMMM]

Nedíval jste se v textovém editoru na obsah těch souborů?

[halva-jr]

Ne Jsem to ale vůl. Mám teda na chvilku povolit zápis a stáhnout nějaký soubor?

[Andy]

naposledy mi to nabouralo starou joomlu, pomohlo zapnuti server-status na apache a vysledovani co to dela.

[halva-jr]

Jenže na tom serveru je jediný redakční systém a to prestashop a teda ispconfig, ale ten asi nic dělat nemůže ne? Zbytek webů buď nic nemá, nebo jsem si to dělal sám a moc tam toho dělat nejde. Nahrávat soubory pouze do určitých složek a spravovat databáze, ale taky pouze některý tabulky, ne všechny a ne všechno.

[Andy]

zkus ten server-status .. me to primo vypisovalo ten soubor, kterej byl nacuzenej

[halva-jr]

Nasadim to. Uz jsem si nasel pekny navod takze jdu na to. Jinak pres noc opet odeslo pres 15000 emailu a v logu od php neni ani carka. Asi jsem to spatne zadal do php.ini nebo nevim. Je jedno kam se to tam napise nebo to musi mit presne umisteni? Dik za pomoc, uz jsem z toho fakt zoufalej.

[halva-jr]

Tak už se mi podařilo všechno správně nastavit. Už to zapisuje odesílání e-mailů z webu. Teď už jen čekat. Snad už to tedy bude v pohodě. Díky moc

[Sten]

V tmp bývají sessiony, kam se ukládá třeba obsah košíku, nastavení barev nebo jméno přihlášeného uživatele

[MMMMMMMMM]

o jaký server jde? co na něm běží? stane se něco, když se na něm na chvilku zakáže odesílání pošty (odchozí traffic na port 25)? kde je administrátor toho serveru? samé otázky :)

[halva-jr]

o jaký server jde? co na něm běží?

Běží na něm apache a pošťák. Cca do 10 webových stránek, 20 e-mailů.

stane se něco, když se na něm na chvilku zakáže odesílání pošty (odchozí traffic na port 25)?

Když to bude na chvilku (ne celý den, ale třeba přes noc), tak se nic nestane.

kde je administrátor toho serveru?

Já Normální člověk, který to má jako koníček a vždycky ho něco překvapí co by Vás asi ani nezpomalilo.

[MMMMMMMMM]

A server poštu odesílá i pro vzdálené klienty? Nebo jen slouží pro posílání e-mailů z localhostu?

main.cf:
mynetworks_style = host (povolí posílat poštu jen ze serveru, ne z "venku" - tedy zabrání relay open)

Jinak v logu (obvykle /var/log/maillog) zkusit mrknout a najít, z kama a kam byl posílán spam v inkriminovanou dobu. Může být třeba děravý některý web na serveru a zkrze něj se může šířit spam. Teoreticky se dá ten log porovnat s logem webového serveru ve stejném čase...

[halva-jr]

A server poštu odesílá i pro vzdálené klienty? Nebo jen slouží pro posílání e-mailů z localhostu?

Jestli to tedy dobře chápu, tak by měl jen z localhostu (jen pro ty weby co jsou hostované).

mynetworks_style = host (povolí posílat poštu jen ze serveru, ne z "venku" - tedy zabrání relay open)

Tuhle řádku v postfixu vůbec nemám. Mám ji tedy přidat?

Jinak v logu (obvykle /var/log/maillog) zkusit mrknout a najít, z kama a kam byl posílán spam v inkriminovanou dobu. Může být třeba děravý některý web na serveru a zkrze něj se může šířit spam. Teoreticky se dá ten log porovnat s logem webového serveru ve stejném čase...

Projdu logy. Pokud je tam děravý některý web, tak by neměl být problém to zjistit, protože každý odesílá z vlastní adresy (web1@, web2@ atd.). Jen je ten log dost velký, tak mi asi bude chvilku trvat ho stáhnout.

[MMMMMMMMM]

mrkněte sem: http://www.postfix.org/BASIC_CONFIGURATION_README.html#relay_from

[halva-jr]

Díky. Takže jsem na to koukal a v main.cf mám řádek mynetworks = 127.0.0.0/8 [::1]/128. Myslíte, že by bylo vhodnější nahradit ho za mynetworks_style = host? Nebo aspoň odmáznout [::1]/128? To mi tam nějak nic moc neříká a ani v tom popisu konfigurace o tom nic není.

[MMMMMMMMM]

Tak to je v pořádku, takto nastavený server by neměl být open relay. Takže to vypadá, že spam zasílal nabouraný web (např. nějaký redakční systém).

[halva-jr]

Jenže ani z logů ani když jsem prošel všechny soubory ve všech webech tak jsem kromě těch souborů v tmp nenašel nic podeřelého a ani žádný nový nebo změněný soubor

[Carth_Onasi]

Ahoj,

Doporučuji tento návod.

Postav nový server, nová pravidla... Tvoje IP adresa, pokud se dostane do blacklistu, tak budeš víc (na Google Mailu) jak měsíc čekat, než tě smaže. Nebo už tam jsi.

Pak musíš hrát s pravidly, procházet stovky stránek, instalovat Razor, Pyzor, SPF politiku, DCC,...

Je toho hodně a mohu dat pár nápadů, ale začni to řešit.

[halva-jr]

Ahoj,

díky za návod, pokud budu předělávat tak už to určitě hodím do něčeho novýho Já to tenkrát stavěl podle tohohle.

On už nějaký pátek ten server funguje. Už si to přesně nepamatuju, ale myslím že to bude již víc než rok co bez problému jede. Sem tam se už samozřejmě na nějakým blacklistu objevil, ale teď že už upozorňoval i provider, tak mi připadá, že to bude asi něco závažnější.

[halva-jr]

Takže od této chvíle se začalo zpomalovat připojení k internetu. Komplet všechno. A je to každý den tak nějak podobně. Viděl bych to, že se tam asi někdo přihlašuje že? Mám třeba na nějakou dobu zakázat port SMTP?

[Petr Šobáň]

Nějak nechápu co řešíš jako první zastavit postfix a hotovo.

Pak vyčistit www který je napaden.

[halva-jr]

Pravda Dík.

Aktuálně pomohl restart routeru. Mohla to být jen nějaká chyba.

Řeším ale to, že nevím, který web je napadený a nevím jak na to přijít.

[Petr Šobáň]

Z logu vydedukovat kdo to posílá.

Jinak proč www servery musí posílat maily? Většinou je tam jako odesílatel kdo podle toho třeba začít pátrat.

Další věc třeba udělat nějaké omezení že www server může odeslat jeden mail za minutu a pod...že jako příjemce může být pouze jeden účet a né 100 uživatelů a pod....

[MMMMMMMMM]

Jak psal kolega výše, pokud je na serveru PHP 5.3 a novější, tak http://blog.rimuhosting.com/2012/09/20/finding-spam-sending-scripts-on-your-server/

[MMMMMMMMM]

případně skvělý návod, jak lokalizovat skripty, která odesílají e-maily přes webový server http://rackerbox.com/wiki/index.php/PHP_sendmail_wrapper (sám to jdu na svůj server nasadit)

[halva-jr]

OK. Takže toto jsem nasadil a zkusím dodat i ten skript níže.

Jinak dnešní den byl docela pozitivní Odeslalo se "pouze" 550 e-mailů (i tak víc než odešlou jen uživatelé, ale zbytek snad odhalí nasazené skripty). Jinak chvilku před dvanáctou (to se v předchozích dnech začali odesílat spamy) spadnul router, který jsme nechali cca 10 minut vypnutý a pak normálně vše naběhlo a funguje to. Můžete to mít všechno nějakou souvislost?

Díky

[lertimir]

To máš ještě celkem slušný. Nedávno byl incident, kdy patrně keyloger nasazený v počítači uživatele odeslal spambotu legální přihlašovací kody a spambot se legálně přihlásil a poslal přes 5000 mailu, každý s 100 položkami v RCPT TO:, než to správci chytli.

[halva-jr]

Dobrý den,

tak se mi konečně po několika dnech podařilo asi identifikovat odkud odchází SPAM, ale potřebuji ještě pomoc.

Nainstaloval jsem program maldet, který odstranil několik souborů. Poté kleslo odesílání spamu na půlku (ale pokračovalo dál). No a včera opět vylítlo asi na 50 000 mailů. A toto odeslání bylo první, co zachytil log, takže se opravdu odeslal z webu. Vše odešlo ze souboru /var/tmp/.lol/x.php, který tam ale vůbec není. Předtím soubory, které odstranil maldet, byly také v tmp. Můžete mi prosím poradit jak se tam ten soubor vytvoří a pak se zase odstraní a hlavně jak se do něj někdo dostane? Asi můžu zakázat přístupová práva do tohoto adresáře, ale připadá mi, že tím nevyřeším příčinu.

Děkuji Vám za pomoc.

[Jendа]

Nejspíš tam máš nějakou děravou PHP aplikaci, přes kterou tam útočník nahrál soubor (do tmp), který potom volá a odesílá tím maily.

[halva-jr]

Aha. Ale jak přijít na to, která je děravá? Myslel jsem si třeba, že bych podle času vytvoření toho souboru prošel pak logy kdy tam někdo něco dělal, jenže nemám ten soubor. Nenapadá Vás nějaký další nápad jak na to přijít? Děkuji

[Jendа]

Grepneš logy na název toho souboru… Jinak nejlepší je mít PHP nějak oddělené pro každý web a pak to je vidět…

[halva-jr]

Aha. Dobrý nápad. Zkusím. Třeba se něco objeví. Díky

[lertimir]

Já bych to viděl skoro na přeinstalaci systému. Tohle se bude hodně těžko hledat. Zabývám se bezpečností z té ochranné části, ale moje představa chování, které popisujete je následovná:

1. Útočník vezme nějaký standardní php modul (modul 1), který na tom CMS systému je. Dodá do něj nový kód, který při volání s nějakou jinou sadou parametrů, než je standardní, provede útok.
2. Vlastní útok provede tak, že vygeneruje nový php script (modul 2), který provede vlastní rozesílání a po ukončení běhu jej smaže. Tím nebude v logu poznat, kdo je fakticky zdroj útoku.
3. Obsah dopisu a seznam adres si skript buď stáhne aktivně sám nebo najde povolený port ve firewalu a otevřeho. Možné je poslat dopis i seznam adres do modulu 1, třeba přes POST, ale to je nápadnější.

Z hlediska access logu to bude v podstatě nenápadné, normální zavolání používaného php. Najít se to dá, snad jedině projítím všech php souborů na serveru a jejich kontrolou s originály. Možná by se dalo postavit na serveru zcela nový apache s potřebnými CMS, na nějakém nestandardním portu a tento nový web porovnat s tím původním. Jak se ten upravený modul tam dostal je jiná věc. Vhodné je mít pro takto veřejný systém uložené hashe jednotlivých souborů a tak je mít možnost zkontrolovat.

[halva-jr]

Příloha:

• maldet.jpg (43710 bytů)

Aha. Tak asi nebude problém komplet přeinstalovat. Ale aby se to zase nevrátilo za chvilku zpátky kde to bylo Aktuálně akorát tedy potřebuji zabránit dalšímu rozesílání. Můžete mi prosím poradit jak tomu zabránit ale se zachováním všech funkcí? Nebo je to nemožné?

V příloze ještě posílám co mi našel maldet. Jen podotýkám, že včera ráno byl server čistý.

Děkuji

[Chulda]

A co to tsunami v /dev, to není problém? Google letmým dotazem vrátí např. tohle, kde se uvádí, že tento program se spouští přes cron a generuje php, které se pak maže atd.

Jestli je to opravdu on, tak hledání php je k ničemu - problém to nevyřeší.

Ovšem najít, skrz co tam prošli, může být docela problém - asi je lepší provést novou instalaci všeho, překopírovat uživatelská data a doufat, že v nich problém není.

[lertimir]

Ano. tohle je podobné. jen v tom mém schématu nebude v bodu 1 php script, ale jiná binárka spuštěná navíc cronem. Klidně to může být binárka, která bude sebe sama spouštět pomocí at.

[halva-jr]

OK. Mezi svátky přeinstaluji. Díky moc. Jinak se mi zatím nějak podařilo zamezit dalšímu rozesílání e-mailů různou změnou přístupových práv do složek a k souborům.

Díky a všem přeji krásné svátky

[Chulda]

To je otázka, na to tsunami jsem koukal jen zběžně, ale umí toho docela dost, takže si může poradit s různými opatřeními. A taky záleží na tom, pod jakým uživatelem to spouští.

Napadlo mě, že by mohl pomoc např. whitelist odesílaných domén/adres pro postfix (IMHO umí, ale nikdy jsem to nepotřeboval) anebo selinux (google na rychlý dotaz ale nic zajímavého nevrátil).

[halva-jr]

Aha, takže myslíte udělat seznam povolených odesílatelů? Teď koukám, že ISP config to umožňuje a že e-maily, které byly odeslány jako SPAM byly z www-data@server2.... a když je to ze stránek tak tam je odesílatel vždy web1@server2..., web2@, web3 apod., takže ty spamy byly odeslány z e-mailu, který vlastně nikdo nepoužívá. Takže ten nepovolit? Nebo jen ten přidat do černé listiny odesílatelů?

Díky

[Chulda]

To bude velmi pravděpodobně blacklist příchozí pošty. Tady se jedná o odeslanou poštu. podle rychlého googlování je potřeba upravit přímo konfigurák postfixu ručně (asi to nejde nastavit přes ispconfig)

(discard) domain XYZ.TLD to send email with postfix use this in the /etc/postfix/header_checks

/^From: .*@XYZ\.TLD>/ DISCARD

[halva-jr]

Super. Díky moc za návod. Tohle tam přidám (isp config to fakt má pro příchozí poštu)

[kua]

..po precteni teto diskuse..ja bych doporucil vyhodit admina. Jako sorry, ale pak to vypada, jak to vypada..

[halva-jr]

Tak to sis ji asi nečetl celou. Ale jinak díky za nabídku

[nazaplakanie]

Ved toto, fakt na zaplakanie. Chlapce, musis aj porozmyslat trochu, nie vsetko sa da niekde vygooglit.