어느 부분이 스패머인지 알려 주세여!!!
스팸 메일 온 것을 원문 그대로 올립니다.
고수님들 함 보시고요. 어느 부분이 스패머 메일인지
좀 알려 주세요.
그리고 sendmail 에서 access 를 수정하고 db를 새로
만들어 주었는데도 계속 메일이 들어오거든요.
(메일을 임의로 등록하고 테스트 해보았슴)
다른 부분도 확인해봐야 하는 데가 있나요?
고수님들 함 부탁합니다.
Return-Path
Received from localhost (localhost)
by saenuri.co.kr (8.9.3/8.9.3) with internal id NAE18520;
Mon, 12 Nov 2001 130448 +0900
Date Mon, 12 Nov 2001 130448 +0900
From Mail Delivery Subsystem
Message-Id <200111120404.NAE18520@saenuri.co.kr>
To postmaster@saenuri.co.kr
MIME-Version 1.0
Content-Type multipart/report; report-type=delivery-status;
boundary="NAE18520.1005537888/saenuri.co.kr"
Subject Postmaster notify User unknown
Auto-Submitted auto-generated (postmaster-notification)
X-UIDL c621407a4a037c658fb74c63d11f4bf0
This is a MIME-encapsulated message
--NAE18520.1005537888/saenuri.co.kr
The original message was received at Sun, 11 Nov 2001 035448 +0900
from localhost
----- The following addresses had permanent fatal errors -----
----- Transcript of session follows -----
... while talking to smtp.webmail.aport.ru.
>>> RCPT To
<<< 553 No mailbox here by that name, sorry (#5.7.1)
550 ... User unknown
--NAE18520.1005537888/saenuri.co.kr
Content-Type message/delivery-status
Reporting-MTA dns; saenuri.co.kr
Arrival-Date Sun, 11 Nov 2001 035448 +0900
Final-Recipient RFC822; f11887@au.ru
Action failed
Status 5.1.1
Remote-MTA DNS; smtp.webmail.aport.ru
Diagnostic-Code SMTP; 553 No mailbox here by that name, sorry (#5.7.1)
Last-Attempt-Date Mon, 12 Nov 2001 130447 +0900
--NAE18520.1005537888/saenuri.co.kr
Content-Type message/rfc822
Return-Path
Received from localhost (localhost)
by saenuri.co.kr (8.9.3/8.9.3) with internal id UAG12674;
Sun, 11 Nov 2001 035448 +0900
Date Sun, 11 Nov 2001 035448 +0900
From Mail Delivery Subsystem
Message-Id <200111101854.UAG12674@saenuri.co.kr>
To
MIME-Version 1.0
Content-Type multipart/report; report-type=delivery-status;
boundary="UAG12674.1005418488/saenuri.co.kr"
Subject Returned mail Cannot send message within 5 days
Auto-Submitted auto-generated (failure)
This is a MIME-encapsulated message
--UAG12674.1005418488/saenuri.co.kr
The original message was received at Tue, 6 Nov 2001 035005 +0900
from dialup-209.244.95.11.Dial1.Dallas1.Level3.net [209.244.95.11]
----- The following addresses had permanent fatal errors -----
----- Transcript of session follows -----
,,,
hwarb.com>,,... Deferred
Connection timed out with minimail.tcsn.net.
... Deferred Connection timed out with
gateway.kwantlen.bc.ca.
451 ... reply read error from lincs.net.
... Deferred Connection reset by lincs.net.
... Deferred Connection timed out with
smtp.lapcopaintball.com.
... Deferred Connection timed out with
world.std.com.
Message could not be delivered for 5 days
Message will be deleted from queue
--UAG12674.1005418488/saenuri.co.kr
Content-Type message/delivery-status
Reporting-MTA dns; saenuri.co.kr
Arrival-Date Tue, 6 Nov 2001 035005 +0900
Final-Recipient RFC822; tduane@schwarb.com
Action failed
Status 4.4.7
Remote-MTA DNS; minimail.tcsn.net
Last-Attempt-Date Sun, 11 Nov 2001 033553 +0900
Final-Recipient RFC822; larro@schwarb.com
Action failed
Status 4.4.7
Remote-MTA DNS; minimail.tcsn.net
Last-Attempt-Date Sun, 11 Nov 2001 033553 +0900
Final-Recipient RFC822; patk@kwantlen.bc.ca
Action failed
Status 4.4.7
Remote-MTA DNS; gateway.kwantlen.bc.ca
Last-Attempt-Date Sun, 11 Nov 2001 033902 +0900
Final-Recipient RFC822; grjoh@schwarb.com
Action failed
Status 4.4.7
Remote-MTA DNS; minimail.tcsn.net
Last-Attempt-Date Sun, 11 Nov 2001 033553 +0900
Final-Recipient RFC822; patk@lincs.net
Action failed
Status 4.4.7
Remote-MTA DNS; lincs.net
Last-Attempt-Date Sun, 11 Nov 2001 033903 +0900
Final-Recipient RFC822; patk@lapcopaintball.com
Action failed
Status 4.4.7
Remote-MTA DNS; smtp.lapcopaintball.com
Last-Attempt-Date Sun, 11 Nov 2001 034830 +0900
Final-Recipient RFC822; michaelt@world.com
Action failed
Status 4.4.7
Remote-MTA DNS; world.std.com
Last-Attempt-Date Sun, 11 Nov 2001 035448 +0900
Final-Recipient RFC822; bettelue@schwarb.com
Action failed
Status 4.4.7
Remote-MTA DNS; minimail.tcsn.net
Last-Attempt-Date Sun, 11 Nov 2001 033553 +0900
Final-Recipient RFC822; bettels@schwarb.com
Action failed
Status 4.4.7
Remote-MTA DNS; minimail.tcsn.net
Last-Attempt-Date Sun, 11 Nov 2001 033553 +0900
Final-Recipient RFC822; bettelsp@schwarb.com
Action failed
Status 4.4.7
Remote-MTA DNS; minimail.tcsn.net
Last-Attempt-Date Sun, 11 Nov 2001 033553 +0900
--UAG12674.1005418488/saenuri.co.kr
Content-Type message/rfc822
Return-Path
Received from personal.ro (dialup-
209.244.95.11.Dial1.Dallas1.Level3.net [209.244.95.11])
by saenuri.co.kr (8.9.3/8.9.3) with SMTP id DAA14840;
Tue, 6 Nov 2001 035005 +0900
From f11887@au.ru
Message-Id <200111051850.DAA14840@saenuri.co.kr>
To
Subject Give a Boost to the Reliability of Windows!!!!
Date Mon, 05 Nov 2001 135910 -0400
MIME-Version 1.0
Content-Type text/html;
charset="iso-8859-1"
Content-Transfer-Encoding quoted-printable
X-Priority 3
X-MSMail-Priority Normal
X-Mailer Microsoft Outlook Express 5.00.2615.200
X-MimeOLE Produced By Microsoft MimeOLE V5.00.2615.200
<body> <p>Dear Windows User,<br> <br> Now you can boost the reliability of ordinary Windows 95, 98 and ME to nea= rly the level of Windows NT or 2000, Microsoft's professional and industrial v= ersion of Windows.<br> <br> The new WinFix is a very effective way to improve the reliability of Windo= ws, because it makes Windows fault-tolerant and self-repairing.<br> <br> And WinFix is very safe, because it operates completely independent of Win= dows.<br> <br> <u><font color=3D"#0000ff"><a href=3D"http//three.alive101.com/">CLICK HE= RE</a></font></u> to find out more about WinFix, the safest, most effectiv= e way to keep you working, by keeping your PC working non-stop.<br> <br> Arlen Dixon, CEO<br> Pinewood Software Marketing<br> <br> -------------------------------------------------------<br> <br> This announcement is intended for PC users who asked to be kept<br> informed about new developments in Windows technology.<br> </p> <p><font size=3D"1">We apologize for any email you may have inadvertently received.<br> Please <a href=3D"http//four.alive101.com">CLICK HERE</a> to be removed f= rom future mailings.</font></p> </body>
--UAG12674.1005418488/saenuri.co.kr--
--NAE18520.1005537888/saenuri.co.kr--
[참고]: 어느 부분이 스패머인지 알려 주세여!!!
안철수 바이러스 연구소의 컬럼에 스팸메일 추적에 관한 글이 아주 자세히 나
와 있습니다.
참고하시기를...
홈페이지 맨 아래 베스트 강좌라는 글입니다.
http//www.ahnlab.com
Re: 어느 부분이 스패머인지 알려 주세여!!!
내용을 읽어보니 mailer daemon이 보낸 메일 등등이
한꺼번에 있어서 보기 나쁘군요.
어쨋거나 중요한 것은 다이얼업 모뎀을 쓰는 누군가가
메일을 보냈다는 것이고, ip 어드레스를 알 수 있습니다.
따라서, 방화벽을 쓰고 계신다면 해당 ip 어드레스 영역을
전부 drop 시키면 될 것입니다. 방화벽을 안 쓴다면
TCP wrapper로 25번 포트를 연결하고 (이건 쉽겠죠?)
해당 어드레스 영역을 deny에 추가해놓으면 되겠습니다.
저도 다이얼업 모뎀이나 ADSL, 케이블 모뎀을 쓰는 사람들이
자신의 PC로 스팸 메일을 발신 또는 중계하는 것을 받다가
수시로 이름을 바꾸어 메일을 보내는 통에 아예 이쪽 IP 어드레스 영역을
전부 막아놓고 있습니다.
일일이 access.db에 추가한다는 것은 너무 어려운 일이지요.
이런 것은 procmail에 필터를 만들어 자동으로 access.db에
메일 주소가 추가되도록 해놓아야 합니다.
그럼.
댓글 달기