2

Here is the packet capture of how the attacker is coming to my server and generating Huge amount of spam, i am not able to block it by any means.

 220 mta1497.mail.ne1.yahoo.com ESMTP YSmtpProxy service ready
EHLO amsonere.co.uk
250-mta1497.mail.ne1.yahoo.com
250-8BITMIME
250-SIZE 41943040
250 PIPELINING
MAIL FROM:<craigwright@straygoat.com>
250 sender <craigwright@straygoat.com> ok
RCPT TO:<ddogg_730@yahoo.com>
250 recipient <ddogg_730@yahoo.com> ok
DATA
354 go ahead
Received: (qmail 3346 invoked from network); 7 May 2013 16:31:47 +0100
Received: from dsl-189-139-37-42-dyn.prod-infinitum.com.mx (HELO vdatbgpawos) (189.139.37.42)
  by amsonere.co.uk with SMTP; 7 May 2013 16:31:46 +0100
From: "fegody zaneze" <craigwright@straygoat.com>
To: <ddogg_730@yahoo.com>, <ol.e.et.h.omas.rn.sp@gmail.com>, <foettle@hotmail.com>, <srandolph24@netscape.net>, <jerry.m.rodriguez@gmail.com>
Date: Tue, 7 May 2013 17:27:50 -0700
Subject: SHOWE RINGt itsjo b
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-2

nop, qi
ruqifaz p http://metal-surface.fr/Knee-highs.html
  .
250 ok dirdel
QUIT
221 mta1497.mail.ne1.yahoo.com

What type of attack is this? it is coming from hundreds of IP addresses. i cannot block thousands of IP addresses. I am using Qmail on Plesk

Here are logs in /usr/loca/psa/var/log/maillog

   May  8 20:19:31 argon qmail-queue-handlers[28923]: Handlers Filter before-queue for qmail started ...
May  8 20:19:31 argon qmail-queue-handlers[28924]: Handlers Filter before-queue for qmail started ...
May  8 20:19:32 argon qmail-queue-handlers[28924]: from=faw@straygoat.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=fl4pperj4ck@live.co.uk
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=charliemunoz@sbcglobal.net
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=juanjaviervb@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=tdcharris88@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=simoncsmyth@googlemail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=venanciog7@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: to=bedo_101_1@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28924]: hook_dir = '/var/qmail//handlers/before-queue'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[3] = 'fl4pperj4ck@live.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/fl4pperj4ck@live.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[4] = 'charliemunoz@sbcglobal.net'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/charliemunoz@sbcglobal.net'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[5] = 'juanjaviervb@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/juanjaviervb@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[6] = 'tdcharris88@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/tdcharris88@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[7] = 'simoncsmyth@googlemail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/simoncsmyth@googlemail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[8] = 'venanciog7@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/venanciog7@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: recipient[9] = 'bedo_101_1@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28924]: handlers dir = '/var/qmail//handlers/before-queue/recipient/bedo_101_1@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: from=muju@straygoat.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=duligongcaonimei@sina.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=cclousingcci@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=bin1800dc@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=peggygonzalez964@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=buddiezno@aol.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=mick@sharnock.fsworld.co.uk
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=nmaurice.white871@gmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=saf509@hotmail.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: to=veronica_lopez10@yahoo.com
May  8 20:19:32 argon qmail-queue-handlers[28923]: hook_dir = '/var/qmail//handlers/before-queue'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[3] = 'duligongcaonimei@sina.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/duligongcaonimei@sina.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[4] = 'cclousingcci@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/cclousingcci@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[5] = 'bin1800dc@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/bin1800dc@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[6] = 'peggygonzalez964@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/peggygonzalez964@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[7] = 'buddiezno@aol.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/buddiezno@aol.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[8] = 'mick@sharnock.fsworld.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/mick@sharnock.fsworld.co.uk'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[9] = 'nmaurice.white871@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/nmaurice.white871@gmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[10] = 'saf509@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/saf509@hotmail.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: recipient[11] = 'veronica_lopez10@yahoo.com'
May  8 20:19:32 argon qmail-queue-handlers[28923]: handlers dir = '/var/qmail//handlers/before-queue/recipient/veronica_lopez10@yahoo.com'
Farhan
  • 4,269
  • 11
  • 49
  • 80

1 Answers1

7

As i see that's not the attacker coming to your server, its your server sending the mail to yahoo.
You either are open relay, or they are exploiting a weak password and injecting the mail's with SMTP auth.

Sandor Marton
  • 1,564
  • 9
  • 12
  • how to investigate that what is doing this? any idea? – Farhan May 07 '13 at 16:33
  • 1
    Not sure how qmail logs auth's, so maybe do a packet capture (tcpdump -n -i interface host YOUR.SERVER.IP and port 25 ), and see if the SMTP conversations have any AUTH PLAIN lines, if yes, run the arguments through a base64 decoder to get the usernames used for SMTP auth – Sandor Marton May 07 '13 at 16:55
  • maybe do a grep for 'smtp_auth' in /usr/local/psa/var/log/maillog – Sandor Marton May 07 '13 at 16:56
  • I have edited the question, the logs for maillog, if you can look into it? – Farhan May 08 '13 at 19:21
  • Looks like you are relaying without them doing any auth. But i don't really use Plesk with qmail, so i'm not sure if smtp_auth supposed to show up in the log or not. Maybe switch to postfix if you don't have any custom config ( via ssh : /usr/local/psa/admin/sbin/autoinstaller --select-release-current --install-component postfix ) – Sandor Marton May 08 '13 at 21:03