Posiadam domenę www.swos.pl i jest to strona zawierająca interesujące informacje na temat Sensible World of Soccer, ale nie w tym rzecz.
portal udostępnia wysyłanie poczty tylko za pomocą panelu Admina - a administratorów jest aż 3.
na domenę stworzyłem skrzynkę mail opartą na Google Apps, gdzie są wpisani konkretni ludzie.
Dlaczego Spamerzy wzieli sobie na cel akurat tą domenę ? Z kilku jakich posiadam i administruje np. podobna do niej jest www.sensiman.pl (tylko dużo starsza) - założona w tym samym portalu i ten sam hosting, ale mimo to SPAMerzy uwzieli się na tą krótszą.
Dostaje takie emaile:
Cytat
**Message you sent blocked by our bulk email filter**
Your message to: daniele.genner@theresianum.ac.at
was blocked by our Spam Firewall. The email you sent with the following subject has NOT BEEN DELIVERED:
Subject: derimell
Final-Recipient: rfc822; daniele.genner@theresianum.ac.at
Action: failed
Status: 5.7.1
Diagnostic-Code: smtp; 550 5.7.1 Message content rejected, UBE, id=08986-02
Last-Attempt-Date: Sun, 20 Jan 2008 21:18:20 +0100 (CET)
Your message to: daniele.genner@theresianum.ac.at
was blocked by our Spam Firewall. The email you sent with the following subject has NOT BEEN DELIVERED:
Subject: derimell
Final-Recipient: rfc822; daniele.genner@theresianum.ac.at
Action: failed
Status: 5.7.1
Diagnostic-Code: smtp; 550 5.7.1 Message content rejected, UBE, id=08986-02
Last-Attempt-Date: Sun, 20 Jan 2008 21:18:20 +0100 (CET)
lub w postaci plain
Cytat
Delivered-To: destiny1@swos.pl
Received: by 10.141.84.5 with SMTP id m5cs110830rvl;
Sun, 20 Jan 2008 17:20:37 -0800 (PST)
Received: by 10.100.34.16 with SMTP id h16mr13343100anh.114.1200878437040;
Sun, 20 Jan 2008 17:20:37 -0800 (PST)
Return-Path: <>
Received: from Mailin1.klgates.com (mailin1.klgates.com [12.4.231.161])
by mx.google.com with ESMTP id 3si8374947wrs.2.2008.01.20.17.20.36;
Sun, 20 Jan 2008 17:20:37 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of Mailin1.klgates.com designates 12.4.231.161 as permitted sender) client-ip=12.4.231.161;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of Mailin1.klgates.com designates 12.4.231.161 as permitted sender) smtp.mail=
Date: Sun, 20 Jan 2008 17:20:36 -0800 (PST)
Message-Id: <4793f364.0313360a.403f.0c12SMTPIN_ADDED@mx.google.com>
To: destiny1@swos.pl
Subject: Returned Mail
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="=====mte=boundary=number=1====="
--=====mte=boundary=number=1=====
Content-Type: text/plain; charset="US-ASCII"
Your message could not be delivered for the following reasons.
The e-mail system was unable to deliver the message, but did not report a specific reason. Check the address and try again. If it still fails, contact your system administrator.
--=====mte=boundary=number=1=====
Content-Type: message/delivery-status
Reporting-MTA: dns; Mailin1
Final-Recipient: rfc822; jimwann@prestongates.com
Action: failed
Status: 5.0.0
--=====mte=boundary=number=1=====
Content-Type: text/rfc822-headers
X-AuditID: c0a8010f-00000ab8000006a0-72-4793f29d20ff
Received: from 201-0-26-178.dsl.telesp.net.br ([201.0.26.178]) by Mailin1.klgates.com with Microsoft SMTPSVC(6.0.3790.1830);
Sun, 20 Jan 2008 20:17:16 -0500
Received: by 10.85.207.79 with SMTP id pQUDwYOHmVjAO;
Sat, 22 Dec 2007 14:41:24 -0200 (GMT)
Received: by 192.168.70.52 with SMTP id cbThvKaNSpyjFk.9063777696016;
Sat, 22 Dec 2007 14:41:22 -0200 (GMT)
Message-ID: <C4BF5EC2.49659509@swos.pl>
Date: Sat, 22 Dec 2007 14:41:19 -0200
From: <destiny1@swos.pl>
User-Agent: Thunderbird 2.0.0.0 (Windows/20070326)
MIME-Version: 1.0
To: jimwann@prestongates.com
Subject: derboeuf
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
--=====mte=boundary=number=1=====--
Received: by 10.141.84.5 with SMTP id m5cs110830rvl;
Sun, 20 Jan 2008 17:20:37 -0800 (PST)
Received: by 10.100.34.16 with SMTP id h16mr13343100anh.114.1200878437040;
Sun, 20 Jan 2008 17:20:37 -0800 (PST)
Return-Path: <>
Received: from Mailin1.klgates.com (mailin1.klgates.com [12.4.231.161])
by mx.google.com with ESMTP id 3si8374947wrs.2.2008.01.20.17.20.36;
Sun, 20 Jan 2008 17:20:37 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of Mailin1.klgates.com designates 12.4.231.161 as permitted sender) client-ip=12.4.231.161;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of Mailin1.klgates.com designates 12.4.231.161 as permitted sender) smtp.mail=
Date: Sun, 20 Jan 2008 17:20:36 -0800 (PST)
Message-Id: <4793f364.0313360a.403f.0c12SMTPIN_ADDED@mx.google.com>
To: destiny1@swos.pl
Subject: Returned Mail
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="=====mte=boundary=number=1====="
--=====mte=boundary=number=1=====
Content-Type: text/plain; charset="US-ASCII"
Your message could not be delivered for the following reasons.
The e-mail system was unable to deliver the message, but did not report a specific reason. Check the address and try again. If it still fails, contact your system administrator.
--=====mte=boundary=number=1=====
Content-Type: message/delivery-status
Reporting-MTA: dns; Mailin1
Final-Recipient: rfc822; jimwann@prestongates.com
Action: failed
Status: 5.0.0
--=====mte=boundary=number=1=====
Content-Type: text/rfc822-headers
X-AuditID: c0a8010f-00000ab8000006a0-72-4793f29d20ff
Received: from 201-0-26-178.dsl.telesp.net.br ([201.0.26.178]) by Mailin1.klgates.com with Microsoft SMTPSVC(6.0.3790.1830);
Sun, 20 Jan 2008 20:17:16 -0500
Received: by 10.85.207.79 with SMTP id pQUDwYOHmVjAO;
Sat, 22 Dec 2007 14:41:24 -0200 (GMT)
Received: by 192.168.70.52 with SMTP id cbThvKaNSpyjFk.9063777696016;
Sat, 22 Dec 2007 14:41:22 -0200 (GMT)
Message-ID: <C4BF5EC2.49659509@swos.pl>
Date: Sat, 22 Dec 2007 14:41:19 -0200
From: <destiny1@swos.pl>
User-Agent: Thunderbird 2.0.0.0 (Windows/20070326)
MIME-Version: 1.0
To: jimwann@prestongates.com
Subject: derboeuf
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
--=====mte=boundary=number=1=====--
i inne takie gdzie dziwaczne odpowiedzi w postaci Deliverów, Returnów, Requestów
na adresy:
denadssds@swos.pl
bvcvjdsjs@swos.pl
weowiew@swos.pl
qoaisssssf@swos.pl
i inne takie ...
nigdy nie na
adresy które stosuje (chyba ze konretny SPAM na mój adres: tomplus[at]swos.pl)
i teraz pytanie, czy da się jakoś uratować moją domenę żeby Spamer odczepił się od niej i nie wysyłał nieautoryzowanych emailii ?
? wygląda jakby z niego szły te maile - ale nic pewnego, bo większość trojanów fałszuje w nagłówku pole FROM trak żeby nie można było tego wyłapać...