спам рассылка, найти и наказать

Exim (reject.log):

2014-07-23 16:38:11 login authenticator failed for 79.142.46.196.static.impol.net (mnsmbizelc) [196.46.142.79]: 535 Incorrect authentication data
2014-07-23 16:38:11 cram authenticator (CRAM-MD5):
  Cyrus SASL permanent failure: user not found
2014-07-23 16:38:11 cram authenticator failed for 79.142.46.196.static.impol.net (mnsmbizelc) [196.46.142.79]: 535 Incorrect authentication data
2014-07-23 17:05:57 plain authenticator (PLAIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 17:05:57 plain authenticator failed for 203-113-206-105-static.tcs.netspace.net.au (ijoxofeyjz) [203.113.206.105]: 535 Incorrect authentication data
2014-07-23 17:05:58 login authenticator (LOGIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 17:05:58 login authenticator failed for 203-113-206-105-static.tcs.netspace.net.au (ijoxofeyjz) [203.113.206.105]: 535 Incorrect authentication data
2014-07-23 17:05:59 cram authenticator (CRAM-MD5):
  Cyrus SASL permanent failure: user not found
2014-07-23 17:05:59 cram authenticator failed for 203-113-206-105-static.tcs.netspace.net.au (ijoxofeyjz) [203.113.206.105]: 535 Incorrect authentication data
2014-07-23 17:23:50 login authenticator (LOGIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 17:23:50 login authenticator failed for s15433869.onlinehome-server.com (User) [74.208.72.28]: 535 Incorrect authentication data
2014-07-23 17:42:26 H=mail.craftsite.co.uk [66.155.18.68] F=<mfvt@show-master.ru> rejected RCPT <info@XXXXXXXXXXX3.ru>: relay not permitted
2014-07-23 18:03:09 login authenticator (LOGIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 18:03:10 login authenticator failed for select64.lnk.telstra.net (User) [203.45.217.245]: 535 Incorrect authentication data
2014-07-23 18:08:15 plain authenticator (PLAIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 18:08:15 plain authenticator failed for (tqkltbzihl) [223.255.191.92]: 535 Incorrect authentication data
2014-07-23 18:08:16 login authenticator (LOGIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 18:08:16 login authenticator failed for (tqkltbzihl) [223.255.191.92]: 535 Incorrect authentication data
2014-07-23 18:08:16 cram authenticator (CRAM-MD5):
  Cyrus SASL permanent failure: user not found
2014-07-23 18:08:16 cram authenticator failed for (tqkltbzihl) [223.255.191.92]: 535 Incorrect authentication data
2014-07-23 18:46:19 plain authenticator (PLAIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 18:46:19 plain authenticator failed for (tbzguqfppa) [188.135.8.47]: 535 Incorrect authentication data
2014-07-23 18:46:19 login authenticator (LOGIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 18:46:19 login authenticator failed for (tbzguqfppa) [188.135.8.47]: 535 Incorrect authentication data
2014-07-23 18:46:20 cram authenticator (CRAM-MD5):
  Cyrus SASL permanent failure: user not found
2014-07-23 18:46:20 cram authenticator failed for (tbzguqfppa) [188.135.8.47]: 535 Incorrect authentication data
2014-07-23 19:14:15 plain authenticator (PLAIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 19:14:15 plain authenticator failed for (cyrqhyfcjc) [212.179.214.48]: 535 Incorrect authentication data
2014-07-23 19:14:16 login authenticator (LOGIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 19:14:16 login authenticator failed for (cyrqhyfcjc) [212.179.214.48]: 535 Incorrect authentication data
2014-07-23 19:14:16 cram authenticator (CRAM-MD5):
  Cyrus SASL permanent failure: user not found
2014-07-23 19:14:16 cram authenticator failed for (cyrqhyfcjc) [212.179.214.48]: 535 Incorrect authentication data
2014-07-23 19:22:22 login authenticator (LOGIN):
  Cyrus SASL permanent failure: user not found
2014-07-23 19:22:22 login authenticator failed for s15433869.onlinehome-server.com (User) [74.208.72.28]: 535 Incorrect authentication data

И вот такие записи не понятны:

Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: NEWSOCKFD - 2
Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: Check quota for 'info@XXXXXXXXXXXXX.ru'
Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: cache_quota /usr/sbin/repquota -u -n /dev/simfs
Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: info@XXXXX.ru [u:533] disk quota used '92' limit '0'
Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: cache_quota /usr/sbin/repquota -g -n /dev/simfs
Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: info@XXXXXXXX.ru [g:524] disk quota used '108' limit '0'
Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: SEND START -   size - 1
Jul 23 18:27:00 zx-spectrum-x86 eximquotacheck: N - 1
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: NEWSOCKFD - 2
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: Check quota for 'info@XXXXXXX.ru'
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: cache_quota /usr/sbin/repquota -u -n /dev/simfs
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: info@XXXXXX.ru [u:533] disk quota used '92' limit '0'
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: cache_quota /usr/sbin/repquota -g -n /dev/simfs
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: info@XXXXXXX.ru [g:524] disk quota used '108' limit '0'
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: SEND START -   size - 1
Jul 23 18:32:22 zx-spectrum-x86 eximquotacheck: N - 1

Буду признателен любой помощи/наводке.

Видемо ранее была рассылка что в спам папали, тут надо многое понимать что за домены у вас и т п

Последнее напоминания о квоте что лимит исчерпан - в панели ispmanager укажите явный размер почтового ящика. 0 - не катит.

1X9u1t-0004WF-Lt-H

exim 93 93

<>

1406112253 0

-ident exim

-received_protocol local

-aclc 8 0



-aclc 9 0



-body_linecount 1300

-allow_unqualified_recipient

-allow_unqualified_sender

-localerror

XX

1

claudioabaq241@kgtrk.ru



149P Received: from exim by zx-spectrum-x86.org with local (Exim 4.63)

        id 1X9u1t-0004WF-Lt

        for claudioabaq241@kgtrk.ru; Wed, 23 Jul 2014 14:44:13 +0400

040  X-Failed-Recipients: info@XXXXXX.ru

029  Auto-Submitted: auto-replied

063F From: Mail Delivery System <Mailer-Daemon@zx-spectrum-x86.org>

028T To: claudioabaq241@kgtrk.ru

059  Subject: Mail delivery failed: returning message to sender

052I Message-Id: <E1X9u1t-0004WF-Lt@zx-spectrum-x86.org>

038  Date: Wed, 23 Jul 2014 14:44:13 +0400

самое интересное там в теле письма, где указаны заголовки исходящего письма, а не отбойника.

если долбят прямо сейчас, то гляньте Apache server-status, увидите POST запросы - это оно и есть.

или ищите в логах apache/nginx POST запросы.

imap, pop3 - это протоколы приема почты, а не отправки. максимум их используют для подбора паролей.

запросов POST нет, в том то и дело, не знаю куда копать...

---------- Добавлено 23.07.2014 в 22:38 ----------

вот:

1XA1Qo-0005fI-Jy-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  info@XXXXXXX
    local delivery failed: retry timeout exceeded

------ This is a copy of the message, including all the headers. ------

Return-path: <velma_morris@fizikportali.com>
Received: from [78.135.94.146] (helo=fizikportali.com)
        by zx-spectrum-x86.org with esmtp (Exim 4.63)
        (envelope-from <velma_morris@fizikportali.com>)
        id 1XA1Qn-0005fB-Ph
        for info@XXXXXX; Wed, 23 Jul 2014 22:38:25 +0400
Date: Wed, 23 Jul 2014 21:38:19 +0300
From: "Velma Morris" <velma_morris@fizikportali.com>
Reply-To:"Velma Morris" <velma_morris@fizikportali.com>
Message-ID: <690d277-1e5e1-8c@fizikportali.com>
To: info@XXXXXX
Subject: Fw:  Lol, Sexy blonde whore double fucked in gangbang
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit


<div><a href="http://uni-display.com/wp-includes/css/themes.html">Sexy blonde whore double fucked in gangbang</a></div>

1XA1RI-0005fi-D2-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  info@xxxxxx
    local delivery failed: retry timeout exceeded

------ This is a copy of the message, including all the headers. ------

Return-path: <jill_mccullough@scherbinka.net>
Received: from t4d.ru ([195.189.180.250] helo=scherbinka.net)
        by zx-spectrum-x86.org with esmtp (Exim 4.63)
        (envelope-from <jill_mccullough@scherbinka.net>)
        id 1XA1RI-0005fb-8p
        for info@xxxxxx; Wed, 23 Jul 2014 22:38:56 +0400
Date: Wed, 23 Jul 2014 22:39:09 +0400
From: "Jill Mccullough" <jill_mccullough@scherbinka.net>
Reply-To:"Jill Mccullough" <jill_mccullough@scherbinka.net>
Message-ID: <62dabed-9b9fc-93@scherbinka.net>
To: info@xxxxxxx
Subject: FW:  Lol, Lesbos kissing passionately and dildoing asshole
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit


<div><a href="http://raykoon.com/wp-content/themes/d8/ajax/ini.html">Lesbos kissing passionately and dildoing asshole</a></div>

сканируйте сайт с помощью clamav и maldet. какой движок?

Plutishe, И снова Cent os?

По сабжу поставьте mail patch чтобы знать откуда шлют, те сам спаммерский скрипт (есть само по себе с isp lite 4 + Debian 7).

clam:

----------- SCAN SUMMARY -----------

Known viruses: 3503092

Engine version: 0.98.4

Scanned directories: 54531

Scanned files: 217101

Infected files: 0

Total errors: 174

Data scanned: 7642.80 MB

Data read: 35580.68 MB (ratio 0.21:1)

Time: 2352.601 sec (39 m 12 s)

hostcms и bitrix

---------- Добавлено 23.07.2014 в 23:32 ----------

nmap:

Not shown: 1664 closed ports

PORT     STATE SERVICE

21/tcp   open  ftp

22/tcp   open  ssh

25/tcp   open  smtp

53/tcp   open  domain

110/tcp  open  pop3

143/tcp  open  imap

443/tcp  open  https

465/tcp  open  smtps

587/tcp  open  submission

953/tcp  open  rndc

993/tcp  open  imaps

995/tcp  open  pop3s

1500/tcp open  vlsi-lm

3306/tcp open  mysql

8080/tcp open  http-proxy

8888/tcp open  sun-answerbook

Plutishe, Вы порт

ну аи из простого - ай-болитом прогони сайты.

при выключении exim рассылка прекращается?