今天所有账号都收到一封相同的垃圾邮件，是怎么回事？

nfore

今天公司所有邮箱都收到一封相同的邮件，标题均为
"你有空也来玩一下吧，都是些小游戏，轻松一下。"

我看发发件人都不一样，但我司每个账号都收到了，是哪里出了问题？如果是垃圾邮件，应该不可能知道我司所有的账号吧？

wxhsh

可能有个内部帐号被破解了，并且你没验证FROM，它通过这个ESMTP进程发给EVERYONE列表，不过这种针对性太强了，不象普通群发器所为。

nfore

没验证FROM 指什么？如何操作

wxhsh

最好还是贴下日志吧，我现在也只是猜，还不一定是这原因。

nfore

都是很正常的日志,每封邮件都是这个地址hellokitty3839@citiz.net 发的

on 2007-11-26 09:05:34: ----------
Mon 2007-11-26 09:05:52: Session 1347; child 1; thread 2288
Mon 2007-11-26 09:05:50: 接受 SMTP 连接来自 [218.1.66.100:53517]
Mon 2007-11-26 09:05:50: --> 220 mail.xxxxxx.com ESMTP MDaemon 9.6.3; Mon, 26 Nov 2007 09:05:50 +0800
Mon 2007-11-26 09:05:50: <-- HELO ws15.citiz.net
Mon 2007-11-26 09:05:50: Performing IP lookup (ws15.citiz.net)
Mon 2007-11-26 09:05:51: *  D=ws15.citiz.net TTL=(720) A=[218.1.66.100]
Mon 2007-11-26 09:05:51: ---- End IP lookup results
Mon 2007-11-26 09:05:51: --> 250 mail.xxxxxx.com Hello ws15.citiz.net, pleased to meet you
Mon 2007-11-26 09:05:51: <-- MAIL FROM:<hellokitty3839@citiz.net>
Mon 2007-11-26 09:05:51: Performing IP lookup (citiz.net)
Mon 2007-11-26 09:05:51: *  P=010 S=000 D=citiz.net TTL=(599) MX=[mx.citiz.net] {218.1.66.91}
Mon 2007-11-26 09:05:51: ---- End IP lookup results
Mon 2007-11-26 09:05:51: Performing SPF lookup (citiz.net / 218.1.66.100)
Mon 2007-11-26 09:05:51: *  Result: none; no SPF record in DNS
Mon 2007-11-26 09:05:51: ---- End SPF results
Mon 2007-11-26 09:05:51: --> 250 <hellokitty3839@citiz.net>, Sender ok
Mon 2007-11-26 09:05:51: <-- RCPT TO:<deng@xxxxxx.com>
Mon 2007-11-26 09:05:51: 执行 DNS-BL 查询（218.1.66.100 - 正在连接 IP）
Mon 2007-11-26 09:05:51: *  cblless.anti-spam.org.cn - 通过
Mon 2007-11-26 09:05:51: *  zen.spamhaus.org - 通过
Mon 2007-11-26 09:05:51: *  zen.spamhaus.org - 通过
Mon 2007-11-26 09:05:51: *  bl.spamcop.net - 通过
Mon 2007-11-26 09:05:51: ---- 结束 DNS-BL 结果
Mon 2007-11-26 09:05:51: --> 250 <deng@xxxxxx.com>, Recipient ok
Mon 2007-11-26 09:05:51: <-- DATA
Mon 2007-11-26 09:05:51: Creating temp file (SMTP): d:\mdaemon\queues\temp\md50000168949.tmp
Mon 2007-11-26 09:05:51: --> 354 Enter mail, end with <CRLF>.<CRLF>
Mon 2007-11-26 09:05:52: Message size: 1080 bytes
Mon 2007-11-26 09:05:52: Performing DKIM lookup
Mon 2007-11-26 09:05:52: *  File: d:\mdaemon\queues\temp\md50000168949.tmp
Mon 2007-11-26 09:05:52: *  Message-ID: n/a
Mon 2007-11-26 09:05:52: *  Result: neutral
Mon 2007-11-26 09:05:52: ---- End DKIM results
Mon 2007-11-26 09:05:52: Performing DomainKeys lookup (Sender: ZHAGNG@xxxxxx.com)
Mon 2007-11-26 09:05:52: *  File: d:\mdaemon\queues\temp\md50000168949.tmp
Mon 2007-11-26 09:05:52: *  Message-ID: n/a
Mon 2007-11-26 09:05:52: *  Querying for policy: xxxxxx.com
Mon 2007-11-26 09:05:52: *    Querying: _domainkey.xxxxxx.com ...
Mon 2007-11-26 09:05:52: *    DNS: *  名称服务器报告未知的域名
Mon 2007-11-26 09:05:52: *  Result: neutral
Mon 2007-11-26 09:05:52: ---- End DomainKeys results
Mon 2007-11-26 09:05:52: Passing message through Spam Filter (Size: 1080)...
Mon 2007-11-26 09:05:52: *  0.6 NO_REAL_NAME From: does not include a real name
Mon 2007-11-26 09:05:52: *  1.1 CN_SUBJECT_166 Subject contains "轻松"
Mon 2007-11-26 09:05:52: *  1.8 INVALID_DATE Invalid Date: header (not RFC 2822)
Mon 2007-11-26 09:05:52: * -100 USER_IN_WHITELIST From: address is in the whitelist
Mon 2007-11-26 09:05:52: *  3.4 SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters
Mon 2007-11-26 09:05:52: *  1.5 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
Mon 2007-11-26 09:05:52: *  0.2 CN_BODY_365 BODY: Body contains "点击"
Mon 2007-11-26 09:05:52: ---- End SpamAssassin results
Mon 2007-11-26 09:05:52: Spam Filter score/req: -91.60/20.0
Mon 2007-11-26 09:05:52: 邮件创建 successful：d:\mdaemon\queues\inbound\md50000286204.msg
Mon 2007-11-26 09:05:52: --> 250 Ok, message saved <Message-ID: >
Mon 2007-11-26 09:05:52: <-- QUIT
Mon 2007-11-26 09:05:52: --> 221 See ya in cyberspace
Mon 2007-11-26 09:05:52: SMTP 会话成功（进/出字节：1182/320）
Mon 2007-11-26 09:05:52: ----------

[ 本帖最后由 nfore 于 2007-11-26 12:09 编辑 ]

nfore

其中这句:
Mon 2007-11-26 09:05:52: Performing DomainKeys lookup (Sender: ZHAGNG@xxxxxx.com)

它怎么可以冒充这个地址来发送邮件？

wxhsh

Mon 2007-11-26 09:05:52: * -100 USER_IN_WHITELIST From: address is in the whitelist
居然在FROM白名单里，你先检查下。

nfore

白名单中没有与citiz.net的关的名字啊

下面这段中，第二行，怎么会出现一个无关的邮件地址（ZHAGNG@xxxxxx.com，并且这个地址也是我们域中的一个账号）？并且这个地方在收件人那是发送人，可其中上是hellokitty3839@citiz.net发送的啊

它是如何冒充我们域中的一个账号来发送垃圾邮件的？

Mon 2007-11-26 09:05:52: ---- End DKIM results
Mon 2007-11-26 09:05:52: Performing DomainKeys lookup (Sender: ZHAGNG@xxxxxx.com)
Mon 2007-11-26 09:05:52: *  File: d:\mdaemon\queues\temp\md50000168949.tmp
Mon 2007-11-26 09:05:52: *  Message-ID: n/a
Mon 2007-11-26 09:05:52: *  Querying for policy: xxxxxx.com
Mon 2007-11-26 09:05:52: *    Querying: _domainkey.xxxxxx.com ...
Mon 2007-11-26 09:05:52: *    DNS: *  名称服务器报告未知的域名
Mon 2007-11-26 09:05:52: *  Result: neutral
Mon 2007-11-26 09:05:52: ---- End DomainKeys results

wxhsh

非常奇怪的日志，感觉有点象MD抽风现象，都是自相矛盾的信息，如果发件人来自本域，通常会在最初有MD5的AUTH login串，成功后会直接跳过SA，而你这里却又是外来的，并且DK校验却莫名奇妙析出个本地帐号，你本地DNS里没有DK的TEXT记录，所以验证失败，并且还居然在手工的FROM白名单，估计要MD开发者来解释了。

nfore