Érthetetlen spam (?)

Fórumok

Ez mi a lófasz lehet? Napok óta változatos IP címekről és email címekről próbál beömleni pont ezekre az email címekre a szar:

Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <explain@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<explain@domain.name> proto=ESMTP helo=<[
185.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <them@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<them@domain.name> proto=ESMTP helo=<[185.14
3.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <logical@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<logical@domain.name> proto=ESMTP helo=<[
185.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <replace@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<replace@domain.name> proto=ESMTP helo=<[
185.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <consequence@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<consequence@domain.name> proto=ESMTP
helo=<[185.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <initially@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<initially@domain.name> proto=ESMTP hel
o=<[185.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <salary@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<salary@domain.name> proto=ESMTP helo=<[18
5.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <hungry@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<hungry@domain.name> proto=ESMTP helo=<[18
5.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <varied@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<varied@domain.name> proto=ESMTP helo=<[18
5.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <complaint@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<complaint@domain.name> proto=ESMTP hel
o=<[185.143.223.163]>
Feb 23 09:15:57 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <half@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<half@domain.name> proto=ESMTP helo=<[185.14
3.223.163]>
Feb 23 09:15:58 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <outdoors@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<outdoors@domain.name> proto=ESMTP helo=
<[185.143.223.163]>
Feb 23 09:15:59 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <avoid@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<avoid@domain.name> proto=ESMTP helo=<[185.
143.223.163]>
Feb 23 09:16:00 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <wallet@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<wallet@domain.name> proto=ESMTP helo=<[18
5.143.223.163]>
Feb 23 09:16:01 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <station@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<station@domain.name> proto=ESMTP helo=<[
185.143.223.163]>
Feb 23 09:16:02 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <insist@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<insist@domain.name> proto=ESMTP helo=<[18
5.143.223.163]>
Feb 23 09:16:03 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <extensive@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<extensive@domain.name> proto=ESMTP hel
o=<[185.143.223.163]>
Feb 23 09:16:04 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <programme@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<programme@domain.name> proto=ESMTP hel
o=<[185.143.223.163]>
Feb 23 09:16:05 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <nephew@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<nephew@domain.name> proto=ESMTP helo=<[18
5.143.223.163]>
Feb 23 09:16:06 portal postfix/smtpd[21590]: NOQUEUE: reject: RCPT from unknown[185.143.223.97]: 550 5.1.1 <drag@domain.name>: Recipient address rejected: User unknown in local recipient table; from=<npiaz31vdx3b@aminetwork.ru> to=<drag@domain.name> proto=ESMTP helo=<[185.14
3.223.163]>

Hozzászólások

Passsz, de ha fix a feladó @domain, tíltsd ki postfix access policyk által.

Passz, nálam is próbálkozik ugyanebből a /24-ből, tippre egy szarabbul sikerült bot... (mondjuk nálam az RCPT-ig már el se jut, a reverse PTR hiányán megakad)

BlackY

"en is amikor bejovok dolgozni, nem egy pc-t [..] kapcsolok be, hanem a mainframe-et..." (sj)

Ezt még nem állítottam be, mert néha beesik levél olyan helyekről, ahol nincs beállítva jól a levelezőszerver, de szerintem már lényegesen kevesebb, mint korábban. Egyelőre nem zavar sok vizet, hogy eljönnek az RCPT-ig, csak furcsa mintázata van.

A reverse tök alap. 2006 óta megkovetelem, hisz RFC-ben is elvárás. Visszapattan és az ottani eszes majd tudja. Néha van, hogy rinyálnak. Logbol visszanezem és meguzenik a rendszergazdáknak.

Nálam postscreen megfogja:

 

Feb 24 17:51:55 apollo13 postfix/postscreen[756010]: DNSBL rank 20 for [185.143.223.166]:42132
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: COMMAND PIPELINING from [185.143.223.166]:42132 after RCPT: RCPT TO:<them@XXX.hu>\r\nRCPT TO:<logical@XXX.hu>\r\nRCPT TO:<replace@XXX.hu>\r\nRCPT TO:<cons
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<explain@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<them@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<logical@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<replace@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<consequence@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<initially@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<salary@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<hungry@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<varied@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<complaint@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<half@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<outdoors@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<avoid@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<wallet@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<station@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<insist@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<extensive@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: NOQUEUE: reject: RCPT from [185.143.223.166]:42132: 550 5.5.1 Protocol error; from=<qy1v5ila3s882vs@wifi.ru>, to=<programme@XXX.hu>, proto=ESMTP, helo=<[185.143.223.163]>
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: COMMAND COUNT LIMIT from [185.143.223.166]:42132 after RCPT
Feb 24 17:51:56 apollo13 postfix/postscreen[756010]: DISCONNECT [185.143.223.166]:42132

Debian Linux rulez... :D
RIP Ian Murdock

Így van, de a neten elérhető címeket már begyűjtötték, fejlődni pedig muszáj.

Ha szótárból dolgoznak, el tudok képzelni olyan szavakat, amiket sok cég használ pl csoportokhoz (nem mindenki korlátozza, hogy ki írhat a csoportba), de nincs publikálva, még nem gondoltak rá. Ezek pedig értékes címek lehetnek egy spammernek.

Szerkesztve: 2020. 02. 25., k - 14:01

A választ nem tudom, de

fail2ban?

logot felolvassa, ha 2-3-4 próba van rossz email címre, akkor a forrást kidobja. Nem lesz felesleges logod.

?

Egyfajta DDoS, ami inkább a szolgáltatás ellen irányul, mint a sávszél ellen. Sok szerveren van kapcsolati limit és sokon elég sokáig végigfut az ellenőrzés (nem biztos, hogy bénák, erre van szükségük bármiért) és szép torlódnak. Pár hete láttam hasonlót, illetve okozott problémát, egy partnernél meg egy saját gépen, mentek /24-estül az iptables megfelelő tiltó sorába. Elég sűrűn előfordulnak ilyesmik, nem biztos, hogy fenn kell rajtuk akadni.