如何追踪垃圾邮件脚本？

Question

我的服务器昨晚发送了83,000封垃圾邮件，我一直在试图找出罪魁祸首，但我不知道如何准确地找到凶手。

• 在日志中，"from“地址总是类似于@#！
• 连接似乎来自本地主机。

让我相信这是一个使用php mail()；函数或CGI的脚本。那么，我如何找出哪个脚本呢？

编辑更正，发送354284封电子邮件与50‘to“地址.17,714,200封电子邮件太棒了。

编辑看起来像smtp用户/机器人网络..。邮件是由一个经过认证的用户发送的.

Apr 22 06:31:41 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25411 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25412 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25413 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25414 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25415 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:42 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:42 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25416 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:42 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25417 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:43 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25418 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:43 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25419 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:43 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25420 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:43 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:43 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25422 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25421 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25423 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25424 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:44 impulsemedia relaylock: /var/qmail/bin/relaylock: mail from 71.129.165.22:25425 (adsl-71-129-165-22.dsl.irvnca.pacbell.net)
Apr 22 06:31:45 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:45 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:45 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:45 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:46 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:46 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:46 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:46 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:46 impulsemedia smtp_auth: SMTP connect from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:46 impulsemedia smtp_auth: smtp_auth: SMTP user --removed--@--removed--.com : /var/qmail/mailnames/--removed--.com/--removed-- logged in from unknown@adsl-71-129-165-22.dsl.irvnca.pacbell.net [71.129.165.22]
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: Handlers Filter before-queue for qmail started ...
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: from=mysteryshopping@stmarysalumni.com
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: to=ctrudel0103@aol.com
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: to=d__franco@msn.com
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: to=d__john2258@yahoo.com
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: to=d_1n_only@yahoo.com
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: to=d_5boyz@yahoo.com
Apr 22 06:31:49 impulsemedia qmail-queue-handlers[28215]: to=d_85242@yahoo.com

然后是50个或更多的"to“地址，我没有在日志中看到它的原因是它们在这里登录--将大部分电子邮件倾倒在队列中，而300m+日志的其余部分则像脚本一样传递消息。ip地址'71.129.165.22‘也出现在垃圾邮件CBL上.

当出现问题时，只要上一课，就能更仔细地阅读日志。

-sean

Answer 1

本周早些时候我们也被一个垃圾邮件发送者袭击了。我发现的一条建议是查看您可以找到的最早垃圾邮件的完整标题，并查找由UID调用的消息。您可以在密码文件中查找此内容，以确定用于运行发送电子邮件的进程的登录名。

不管它的价值是什么，垃圾邮件的入口点被证明是我们的网络邮件界面。垃圾邮件发送者使用现有帐户和密码登录，然后使用web邮件应用程序发送电子邮件。据我所知，垃圾邮件发送者从未破坏过实际系统。

Answer 2

您应该创建一个包装器来记录有关请求的各种信息。

Parallels为Plesk系统提供了一个示例，但它看起来有点通用：http://kb.parallels.com/1711。

Answer 3

虽然你可以用grep来写邮件(这不是从PHP发送电子邮件的唯一方法。)也可以通过各种程序执行函数(标准邮件fn只是php.ini中定义的程序的包装器)来完成，也可以连接到SMTP端口。

无论如何，应该花一些时间来处理大量的消息--或者需要大量的HTTP请求--这在您的logs服务器日志中是显而易见的。

我建议将php.ini文件中配置的命令替换为一个命令，该命令将尽可能多地收集有关调用它的信息，并将其记录在某个地方。另外，如果您在机器上打开了端口25，那么从脚本中阻止对它的访问(请注意，这可能会破坏您为用户提供的服务)。