[Postfixbuch-users] Warnung Paypal Pishingmails von deutschem Server

[sebastian at debianfan.de]

Torsten Weinstein schrieb:
>>   
> OFFTOPIC:
> Was für ein IP hatte der Server denn bei der Keyweb AG? Ich hatte auch 
> einen gemeldet. Also reines Interesse...
> 


Keyweb ist in dieser Beziehung ne *zensiert* was Sicherheit betrifft

ein kleiner Blick in die Logfiles der letzten Tage verrät:

z.B. 62.141.126.138

Dec 10 09:43:40 ks360112 postfix/smtpd[23023]: NOQUEUE: reject: RCPT 
from unknown[62.141.126.138]: 550 5.1.1 <michel at meineadresse.de>: 
Recipient address rejected: User unknown in virtual alias table; 
from=<akstcneoshofiremnsdgs at neoshofire.org> to=<michel at meineadresse.de> 
proto=ESMTP helo=<job-comp>
Dec 10 10:44:50 ks360112 postfix/smtpd[26238]: warning: 62.141.54.181: 
hostname ns.km31608.keymachine.de verification failed: Name or service 
not known
Dec 10 10:44:50 ks360112 postfix/smtpd[26238]: connect from 
unknown[62.141.54.181]
Dec 10 10:44:51 ks360112 postfix/smtpd[26238]: NOQUEUE: reject: RCPT 
from unknown[62.141.54.181]: 450 4.7.1 Client host rejected: cannot find 
your hostname, [62.141.54.181]; from=<1842ccc at hotmail.com> 
to=<info at meineadresse.de> proto=SMTP helo=<hotmail560.com>
Dec 10 10:44:52 ks360112 postfix/smtpd[26238]: disconnect from 
unknown[62.141.54.181]
Dec 11 15:11:22 ks360112 postfix/smtpd[31522]: connect from 
mail.iksgroup.ru[62.141.98.99]
Dec 11 15:11:28 ks360112 postfix/smtpd[31522]: NOQUEUE: reject: RCPT 
from mail.iksgroup.ru[62.141.98.99]: 550 5.7.1 
<webmaster at meineadresse.de>: Recipient address rejected: Mail appeared 
to be SPAM or forged. Ask your Mail/DNS-Administrator to correct HELO 
and DNS MX settings or to get removed from DNSBLs; MTA helo: mctpdc.mct, 
MTA hostname: mail.iksgroup.ru[62.141.98.99] (helo/hostname mismatch); 
from=<williamscoleman_13 at yahoo.co.th> to=<webmaster at meineadresse.de> 
proto=ESMTP helo=<mctpdc.MCT>
Dec 11 15:11:28 ks360112 postfix/smtpd[31522]: disconnect from 
mail.iksgroup.ru[62.141.98.99]