>> Delete No. 19289 article
No. 메일서버가 해킹당한거 같은데 어떻게 해야하나요?

등록 2001-01-31 09:52:00 By localhost     조회 2
이름 마린    

		아침에 어떤 외국사이트에서 스팸메일을 보내지 말라는 메일을 받았습니다.
 "I LOVE YOU AND I DON'T WANT YOU TO DIE!"
이런 타이틀로 메일이 발송되어 졌더군요.....출처는 저희 서버에서요
 그리고 얼마 않있어 www.orbs.org 라는 사이트에서
메일이 날아 왔습니다. 근데 무슨내용인지 잘 이해가 않갑니다.
원문을 인용합니다.
 Please read this entire message carefully before replying
 If you are not the technical contact for your organisation, please
forward this to the person who is.
 Reference: http://www.orbs.org/messagelookup.php3?address=211.45.55.xx  211.45.55.xx has been detected as an insecure e
mail relay and added to the ORBS database.
 Please check the ORBS website (http://www.orbs.org/) for links
to other sites that may be able to help you close your relay. Most mail
transport agents can be secured quickly by the operator, usually for no
cost other than the time take to read the appropriate instructions for
your software.
 To be removed from the ORBS database, you need to disable the external relay
features of your mail server and then report the IP address 211.45.55.xx
to our web site at  http://www.orbs.org/closed2.php3?address=211.45.55.xx We will immediately remove your site's entry,
 then re-test it for third-party relay capabilities.
 ORBS is an automated testing system, if your mailserver has multiple
IP interfaces, it is likely that you will receive multiple copies of
this message. You should only receive one notice per IP number, however
ORBS notices are sent to both the literal IP address and the resolved DNS
name, so 2 notices may be received in some cases.
 Thank you for your attention to this matter.
 Sincerely,
 listings at orbs.org  The message your system relayed is attached below.
If you believe your server has been secured, please check the
X-Envelope lines to see which vulnerability has been missed
and check them against the list of vulnerabilties at
http://www.orbs.org/envelopes.html  >From sender at orbs.org  Wed Jan 31 12:58:32 2001
Received: from firetool.net (IDENT:root@[211.45.55.xx])
by mail2.manawatu.net.nz (8.9.3/8.9.3) with ESMTP id MAA21597
for <orbs-relaytest at manawatu.co.nz>; Wed, 31 Jan 2001 12:58:24 +1300
X-Remote-IP:211.45.55.xx
Received: from relaytest.orbs.vuurwerk.nl (tester42.orbs.org [62.250.3.55])
by firetool.net (8.10.1/8.10.1) with SMTP id f0UNhRI17648
for <"orbs-relaytest at manawatu.co.nz">; Wed, 31 Jan 2001 08:43:27 +0900
Date: Wed, 31 Jan 2001 08:43:27 +0900
To:"orbs-relaytest at manawatu.co.nz"@firetool.net
From: sender at orbs.org X-Token: wlhlblvkklmynhow
X-Envelope-Sender:<sender at orbs.org>
X-Envelope-Recipient:<"orbs-relaytest at manawatu.co.nz">
Message-Id:<211.45.55.xx at orbs.org>
Subject: ORBS Relay Test - 211.45.55.xx
 This program checks for open relays.
 Open relays are automatically added to the ORBS Open Relay
Database (see http://www.orbs.org/ for details).
 Check http://www.orbs.org/verify.php3?address=211.45.55.xx for this hosts current status.
 Vulnerability checks are detailed at http://www.orbs.org/envelopes.html  Securing help can be found at http://www.orbs.
org/otherresources.html  There are multiple tests applied per IP address. Partially secured hosts may pass some tests, b
ut fail others. Hosts are only classified as secure by ORBS if they pass all tests.
 Hosts which do not deliver messages are not classified as insecure.
 Do not use the above addresses to contact me - use admin at orbs.org.  X-Token: wlhlblvkklmynhow
X-Envelope-Sender: MAIL FROM:<sender at orbs.org>
X-Envelope-Recipient: RCPT TO:<"orbs-relaytest at manawatu.co.nz">
 IP의 마지막숫자는 xx로 표시했습니다.
 누가 제발좀 도와주세요...
지금 서버의 프로세스를 살펴보면 많은 양의 메일이 발송 되어지고 있습니다.
글을 쓰고 있는 지금도 돌고 있습니다.
 물론 SMTP는 막아 놓았습니다.
[관리자] 패스워드를 입력 하십시오. 답장이 존재하면 함께 삭제됩니다.[ 목록 | 이전 ]
패스워드:    

Copyleft 1999-2026 by JSBoard Open Project
Theme Designed by IDOO All right reserved