Results 1 to 6 of 6

Thread: Internal Mail Attack

  1. #1
    Bufonx is offline New Member
    Join Date
    Nov 2010
    Posts
    3
    Rep Power
    4

    Default Internal Mail Attack

    Hi Guys, sorry my english

    Since a couple of days I'm having a serious problem with two different zimbra servers. I'm receiving internal mails of mailboxs that doesn't exist.

    I don't know if is a new "world wide" problem or maybe can be just a internal problem ( i have my dude because the 2 servers are in different places, different nets..but they are the same zimbra version)

    If you hear something about this problem..please post!!

    Regards

    Eduardo Campbell

  2. #2
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,585
    Rep Power
    57

    Default

    You should update your forum profile with the output of the following command (do not post the output in this thread):

    Code:
    zmcontrol -v
    Quote Originally Posted by Bufonx View Post
    Hi Guys, sorry my english

    Since a couple of days I'm having a serious problem with two different zimbra servers. I'm receiving internal mails of mailboxs that doesn't exist.

    I don't know if is a new "world wide" problem or maybe can be just a internal problem ( i have my dude because the 2 servers are in different places, different nets..but they are the same zimbra version)

    If you hear something about this problem..please post!!
    You need to post the headers of some of the spam emails and you should post some of the entries from your log files that show where this spam is coming from.

    I'll also move this to the correct forum as it's not a Zimbra Desktop question.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  3. #3
    Bufonx is offline New Member
    Join Date
    Nov 2010
    Posts
    3
    Rep Power
    4

    Default this is one of the email headers

    Return-Path: hillduzyru57@senzablog.it
    Received: from mail.ajax.cl (LHLO mail.ajax.cl) (192.168.2.3) by
    mail.ajax.cl with LMTP; Fri, 12 Nov 2010 13:13:38 -0300 (CLST)
    Received: from localhost (localhost.localdomain [127.0.0.1])
    by mail.ajax.cl (Postfix) with ESMTP id F080B1A72C4;
    Fri, 12 Nov 2010 13:13:37 -0300 (CLST)
    X-Quarantine-ID: <mHHNpAeUzzBb>
    X-Virus-Scanned: amavisd-new at mail.ajax.cl
    X-Amavis-Alert: BAD HEADER SECTION, Header field occurs more than once: "Cc"
    occurs 3 times
    X-Spam-Flag: NO
    X-Spam-Score: 2.464
    X-Spam-Level: **
    X-Spam-Status: No, score=2.464 tagged_above=-10 required=6.6
    tests=[BAYES_50=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457,
    RCVD_IN_PBL=0.905, RDNS_NONE=0.1] autolearn=no
    Received: from mail.ajax.cl ([127.0.0.1])
    by localhost (mail.ajax.cl [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id mHHNpAeUzzBb; Fri, 12 Nov 2010 13:13:36 -0300 (CLST)
    Received: from [89.123.211.94] (unknown [89.123.211.94])
    by mail.ajax.cl (Postfix) with ESMTP id 6AF2F1A72C1
    for <nelly_rojas@ajax.cl>; Fri, 12 Nov 2010 13:13:35 -0300 (CLST)
    Received: from [119.87.43.145] (helo=dcsgnwqnl.giuekzcn.tv)

  4. #4
    xtim0x is offline Starter Member
    Join Date
    Nov 2010
    Posts
    2
    Rep Power
    4

    Default

    Hello BufonX im having the same problem here.

    Im using Release 5.0.23_GA_3242.UBUNTU6 UBUNTU6 FOSS edition
    in ubuntu 6.

    Are you from chile? This is attacking my internal network.

    Code:
    Return-Path: hillduzyru57@duecisrl.it
    Received: from mail.tvi.cl (LHLO mail.tvi.cl) (192.168.169.33) by
     mail.tvi.cl with LMTP; Fri, 12 Nov 2010 09:05:21 -0300 (CLST)
    Received: from localhost (localhost.localdomain [127.0.0.1])
    	by mail.tvi.cl (Postfix) with ESMTP id 2D87E1F38004;
    	Fri, 12 Nov 2010 09:05:21 -0300 (CLST)
    X-Quarantine-ID: <1dMJ3uHuqPOj>
    X-Virus-Scanned: amavisd-new at mail.tvi.cl
    X-Amavis-Alert: BAD HEADER, Header field occurs more than once: "Cc" occurs 3
    	times
    X-Spam-Flag: NO
    X-Spam-Score: 0.818
    X-Spam-Level: 
    X-Spam-Status: No, score=0.818 tagged_above=-10 required=6.6
    	tests=[BAYES_20=-0.74, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457,
    	RDNS_NONE=0.1]
    Received: from mail.tvi.cl ([127.0.0.1])
    	by localhost (mail.tvi.cl [127.0.0.1]) (amavisd-new, port 10024)
    	with ESMTP id 1dMJ3uHuqPOj; Fri, 12 Nov 2010 09:05:04 -0300 (CLST)
    Received: from [118.221.132.75] (unknown [118.221.132.75])
    	by mail.tvi.cl (Postfix) with ESMTP id 8AA3F1F38008
    	for <admin@tvi.cl>; Fri, 12 Nov 2010 09:05:04 -0300 (CLST)
    Received: from [172.106.132.19] (account turnerfocomu74@collinemoreniche.it HELO xbwiaowafztgg.bqhhtdauvcqmcz.com)
    	by  (CommuniGate Pro SMTP 5.2.3)
    	with ESMTPA id 981620579 for <admin@tvi.cl>
    Cc: <awuba666@tvi.cl>, <postmaster@tvi.cl>, <root@tvi.cl>,
    	<wiki@tvi.cl>, <xrnx4u9lj4wy@tvi.cl>;, Fri@mail.tvi.cl,
    	12@mail.tvi.cl, Nov@mail.tvi.cl, 2010@mail.tvi.cl,
    	"21:08:13"@mail.tvi.cl, +0900@mail.tvi.cl
    From: <admin@tvi.cl>
    Cc: <awuba666@tvi.cl>,
    	<postmaster@tvi.cl>,
    	<root@tvi.cl>,
    	<wiki@tvi.cl>,
    	<xrnx4u9lj4wy@tvi.cl>
    To: <admin@tvi.cl>
    Cc: <awuba666@tvi.cl>,
    	<postmaster@tvi.cl>,
    	<root@tvi.cl>,
    	<wiki@tvi.cl>,
    	<xrnx4u9lj4wy@tvi.cl>
    Subject: iHola!
    Date: Fri, 12 Nov 2010 21:08:13 +0900
    MIME-Version: 1.0
    Content-Type: text/html
    	charset="us-ascii"
    X-Priority: 3
    X-Mailer: dluhwpnxva-89
    Message-ID: <4064129394.6TPGXAJ3685061@wivjwnbouoaxv.gibayrxqll.net>
    Content-Transfer-Encoding: quoted-printable

  5. #5
    Bufonx is offline New Member
    Join Date
    Nov 2010
    Posts
    3
    Rep Power
    4

    Default

    Yeah!..I'm from Chile...

    I'm searching for news about that error...if you have a solution please post it, i'll do the same

    Regards

  6. #6
    xtim0x is offline Starter Member
    Join Date
    Nov 2010
    Posts
    2
    Rep Power
    4

    Default

    Any ideas from here? i dont know if this is a virus or is server side

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Problems with port 25
    By yogiman in forum Installation
    Replies: 57
    Last Post: 06-13-2011, 01:55 PM
  2. Replies: 7
    Last Post: 02-03-2011, 07:01 AM
  3. [SOLVED] Upgraded to 5.0 OSS - Sendmail Problem
    By Chewie71 in forum Installation
    Replies: 11
    Last Post: 12-28-2007, 07:07 PM
  4. Issues...
    By timothyalangorman in forum Administrators
    Replies: 3
    Last Post: 11-19-2007, 10:43 AM
  5. fresh install down may be due to tomcat
    By gon in forum Installation
    Replies: 10
    Last Post: 07-25-2007, 08:09 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •