Spammer se conecta a mi SMTP. No puedo reportarlo.

Thevenin · #1 (**permalink**) 15/01/2008, 12:42

Buenos días:

Desde el día 12, varios ordenadores ubicados en las redes siguientes están tratando de enviar SPAM a través de mi SMTP de pruebas:

http://ws.arin.net/whois/?queryinput=204.13.69.69
http://ws.arin.net/whois/?queryinput=66.79.170.102

A pesar de haber instalado un firewall y haberles denegado correctamente la conexión (ya no dejan mensajes ni nada) continuan erre que erre.

He intentado denunciar en spamcom.net, pero lo que quieren en el formulario es las cabeceras de un mensaje de spam.

He reportado esta información a :

[email protected] para el (204.13.69.69) y
[email protected] para 66.79.170.102

pero ni contestan.

Escribí a [email protected] pero me dicen que no pueden bloquearlos (no explican porqué, pero imagino que porque son ips extranjeras).

También probé en la página www.telefonicaonline.com/nemesys y llamando al número de atención ADSL de telefónica, y nada.

¿Se os ocurre alguna idea?

Un saludo.

15/01/2008 8:52:26 - SMTP Server started. Listening on port 25
15/01/2008 8:52:26 - POP3 Server started. Listening on port 110
15/01/2008 8:52:26 - Finger Server started. Listening on port 79
Message size limit 5 MB
Winsock version: $0101
High version: $0202
Description: WinSock 2.0
System status: Running
Maximum sockets: 32767
Local host: HELENA
Local addresses: 172.16.0.2
Local host after reverse lookup: HELENA
15/01/2008 8:52:50 - Requested SMTP connection from 205.209.136.46
15/01/2008 8:52:50 - Requested SMTP connection from 66.79.170.106
15/01/2008 8:52:50 - Requested SMTP connection from 204.13.69.27
15/01/2008 8:52:50 - Requested SMTP connection from 66.79.170.92
15/01/2008 8:52:50 - Requested SMTP connection from 205.209.136.44
15/01/2008 8:52:51 - Requested SMTP connection from 205.209.136.180
15/01/2008 8:52:51 - Requested SMTP connection from 204.13.69.68
15/01/2008 8:52:51 - Requested SMTP connection from 208.77.45.68
15/01/2008 8:52:51 - Requested SMTP connection from 66.79.170.102
15/01/2008 8:52:51 - Requested SMTP connection from 204.13.69.92
15/01/2008 8:52:52 - Requested SMTP connection from 204.13.69.27
15/01/2008 8:52:52 - Requested SMTP connection from 205.209.136.180
15/01/2008 8:52:52 - Requested SMTP connection from 204.13.69.27
15/01/2008 8:52:52 - Requested SMTP connection from 205.209.142.22
15/01/2008 8:52:52 - Requested SMTP connection from 205.209.142.34
15/01/2008 8:52:52 - Requested SMTP connection from 66.79.170.101
15/01/2008 8:52:52 - Requested SMTP connection from 204.13.69.27
15/01/2008 8:52:53 - Requested SMTP connection from 208.77.45.68
15/01/2008 8:52:53 - Requested SMTP connection from 204.13.69.90
15/01/2008 8:52:53 - Requested SMTP connection from 204.13.69.93
15/01/2008 8:53:53 - Error: Operation has been canceled
15/01/2008 8:53:53 - Error: Operation has been canceled
15/01/2008 8:53:53 - Error: Operation has been canceled
15/01/2008 8:53:53 - Error: Operation has been canceled
15/01/2008 8:53:53 - Error: Operation has been canceled
15/01/2008 8:53:53 - Error: Operation has been canceled

14/01/2008 23:28:52 - POP3 Server started. Listening on port 110
14/01/2008 23:28:52 - Finger Server started. Listening on port 79
Message size limit 5 MB
Winsock version: $0101
High version: $0202
Description: WinSock 2.0
System status: Running
Maximum sockets: 32767
Local host: HELENA
Local addresses: 172.16.0.2
Local host after reverse lookup: HELENA
14/01/2008 23:28:54 - Requested SMTP connection from 204.13.69.90
14/01/2008 23:28:54 - Requested SMTP connection from 205.209.142.22
14/01/2008 23:28:55 - Requested SMTP connection from 208.77.45.68
14/01/2008 23:28:56 - Requested SMTP connection from 204.13.69.90
14/01/2008 23:28:56 - Requested SMTP connection from 204.13.69.27
14/01/2008 23:28:56 - Requested SMTP connection from 66.79.170.106
14/01/2008 23:28:56 - Requested SMTP connection from 205.209.142.34
14/01/2008 23:28:56 - Requested SMTP connection from 66.79.170.102
14/01/2008 23:28:57 - SMTP connection with 208.77.45.68 ended. ID=3
14/01/2008 23:28:58 - Requested SMTP connection from 205.209.161.146
14/01/2008 23:28:58 - Requested SMTP connection from 204.13.69.69
14/01/2008 23:28:59 - Requested SMTP connection from 205.209.142.27
14/01/2008 23:29:00 - Requested SMTP connection from 205.209.136.180
14/01/2008 23:29:00 - Requested SMTP connection from 66.79.170.101
14/01/2008 23:29:02 - Requested SMTP connection from 208.77.45.131
14/01/2008 23:29:02 - Requested SMTP connection from 205.209.136.178
14/01/2008 23:29:03 - Requested SMTP connection from 208.77.45.68
14/01/2008 23:29:03 - Requested SMTP connection from 205.209.142.27
14/01/2008 23:29:04 - Requested SMTP connection from 208.77.45.131
14/01/2008 23:29:05 - Requested SMTP connection from 205.209.136.46
14/01/2008 23:29:05 - Requested SMTP connection from 205.209.136.44
14/01/2008 23:29:05 - Requested SMTP connection from 205.209.143.11
14/01/2008 23:29:06 - Requested SMTP connection from 204.13.69.68
14/01/2008 23:29:06 - Requested SMTP connection from 205.209.142.26
14/01/2008 23:29:06 - Requested SMTP connection from 204.13.69.11
14/01/2008 23:29:08 - SMTP connection with 66.79.170.102 ended. ID=8
14/01/2008 23:29:08 - Requested SMTP connection from 204.13.69.70
14/01/2008 23:29:08 - Requested SMTP connection from 204.13.69.70
14/01/2008 23:29:10 - Requested SMTP connection from 204.13.69.68
14/01/2008 23:29:10 - Requested SMTP connection from 66.79.170.102
14/01/2008 23:29:10 - Requested SMTP connection from 205.209.136.44
14/01/2008 23:29:10 - Requested SMTP connection from 204.13.69.68
14/01/2008 23:29:10 - Requested SMTP connection from 66.79.170.101
14/01/2008 23:29:11 - Requested SMTP connection from 204.13.69.27
14/01/2008 23:29:11 - Requested SMTP connection from 208.77.45.131
14/01/2008 23:29:12 - Requested SMTP connection from 205.209.136.44
14/01/2008 23:29:13 - Requested SMTP connection from 66.79.170.102
14/01/2008 23:29:14 - Requested SMTP connection from 204.13.69.90
14/01/2008 23:29:14 - Requested SMTP connection from 208.77.45.68
14/01/2008 23:29:17 - Requested SMTP connection from 205.209.136.178
14/01/2008 23:29:17 - Requested SMTP connection from 208.77.45.131
14/01/2008 23:29:17 - Requested SMTP connection from 204.13.69.70
14/01/2008 23:29:18 - Requested SMTP connection from 204.13.69.27
14/01/2008 23:29:19 - Requested SMTP connection from 204.13.69.93
14/01/2008 23:29:20 - Requested SMTP connection from 205.209.142.34
14/01/2008 23:29:20 - Requested SMTP connection from 205.209.136.46
14/01/2008 23:29:22 - Requested SMTP connection from 204.13.69.27

diegors · #2 (**permalink**) 17/01/2008, 05:46

con iptables, crea dos reglas para que filtre todo acceso a los puertos desde internet.

Thevenin · #3 (**permalink**) 17/01/2008, 14:00

Cita:

Iniciado por diegors

con iptables, crea dos reglas para que filtre todo acceso a los puertos desde internet.

Hola, gracias por la respuesta, aunque ya no me preocupa el echo de que conecten o no al SMTP, ya que cambié el puerto del mismo, y tengo un firewall que bloquea los cuatro o cinco ordenadores a cualquier puerto que se conecten.

El problema no es técnico en sí, sino que necesito reportarlo para que los metan en una lista negra.

Por lo pronto dejé que entraran un par de emails al servidor, reporté esos emails a spamcop.net, y detectó las direcciones de abuse (las mismas que puse yo en el mensaje anterior).

Yo esperaba que eso fuera suficiente, pero o los administradores pasan un kilo o ellos mismos son los encargados de enviar esos spam's.

Y telefónica ni se entera, ahora me dicen que es que yo puedo tener un virus, a pesar de haberles dejado clarito que lo que tenía era un servidor SMTP de pruebas (mal configurado eso sí).

¿No hay más organismos a los que dirigirse?