Mystery Spam Piling Up in Mqueue

Jeff Royle lists at qwirky.net
Mon Jan 15 04:46:33 UTC 2007


The example below is simply a bounce that did not go through.

Note: Mailer-Daemon and MDeferred: Connection refused by macbilling.com.

Your system attempted to delivery a bounce back to macbilling.com and 
the MTA @ macbilling.com is rejecting the bounce.

Most likely spam using a forged (or real) address 
<something>@macbilling.com was sent to your system to 
<somefakeaddress>@highperformance.net and of course your system could 
not deliver the message so it bounced.

If all messages in your queue are like this, I would take some time, 
report the spam to say spamcop.net or the like and remove them.   You 
even could be a nice internet neighbour and try to redeliver the legit ones.

Welcome to the running a mailserver on the intertubes. :-)

Cheers,

Jeff


Jason C. Wells wrote:
> I have a bunch of mail piling up in /var/spool/mqueue.  It appears to be 
> all spam and it appears to be generated on the localhost.  I am not 
> sending it.  I double checked my self @ abuse.net to see if I was an 
> open relay, I'm not.  I can't really say where it's coming from.  How do 
> I figure this one out?
> 
> An example is shown below.
> 
> What has been a fun hobby all these years is turning into a nightmare.  
> Spam is making me batty.
> 
> Thanks,
> Jason C. Wells
> 
> 
> V8
> T1168684668
> K1168832991
> N87
> P7790448
> I0/81/22039
> MDeferred: Connection refused by macbilling.com.
> Frs
> $_localhost
> $r
> $slocalhost
> ${daemon_flags}
> ${if_addr}192.168.1.204
> SMAILER-DAEMON
> MDeferred: Connection refused by macbilling.com.
> rRFC822; zpiracing.net at macbilling.com
> RPF:<zpiracing.net at macbilling.com>
> H?P?Return-Path: <<81>g>
> H??Received: from localhost (localhost)
>        by mx1.highperformance.net (8.13.8/8.13.8) id l0DAbm7q007014;
>        Sat, 13 Jan 2007 02:37:48 -0800 (PST)
>        (envelope-from MAILER-DAEMON)
> H?D?Date: Sat, 13 Jan 2007 02:37:48 -0800 (PST)
> H??Received: from localhost (localhost)
>        by mx1.highperformance.net (8.13.8/8.13.8) id l0DAbm7q007014;
>        Sat, 13 Jan 2007 02:37:48 -0800 (PST)
>        (envelope-from MAILER-DAEMON)
> H?D?Date: Sat, 13 Jan 2007 02:37:48 -0800 (PST)
> H?F?From: Mail Delivery Subsystem <MAILER-DAEMON>
> H?x?Full-Name: Mail Delivery Subsystem
> H?M?Message-Id: <200701131037.l0DAbm7q007014 at mx1.highperformance.net>
> H??To: <zpiracing.net at macbilling.com>
> H??MIME-Version: 1.0
> H??Content-Type: multipart/report; report-type=delivery-status;
>        boundary="l0DAbm7q007014.1168684668/mx1.highperformance.net"
> H??Subject: Returned mail: see transcript for details
> H??Auto-Submitted: auto-generated (failure)
> .
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to 
> "freebsd-questions-unsubscribe at freebsd.org"



More information about the freebsd-questions mailing list