есть сервер, на нем стоит vestacp, настроен exim, недавно началась забиваться очередь странными письмами, например
1dVGhm-0007Yc-UQ-D
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
user19@gmail.com
(ultimately generated from user@example.com)
SMTP error from remote mail server after end of data:
host gmail-smtp-in.l.google.com [64.233.191.27]:
550-5.7.1 [1.2.3.4 7] Our system has detected that this message is
550-5.7.1 likely unsolicited mail. To reduce the amount of spam sent to Gmail,
550-5.7.1 this message has been blocked. Please visit
550-5.7.1 https://support.google.com/mail/?p=UnsolicitedMessageError
550 5.7.1 for more information. q7si2227627itc.102 - gsmtp
------ This is a copy of the message, including all the headers. ------
Return-path: <pouxaihfzuwgh@isokanet.com>
Received: from static.232.158.46.78.clients.your-server.de ([78.46.158.232] helo=mailer-daemon)
by domain.com with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128)
(Exim 4.82)
(envelope-from <pouxaihfzuwgh@isokanet.com>)
id 1dVGhX-0007Uq-OB
for user@example.com; Wed, 12 Jul 2017 15:25:16 +0300
Received: from [179.211.85.36] (helo=b3d35524.virtua.com.br)
by mailer-daemon with smtp (Exim 4.80)
(envelope-from <pouxaihfzuwgh@isokanet.com>)
id 1dVGhU-0004IJ-RH
for support@s.com; Wed, 12 Jul 2017 14:25:06 +0200
Message-ID: <7565294537-HYJPYVXJPRMVAHLQIQAJE@plorusujv.gogan.us>
From: "Trudy Kent" <Kent04@gogan.us>
Subject: Don't slow your life down! Use Viagra Capsules.
To: support@s.com
Date: Wed, 12 Jul 2017 12:17:03 -0100
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="_av-2096603544953141"
X-Spam-Score: 76
X-Spam-Bar: +++++++
X-Spam-Report: Spam detection software, running on the system "domain.com",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Don't slow your life down! Use Viagra Capsules. = A man can
do more when he uses Viagra Super Active. Buy it in our online store and
become Super Active! = The best price here! *SALE2017 *Use this code and get
ADDITIONAL discount 5% for all our product.* [...]
Content analysis details: (7.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: uploadhouse.com]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?179.211.85.36>]
0.8 RCVD_IN_SORBS_WEB RBL: SORBS: sender is an abusable web server
[179.211.85.36 listed in dnsbl.sorbs.net]
3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_HELO_NON_FQDN_1 No description available.
0.0 T_HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
2.0 DRUGS_ERECTILE Refers to an erectile drug
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam (from pouxaihfzuwgh@isokanet.com to user@example.com).
--_av-2096603544953141
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
в vestacp заведена почта user@example.com, которая перенаправляет письма на user19@gmail.com, это просто спам или с моего сервера рассылают спам?
