find spam relaying user?

[synthetic5995]

I facing a serious problem with my qmail and plesk 11.0.9.

I found the way spammer did with my server by listening everything on port 25.

Maybe he know the RCPT hosts of mine, and they send emails with random username but with domain hosted on my Plesk. ([email protected], [email protected], ... [email protected]).

qmail only check domain in RCPT if spammer input:

"mail from [email protected]" - (with out ":") - no email address on my server.
then server reply: 550 sorry, no mailbox here by that name. (#5.7.17)

But qmail check username and domain if spammer input:

""mail from: [email protected]" - (with ":") - no email address on my server.
then server reply: 250 OK


This is really weird! I tried with all my plesk server, this bug still effected.

Do you have any idea?

Thank You!

 

[synthetic5995]

http://forum.parallels.com/showthread.php?303771-Qmail-act-as-Open-Relay-Email-Server

I also have this problems before, with ":" and without ":".

Anyone have any suggestion?

 

[minhnv]

@tuanbo91 : i'm facing the same serious problem as you. did you resolve this problem.

our server farm having a massive spam ( ip from all over the world with unreal random mailbox users )
please help