Einer unser Firmenserver regestrierte vermehrte Zustellversuche von angeblichen PayPal Mails.
Der Server hat den Fake natürlich erkannt, aber ich bezweifle, das dies auch die freien Anbieter bemerken...
Möglicherweise geht wieder eine Welle los, deswegen Augen auf beim Klicken.
einige Fälle
--------------
Oct 16 16:04:56 *** postfix/smtpd[8365]: connect from botsarea.com[46.32.229.203]
Oct 16 16:04:56 *** postfix/smtpd[8365]: NOQUEUE: reject: RCPT from botsarea.com[46.32.229.203]: 554 5.7.1 Service unavailable; Client host [46.32.229.203] blocked using ix.dnsbl.manitu.net; Your e-mail service was detected by mail.ixlab.de (NiX Spam) as spamming at Thu, 16 Oct 2014 12:18:00 +0200. Your admin should visit http://www.dnsbl.manitu.net/lookup.php?value=46.32.229.203; from=<service@paylpal.com> to=<***@***.de> proto=ESMTP helo=<botsarea.com>
Oct 16 16:05:03 *** postfix/smtpd[8365]: disconnect from botsarea.com[46.32.229.203]
Oct 16 16:12:12 *** postfix/smtpd[8470]: connect from botsarea.com[46.32.229.203]
Oct 16 16:12:12 *** postfix/smtpd[8470]: NOQUEUE: reject: RCPT from botsarea.com[46.32.229.203]: 554 5.7.1 Service unavailable; Client host [46.32.229.203] blocked using ix.dnsbl.manitu.net; Your e-mail service was detected by mail.ixlab.de (NiX Spam) as spamming at Thu, 16 Oct 2014 12:18:00 +0200. Your admin should visit http://www.dnsbl.manitu.net/lookup.php?value=46.32.229.203; from=<service@paylpal.com> to=<***@***.de> proto=ESMTP helo=<botsarea.com>
und noch einmal, aber ein anderer MTA
----------------
Oct 16 04:37:40 *** postfix/smtpd[32485]: connect from v211n03.inet.sy[91.144.8.148]
Oct 16 04:37:40 *** postfix/smtpd[32485]: NOQUEUE: reject: RCPT from v211n03.inet.sy[91.144.8.148]: 554 5.7.1 Service unavailable; Client host [91.144.8.148] blocked using ix.dnsbl.manitu.net; Your e-mail service was detected by mail.ixlab.de (NiX Spam) as spamming at Thu, 16 Oct 2014 01:05:57 +0200. Your admin should visit http://www.dnsbl.manitu.net/lookup.php?value=91.144.8.148; from=<service@paylpal.com> to=<***@***.de> proto=ESMTP helo=<ns5.dnsplatinum.com>
Oct 16 04:37:47 *** postfix/smtpd[32485]: disconnect from v211n03.inet.sy[91.144.8.148]
Oct 16 04:43:07 *** postfix/anvil[32487]: statistics: max connection rate 1/60s for (smtp:91.144.8.148) at Oct 16 04:37:40
Oct 16 04:43:07 *** postfix/anvil[32487]: statistics: max connection count 1 for (smtp:91.144.8.148) at Oct 16 04:37:40
Oct 16 04:48:41 *** postfix/smtpd[32533]: connect from v211n03.inet.sy[91.144.8.148]
Oct 16 04:48:41 *** postfix/smtpd[32533]: NOQUEUE: reject: RCPT from v211n03.inet.sy[91.144.8.148]: 554 5.7.1 Service unavailable; Client host [91.144.8.148] blocked using ix.dnsbl.manitu.net; Your e-mail service was detected by mail.ixlab.de (NiX Spam) as spamming at Thu, 16 Oct 2014 01:05:57 +0200. Your admin should visit http://www.dnsbl.manitu.net/lookup.php?value=91.144.8.148; from=<service@paylpal.com> to=<***@***.de> proto=ESMTP helo=<ns5.dnsplatinum.com>
Problematisch wieder einmal, zugestellt von gehighjackten Servern...