How to prevente from sending emails from other domains.

[dio]

Hello all,

I have a VPS running "Version Plesk v12.0.18_build1200140606.15" on "OS CentOS 6.4 (Final)" with 3 hosted domains and another running "Plesk v12.0.18_build1200140606.15" on "SO Debian 7.6" with only 2 domains.

I have strong passwords everywhere, and both servers configured equal, but in the CentOS I've got all the time Spam Attacks, its like someone is trying to use my server to send spam, like you can see in the attached image.
The Debian server is allways "clean".

I double-checked all possible options and can't find the reason for that.

Can someone help?

Thank you.

 

[abdi]

Hello Dio,

You will need to investigate the source of SPAM.
Chances are you have a CMS such as Joomla /Wordpress.

Please understand that there lots of resources of how to mitigate spam on a server. Just Google.

Otherwise, I would also suggest you disable the Php Mail Function and only use SMTP with your website forms.

 

[UFHH01]

Hi dio,

you might find it interesting, that Odin wrote a KB - article, how to investigate spam on your server, when using sendmail:

Many email messages are sent from PHP scripts on the server. How to find the domains on which these scripts are running? ( KB - article 1711 )​

 

[dio]

Thank you for your help abdi.

Both servers have CMS, and the one with spam problems have phplist, but is only activated when I have to send a mass mail to the users of an phpbb forum (not spam) already because of that, i'm going to disable php mail function too, how can I do that?

@UFHH01 I will try that too, thanks.

 

[abdi]

Hello Dio,

When you are able to resolve the problem, it would be nice to share (for other community members) how and what approach you used.

Otherwise have (+@UFHH01) a nice weekend!

 

[dio]

Hello all.

I've failed to find the source of spam, I really don't understand why emails are trying to be send from domains that don't even exist in my VPS, its like they try to use my server to Relay emails, but I have "authorization is required" enabled to send emails, and "SPF spam protection" ON.

Messages like this one are all the time in the "Mail queue", even with mydomain.com in suspend.

Received: (qmail 17868 invoked from network); 17 Dec 2015 15:50:05 +0100
Received: from 176-228-208-90.orange.net.il (HELO fplm.com) (176.228.208.90)
    by MYVPS.ovh.net with ESMTPSA (DHE-RSA-AES256-GCM-SHA384 encrypted,
    authenticated); 17 Dec 2015 15:50:05 +0100
From: BDfugue.com <[email protected]>
To: "Ann Vinck" <[email protected]>, "Anna Bui Xuan"
    <[email protected]>, "Anna COELHO" <[email protected]>,
    "Anna Godoy" <[email protected]>
Subject: Fw: new message
Date: Thu, 17 Dec 2015 22:47:20 -0800
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_0001_3308AECB.4FAC99FB"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AdE1fwyb03dLkG0cVLyC0jK1cj7YAQ==
Content-Language: en-us
X-PPP-Message-ID: <[email protected]>
X-PPP-Vhost: MYDOMAIN.com

Any help is appreciated.

 

[serverpoint_tom]

Hi,

Please check the below article,
===========
http://download1.parallels.com/Ples...inistrator-guide/index.htm?fileName=71349.htm
===========

Thank you,

 

[dio]

Thank you for your help serverpoint_tom.

In fact, my server add the 127.0.0.0/8 and ::1/128 in the whitelist since the original version was 11.5.30, now its in 12.5.30, i've remove all, let's see how it goes.

I have to test later if PHPList work correctly without that configution.

Thank you once again.

EDIT: Spam mails still appear in the Mail Queue... :/