1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

spammer problems

Discussion in 'Plesk for Linux - 8.x and Older' started by gizmo_24, Feb 5, 2006.

  1. gizmo_24

    gizmo_24 Guest

    0
     
    Hi,

    I've got someone on my system doing massive spamming to aol ..
    The qmail logs doesn't show any useful information .. it all looks like the following:

    Feb 5 09:07:36 ws01 qmail: 1139126856.416743 status: local 0/25 remote 24/25
    Feb 5 09:07:36 ws01 qmail: 1139126856.416795 starting delivery 12457: msg 11647100 to remote xxx@aol.com

    The spammer always uses admin@<mydomain> and anonymous@<mydomain> to send the spam:

    qmail-remote aol.com admin@<mydomain> xxx@aol.com

    Does anyone know how to solve this???
     
  2. smarag

    smarag Guest

    0
     
    Have also I the same problem.
     
  3. geeza@

    geeza@ Basic Pleskian

    24
    23%
    Joined:
    Sep 1, 2005
    Messages:
    77
    Likes Received:
    0
    open one of the emails and look at the header of the email. Find the sender ip in angular brackets [x.x.x.x] and add it to the firewall to block it.
     
  4. smarag

    smarag Guest

    0
     
  5. geeza@

    geeza@ Basic Pleskian

    24
    23%
    Joined:
    Sep 1, 2005
    Messages:
    77
    Likes Received:
    0
    You need to find one of the spam emails in the email queue. Try using qmail-read to see the messages in the queue and their numbers.

    Then use find to find the location of the message usings its number.

    Lastly less <message no> to see the full message + email header (with source ip)
     
  6. smarag

    smarag Guest

    0
     
    it does not in only say ip the e-mails it has.
     
  7. jwdick

    jwdick Guest

    0
     
  8. gizmo_24

    gizmo_24 Guest

    0
     
    Thx for your help ..

    What I ask myself is, how these guys are using my server to mail ..

    My guess is that they use php scripts or similar, does anyone have an idea how to find these?
     
  9. jwdick

    jwdick Guest

    0
     
    I got this from another thread here, sorry, I didn't record the thread number, just the solution to tracking php script email:

    Hope this helps you.
     
Loading...