The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Help - My server is being used as a spam relay right now

Discussion in 'General Discussion' started by romanus, Sep 11, 2006.

  1. romanus

    romanus Well-Known Member

    Joined:
    Jul 17, 2004
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    6
    How can I find out which domain is responsible for the 3000 or so bounced emails that I got in the last 20 minutes?
     
  2. mctDarren

    mctDarren Well-Known Member

    Joined:
    Jan 6, 2004
    Messages:
    664
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    New Jersey
    cPanel Access Level:
    Root Administrator
    If you are running suexec you could check the suexec_log to see what scripts ran when, you can grep it to find the specific time that the spam occurred. If you still have mail in queue, check the headers to see if you can see where it came from.

    :edit: bounced? might just be someone using your domain name as the reply to when they are sending out spam too....
     
    #2 mctDarren, Sep 11, 2006
    Last edited: Sep 11, 2006
  3. romanus

    romanus Well-Known Member

    Joined:
    Jul 17, 2004
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    6
    noe these are in my mail que with my host name in the header
     
  4. romanus

    romanus Well-Known Member

    Joined:
    Jul 17, 2004
    Messages:
    68
    Likes Received:
    0
    Trophy Points:
    6
  5. mohit

    mohit Well-Known Member

    Joined:
    Jul 12, 2005
    Messages:
    553
    Likes Received:
    0
    Trophy Points:
    16
    Location:
    Sticky On Internet
    hi,
    there are a lot of threads which can help you catch the culprit.
    Try searching the forum as
    Code:
    http://forums.cpanel.net/search.php?searchid=1507222
    or
    Code:
    http://forums.cpanel.net/search.php?searchid=1507239


    PS: please correct the spelling of Mahatma Gandhi in your signature.
     
Loading...

Share This Page