The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Server sending spam: How to troubleshoot?

Discussion in 'E-mail Discussions' started by katydid, Jun 29, 2011.

  1. katydid

    katydid Registered

    Joined:
    Jun 29, 2011
    Messages:
    1
    Likes Received:
    0
    Trophy Points:
    1
    My server is sending out spam messages, and I don't even know where to start to troubleshoot this. What can I look for? Here's an example. It's obviously being sent out by some PHP script ("nobody"), but X-Source* are blank. I cannot globally disable PHP mail, and I can't turn on phpsuexec because it breaks a bunch of the scripts. How can I track these to a script on my server?

    Code:
    Received: from server.example.com (server.example.com [123.123.123.123])
    by mtain-dh05.r1000.mx.aol.com (Internet Inbound) with ESMTP id 9BB36380002A1
    for <redacted@aol.com>; Tue, 28 Jun 2011 13:59:37 -0400 (EDT)
    Received: from nobody by server.example.com with local (Exim 4.69)
    (envelope-from <nobody@server.example.com>)
    id 1QbcLv-0004nn-S3
    for redacted@aol.com; Tue, 28 Jun 2011 12:45:35 -0500
    To: redacted@aol.com
    Subject: PLS HELP ME
    From: WILLIAMS <engranderson2010@yahoo.co.jo>
    Reply-To: engranderson2010@yahoo.co.jo
    MIME-Version: 1.0
    Content-Type: text/plain
    Content-Transfer-Encoding: 8bit
    Message-Id: <E1QbcLv-0004nn-S3@server.example.com>
    Date: Tue, 28 Jun 2011 12:45:35 -0500
    X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
    X-AntiAbuse: Primary Hostname - server.example.com
    X-AntiAbuse: Original Domain - aol.com
    X-AntiAbuse: Originator/Caller UID/GID - [99 500] / [47 12]
    X-AntiAbuse: Sender Address Domain - server.example.com
    X-Source:
    X-Source-Args:
    X-Source-Dir:
    x-aol-global-disposition: S
    X-AOL-SCOLL-SCORE: 0:2:107005616:93952408
    X-AOL-SCOLL-URL_COUNT: 0
    X-AOL-REROUTE: YES
    x-aol-sid: 3039ac1d41194e0a16895298
    X-AOL-IP: 123.123.123.123
    X-AOL-SPF: domain : server.example.com SPF : none
    MIME element (text/plain)
    ENGR WILLIMAS
    FEDERAL MINISTRY OF
    PETROLEUM AND MINERAL
    RESOURCES.
    FEDERAL REPUBLIC OF NIGERIA,
    LAGOS, NIGERIA
    WEST AFRICA.
    ATTN:Sir
    PLEASE REPLY to:(
    Dear Friend,
    RE:REQUEST FOR URGENT CONFIDENTIAL BUSINESS RELATIONSHIP IN RESPECT OF THE
    TRANSFER OF $25,500,000.00(TWENTY-FIVE MILLION FIVE HUNDRED AMERICAN
    DOLLARS)INTO YOUR ACCOUNT.
    I,on behalf of my other colleagues from different Federal Government of
    Nigeria owned parastatals decided to solicit your assistance as regards
    the transfer of the above stated amount into your bank account. This fund
    arose from the over invoicing of various contracts awarded in my
    parastatal to certain foreign contractors sometime ago.
    We as holders of sensitive positions in our various parastatal, were
    mandated by the federal government to scrutinise all payments made to
    foreign contractors,
    and discovered that some of the contracts they executed were grossly over
    invoiced,either by omission or commission. Also, we discovered that the
    sum of $33,000,000.00(thirty three million American dollars only) was
    lying in a suspense account, although the foreign contractors were fully
    paid their entitlements after executing the said contracts.
    We all agreed that the over-invoiced amount be transferred into a bank
    account provided by a foreign partner, as the code of conduct of federal
    civil service does not allow us to operate foreign accounts.
    However, we have suceeded in transferring some of the monies, precisely
    US$7.5(Seven million five Hundred American Dollars) into a foreign account
    in united State of America,but unfortunately the provider of the account
    has severed all forms of communication with us as he has refused to adhere
    to our earlier mutual agreement, insisting that the total amount be paid
    into his nominated bank account beforedisbursement will take effect.
    We are therefore seeking your assistance based on the balance amount
    US$25.5M which can be speedily processed and fully remitted into your
    nominated bank account.On successful remittance of the funds into your
    account, you will be compensated with 20% of of the amount for your
    assistance and services.
    This transaction is closely knitted and in view of our sensitive positions
    we cannot afford a slip. I assure you that this transaction is 100% risk
    free.
    We will avail you with our identities as regards our respective office
    when relationship is fully established and smooth operation commences.
    I am at your disposition to entertain any questions from you in respect of
    this transaction, so, contact me immediately through the above email
    address for further information on the requirements and procedure.
    Please note that this is a DEAL and confidentiality is of very great
    important for security reasons.
    Please treat with strict confidential and utmost urgency.
    N.B: Your telephone and fax numbers are needed for easy communication.
    Best regards,
    CIVIL SERVANT
    FEDERAL MINISTRY OF
    PETROLEUM AND MINERAL
    RESOURCES
    ENGR WILLIMAS 
     
Loading...

Share This Page