Server Sending Spam Problem

drupalin · Dec 30, 2016

Hi everyone, i´m kind of desesperate, my server sends spam from email acounts very similar to the real one.

Real Mail Account: info@example.com

Spammers:
info115@example.com
info116@example.com
info117@example.com
info118@example.com
info119@example.com
....

After of write this: grep cwd /var/log/exim_mainlog|grep -v /var/spool|awk -F"cwd=" '{print $2}'|awk '{print $1}'|sort|uniq -c|sort -n

I get this details:
Code:
1 /home/biovidrio/public_html

1 /home/meollo/public_html

1 /home/tyd/public_html

1 /home/webes/public_html/base

1 /home/webes/public_html/clinicadental

1 /home/webes/public_html/serviamb

1 /var/log

2 /home/adventurerooms/public_html

2 /home/webes/public_html/tienda

3 /home/enigmabohemia/public_html

3 /home/legionella/public_html

4 /home/ruraly/public_html

4 /home/webes/public_html

4 /home/webtematica/public_html

5 /home/actormania/public_html

5 /home/albertogorgojo/public_html

5 /home/algodonmerlin/public_html

5 /home/antonioaznar/public_html

5 /home/elperiodismo/public_html

5 /home/fisioterapia/public_html

5 /home/fontanerosmadrid/public_html

5 /home/inmobiliaria/public_html

5 /home/kristianboys/public_html

5 /home/serviamb/public_html

6 /home/disenowebmadrid/public_html

7 /home/costurasnontol/public_html

7 /home/cursoderevit/public_html

8 /tmp

14 /home/portalclasico/public_html

78 /

110 /usr/local/apache/domlogs/portalclasico

181 /home

960 /root

6748 /usr/local/cpanel/whostmgr/docroot
So it seems its root user witch sends spam, but i can not find a way to get the spammer script

Thanks very much

SysSachin · Dec 30, 2016

Hello,

It's seems the mail sending from account using php mail script. I think there is infected file under the account which is sending mails.

Please try to check logs using below command so that you will get account account which is sending mail.
Code:
tail -n2000 /var/log/exim_mainlog|grep /home/

drupalin · Dec 30, 2016

Thanks for the replay, i´m only get this details:
Code:
2016-12-30 11:42:37 [3507] cwd=/home/someusr/public_html 4 args: /usr/sbin/sendmail -t -i -finfo@example.com

SysSachin · Dec 30, 2016

drupalin said: ↑

Real Mail Account: info@example.com

Spammers:
info115@example.com
info116@example.com
info117@example.com
info118@example.com
info119@example.com
....
Click to expand...

If spam mails sending one account then try to scan account with maldet and clamscan if found any infected mail script under that account.

rpvw · Dec 30, 2016

Remember this may not be an infected script, and may not be detected by antivirus or malware detection software.

Check for things like unpatched versions ( eg PHPMailer that has just had 2 critical updates in 3 days, and which may well be being actively exploited.) and any other php scripts that might be installed.

drupalin · Dec 30, 2016

Thanks for the replay, i check with malded and clam, but not show results, about PHPMailer, not know what to do or update

Any ideas, thanks very much in advance and happy new year

drupalin · Jan 1, 2017

I repeat the grep cwd /var/log/exim_mainlog|grep -v /var/spool|awk -F"cwd=" '{print $2}'|awk '{print $1}'|sort|uniq -c|sort -n and this is the result

Code:

1
      1 /home/actormania/public_html
      1 /home/albertogorgojo/public_html
      1 /home/algodonmerlin/public_html
      1 /home/antonioaznar/public_html
      1 /home/costurasnontol/public_html
      1 /home/cursoderevit/public_html
      1 /home/disenowebmadrid/public_html
      1 /home/elperiodismo/public_html
      1 /home/enigmabohemia/public_html
      1 /home/fisioterapia/public_html
      1 /home/fontanerosmadrid/public_html
      1 /home/inmobiliaria/public_html
      1 /home/kristianboys/public_html
      1 /home/ruraly/public_html
      1 /home/serviamb/public_html
      1 /home/webes/public_html
      3 /home/webtematica/public_html
    164 /root
    318 /
   3700 /usr/local/cpanel/whostmgr/docroot

NOC_Serverpoint · Jan 3, 2017

Hi,

Following command that will show you the script which is using script to send the email. If it is from php then use

# egrep -R "X-PHP-Script" /var/spool/exim/input/*

Thanks,

cPanelMichael · Jan 6, 2017

Hello,

The following document is a good place to start:

How to Prevent Email Abuse - cPanel Knowledge Base - cPanel Documentation

In particular, review the section titled "Experimental: Rewrite From: header to match actual sender":

Experimental: Rewrite From: header to match actual sender
Any local cPanel user can use the 127.0.0.1 IP address to send mail without authentication. This can make it difficult for system administrators to determine which cPanel account sent the mail, especially when a malicious user spoofs an email address to disguise the origin of the email.

To require cPanel & WHM to put the actual sender in the header, enable the Experimental: Rewrite From: header to match actual sender option in WHM's Exim Configuration Manager interface (Home >> Exim Service Configuration >> Exim Configuration Manager).

After you enable this feature, you will see output that is similar to the following in the /var/log/exim_mainlog file:

2014-04-23 08:09:52 1Wcwvu-0000On-Sb From: header (rewritten was: [fakemail@example.com], actual sender is not the same system user) original=[fakemail@example.com] actual_sender=[spammer@spammer.com]
The actual_sender portion of the log entry shows that spammer is the cPanel account that sent the email. This information allows the system administrator to take action against the account to prevent additional spam.
Click to expand...

Thank you.

Forums

The Community Forums

Interact with an entire community of cPanel & WHM users!

Server Sending Spam Problem

drupalin Registered

SysSachin Well-Known Member

drupalin Registered

SysSachin Well-Known Member

rpvw Well-Known Member

drupalin Registered

drupalin Registered

NOC_Serverpoint Well-Known Member

cPanelMichael Technical Support Community Manager
Staff Member

Server is sending spam

Prevent users from sending emails that gets server IP blocked?

Server gets no return TCP packets when sending to cPanel server

SOLVED DNS only server sending email about backups

Mail not working on server (sending and receiving)

Share This Page

Useful Searches

The Community Forums

Interact with an entire community of cPanel & WHM users!

Server Sending Spam Problem

drupalin Registered

SysSachin Well-Known Member

drupalin Registered

SysSachin Well-Known Member

rpvw Well-Known Member

drupalin Registered

drupalin Registered

NOC_Serverpoint Well-Known Member

cPanelMichael Technical Support Community Manager Staff Member

Server is sending spam

Prevent users from sending emails that gets server IP blocked?

Server gets no return TCP packets when sending to cPanel server

SOLVED DNS only server sending email about backups

Mail not working on server (sending and receiving)

Share This Page

cPanelMichael Technical Support Community Manager
Staff Member