The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

There is a way to send out spam in Cpanel servers

Discussion in 'General Discussion' started by NetX, Dec 20, 2003.

  1. NetX

    NetX Well-Known Member

    Joined:
    Jun 18, 2003
    Messages:
    177
    Likes Received:
    0
    Trophy Points:
    16
    Hi,

    I think my server is used to send out SPAM. (The problem is no matter what I do, I cannot stop it)

    I have specified the maximum each domain can send out per hour in 150.

    But when I view the Mail queue I have more than 30,000 messages there! (Each one with hundreds of mail addresses) and the Mail Statistics show more than 50 000 messages delivered.

    I don't know why??


    Is my server used to send out spam? If so, how can I stop the sapammers? (The WHM tools are not very usefull fot that)

    I really appreciate any help about it.


    Below is one messahe in my mail queue:

    **************************
    1AXjI8-00072u-V4-H
    mailnull 47 12
    <jkkgj@helix.net>
    1071935120 0
    -helo_name unspecified.host
    -host_address 200.63.143.103.1079
    -interface_address 205.60.34.18.25
    -received_protocol smtp
    -body_linecount 17
    -frozen 1071959651
    -host_lookup_failed
    YY freeme2@worldnet.att.net
    YY brown_family@att.net
    YY allsoccer@att.net
    YN agocs@sksyu.net
    NN acameron@mccord.com
    YN billyc@america.com
    NN betty@rockski.net
    YN freegift@ecoutez.com
    NN darrin_haug@dg.com
    YY theyunguns@webtv.net
    YY orders@essexmfg.com
    NY jmartin@canby.com
    NN mchmiel@datron.com
    NN rick@mktnet.com
    YY topflight@webtv.net
    YN tony@hshawaii.com
    NN timothy@wizards.com
    YY webmaster@greatlakeslighthouses.com
    NN unicorn1@pnv.net
    NN webmaster@mindcrime.net
    49
    betty@rockski.net
    oz@pwrnet.com
    agocs@sksyu.net
    webmaster@mindcrime.net
    tony@hshawaii.com
    brown_family@att.net
    acameron@mccord.com
    a.j.oliver@netscape.net
    aacampana@netscape.net
    jmartin@canby.com
    theyunguns@webtv.net
    topflight@webtv.net
    unicorn1@pnv.net
    timothy@wizards.com
    orders@essexmfg.com
    niac_18@eudoramail.com
    mchmiel@datron.com
    rick@mktnet.com
    billyc@america.com
    darrin_haug@dg.com
    freegift@ecoutez.com
    webmaster@greatlakeslighthouses.com
    freeme2@worldnet.att.net
    boolean@mailcity.com
    bpalling@gapac.com
    rtkahn@netscape.net
    dgorrang@cela.com
    noturown@mindspring.com
    webmaster@bluesparc.net
    aleax@netscape.net
    ohsuzieq@netscape.net
    peter_e@dell.com
    sdt@dspg.com
    saturn3003@angelfire.com
    nickisch@montana.com
    rick.curti@win.net
    allsoccer@att.net
    donas@rpa.net
    bstockdale@driveninc.com
    paulboro@netscape.net
    calo@klas-tv.com
    thorsten_winkler@dell.com
    jan_v_d_berg@dell.com
    acecola@angelfire.com
    david.pallett@virgin.net
    wally_lovelace@dell.com
    alexn@cognomen.com
    opinion@badgerherald.com
    olsson@mailbox.calypso.net

    158P Received: from [200.63.143.103] (helo=unspecified.host)
    by server.myhost.net with smtp (Exim 4.24)
    id 1AXjI8-00072u-V4; Sat, 20 Dec 2003 09:45:21 -0600
    127P Received: from 67.65.59.224 ([67.65.59.224]) by 200.63.143.13 (WinRoute Pro 4.1.27) with SMTP; Fri, 19 Dec 2003 20:16:49 -0300
    035F From: "Christy " <jkkgj@helix.net>
    062T To: "bsntqauthw@hummingbird.com" <bsntqauthw@hummingbird.com>
    034 Subject: Someone wants to go out.
    018 MIME-Version: 1.0
    024 Content-Type: text/html
    054I Message-Id: <E1AXjI8-00072u-V4@server.myhost.net>
    038 Date: Sat, 20 Dec 2003 09:45:21 -0600

    **************************
     
  2. DARKMAN

    DARKMAN Registered

    Joined:
    Jan 1, 2004
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Sibenik, Croatia
    Hi, I'm also having this problem.

    Does someone know how can I trace the mail in queue? What user sent it?
     
  3. RandyO

    RandyO Well-Known Member

    Joined:
    Jun 17, 2003
    Messages:
    173
    Likes Received:
    0
    Trophy Points:
    16
    Most likely a cgi script, there is plenty of info about it on the boards. It self replicates and can usually be found as a counter.cgi file or it will have counter####.cgi they try to hide it as a legit counter.cgi file
     
Loading...

Share This Page