Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

There is a way to send out spam in Cpanel servers

Discussion in 'General Discussion' started by NetX, Dec 20, 2003.

  1. NetX

    NetX Well-Known Member

    Joined:
    Jun 18, 2003
    Messages:
    177
    Likes Received:
    0
    Trophy Points:
    166
    Hi,

    I think my server is used to send out SPAM. (The problem is no matter what I do, I cannot stop it)

    I have specified the maximum each domain can send out per hour in 150.

    But when I view the Mail queue I have more than 30,000 messages there! (Each one with hundreds of mail addresses) and the Mail Statistics show more than 50 000 messages delivered.

    I don't know why??


    Is my server used to send out spam? If so, how can I stop the sapammers? (The WHM tools are not very usefull fot that)

    I really appreciate any help about it.


    Below is one messahe in my mail queue:

    **************************
    1AXjI8-00072u-V4-H
    mailnull 47 12
    <jkkgj@helix.net>
    1071935120 0
    -helo_name unspecified.host
    -host_address 200.63.143.103.1079
    -interface_address 205.60.34.18.25
    -received_protocol smtp
    -body_linecount 17
    -frozen 1071959651
    -host_lookup_failed
    YY freeme2@worldnet.att.net
    YY brown_family@att.net
    YY allsoccer@att.net
    YN agocs@sksyu.net
    NN acameron@mccord.com
    YN billyc@america.com
    NN betty@rockski.net
    YN freegift@ecoutez.com
    NN darrin_haug@dg.com
    YY theyunguns@webtv.net
    YY orders@essexmfg.com
    NY jmartin@canby.com
    NN mchmiel@datron.com
    NN rick@mktnet.com
    YY topflight@webtv.net
    YN tony@hshawaii.com
    NN timothy@wizards.com
    YY webmaster@greatlakeslighthouses.com
    NN unicorn1@pnv.net
    NN webmaster@mindcrime.net
    49
    betty@rockski.net
    oz@pwrnet.com
    agocs@sksyu.net
    webmaster@mindcrime.net
    tony@hshawaii.com
    brown_family@att.net
    acameron@mccord.com
    a.j.oliver@netscape.net
    aacampana@netscape.net
    jmartin@canby.com
    theyunguns@webtv.net
    topflight@webtv.net
    unicorn1@pnv.net
    timothy@wizards.com
    orders@essexmfg.com
    niac_18@eudoramail.com
    mchmiel@datron.com
    rick@mktnet.com
    billyc@america.com
    darrin_haug@dg.com
    freegift@ecoutez.com
    webmaster@greatlakeslighthouses.com
    freeme2@worldnet.att.net
    boolean@mailcity.com
    bpalling@gapac.com
    rtkahn@netscape.net
    dgorrang@cela.com
    noturown@mindspring.com
    webmaster@bluesparc.net
    aleax@netscape.net
    ohsuzieq@netscape.net
    peter_e@dell.com
    sdt@dspg.com
    saturn3003@angelfire.com
    nickisch@montana.com
    rick.curti@win.net
    allsoccer@att.net
    donas@rpa.net
    bstockdale@driveninc.com
    paulboro@netscape.net
    calo@klas-tv.com
    thorsten_winkler@dell.com
    jan_v_d_berg@dell.com
    acecola@angelfire.com
    david.pallett@virgin.net
    wally_lovelace@dell.com
    alexn@cognomen.com
    opinion@badgerherald.com
    olsson@mailbox.calypso.net

    158P Received: from [200.63.143.103] (helo=unspecified.host)
    by server.myhost.net with smtp (Exim 4.24)
    id 1AXjI8-00072u-V4; Sat, 20 Dec 2003 09:45:21 -0600
    127P Received: from 67.65.59.224 ([67.65.59.224]) by 200.63.143.13 (WinRoute Pro 4.1.27) with SMTP; Fri, 19 Dec 2003 20:16:49 -0300
    035F From: "Christy " <jkkgj@helix.net>
    062T To: "bsntqauthw@hummingbird.com" <bsntqauthw@hummingbird.com>
    034 Subject: Someone wants to go out.
    018 MIME-Version: 1.0
    024 Content-Type: text/html
    054I Message-Id: <E1AXjI8-00072u-V4@server.myhost.net>
    038 Date: Sat, 20 Dec 2003 09:45:21 -0600

    **************************
     
  2. DARKMAN

    DARKMAN Registered

    Joined:
    Jan 1, 2004
    Messages:
    3
    Likes Received:
    0
    Trophy Points:
    151
    Location:
    Sibenik, Croatia
    Hi, I'm also having this problem.

    Does someone know how can I trace the mail in queue? What user sent it?
     
  3. RandyO

    RandyO Well-Known Member

    Joined:
    Jun 17, 2003
    Messages:
    173
    Likes Received:
    0
    Trophy Points:
    166
    Most likely a cgi script, there is plenty of info about it on the boards. It self replicates and can usually be found as a counter.cgi file or it will have counter####.cgi they try to hide it as a legit counter.cgi file
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice