There is a way to send out spam in Cpanel servers

[NetX]

Hi,

I think my server is used to send out SPAM. (The problem is no matter what I do, I cannot stop it)

I have specified the maximum each domain can send out per hour in 150.

But when I view the Mail queue I have more than 30,000 messages there! (Each one with hundreds of mail addresses) and the Mail Statistics show more than 50 000 messages delivered.

I don't know why??


Is my server used to send out spam? If so, how can I stop the sapammers? (The WHM tools are not very usefull fot that)

I really appreciate any help about it.


Below is one messahe in my mail queue:

**************************
1AXjI8-00072u-V4-H
mailnull 47 12
<[email protected]>
1071935120 0
-helo_name unspecified.host
-host_address 200.63.143.103.1079
-interface_address 205.60.34.18.25
-received_protocol smtp
-body_linecount 17
-frozen 1071959651
-host_lookup_failed
YY [email protected]
YY [email protected]
YY [email protected]
YN [email protected]
NN [email protected]
YN [email protected]
NN [email protected]
YN [email protected]
NN [email protected]
YY [email protected]
YY [email protected]
NY [email protected]
NN [email protected]
NN [email protected]
YY [email protected]
YN [email protected]
NN [email protected]
YY [email protected]
NN [email protected]
NN [email protected]
49
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]il.com
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

158P Received: from [200.63.143.103] (helo=unspecified.host)
by server.myhost.net with smtp (Exim 4.24)
id 1AXjI8-00072u-V4; Sat, 20 Dec 2003 09:45:21 -0600
127P Received: from 67.65.59.224 ([67.65.59.224]) by 200.63.143.13 (WinRoute Pro 4.1.27) with SMTP; Fri, 19 Dec 2003 20:16:49 -0300
035F From: "Christy " <[email protected]>
062T To: "[email protected]" <[email protected]>
034 Subject: Someone wants to go out.
018 MIME-Version: 1.0
024 Content-Type: text/html
054I Message-Id: <[email protected]>
038 Date: Sat, 20 Dec 2003 09:45:21 -0600

**************************

 

[DARKMAN]

Hi, I'm also having this problem.

Does someone know how can I trace the mail in queue? What user sent it?

 

[RandyO]

Most likely a cgi script, there is plenty of info about it on the boards. It self replicates and can usually be found as a counter.cgi file or it will have counter####.cgi they try to hide it as a legit counter.cgi file