Email - Spamer sending mail from my site?
I recieved an email from Luxury@debian1.the-computerguy.biz That is my server but this email account is not on my system. The mail came to an email account on one of my other sites. Did I miss something in my setup so others are useing my email services? How can I stop this?
It also seems that most of my spam and people giving post the links point to .ru sites. Is there any way to just block all the sites from another country like .ru?
Did you check the email header to see if the maill really originated from your server?
Did you check if your server is blacklisted? http://www.mxtoolbox.com/blacklists.aspx
It is possible that spammers abuse a vulnerable web application, so I'd make sure these are all up to date.
This link might also be of interest: http://www.howtoforge.com/how-to-log...tect-form-spam
It looks like my server sent it because it said debian1.the-computerguy.biz and I naver as far as i can remember used the debian1. other then during setup. I am not on the blacklist. I may need to find a way to password all email sending. I know how to secure a windows server but I am still learning the linux side of web serving.
Did you check the email headers to be sure?
Hmm, It does looked like someone faked it but I do not understand how they got the debian1. part. Here is my header. It looks like the ip was not mine.
Received: from localhost (localhost.localdomain [127.0.0.1])
by debian1.the-computerguy.biz (Postfix) with ESMTP id 57D13ADC0FA
for <email@example.com>; Sat, 26 Feb 2011 10:05:49 -0500 (EST)
X-Virus-Scanned: Debian amavisd-new at debian1.the-computerguy.biz
X-Spam-Status: Yes, score=13.623 tagged_above=1 required=4.5
tests=[HTML_MESSAGE=0.001, RDNS_NONE=0.1, URIBL_AB_SURBL=1.613,
URIBL_BLACK=1.961, URIBL_JP_SURBL=2.857, URIBL_SBL=2.468,
Received: from debian1.the-computerguy.biz ([127.0.0.1])
by localhost (debian1.the-computerguy.biz [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id pDmANK9RIaqX for <firstname.lastname@example.org>;
Sat, 26 Feb 2011 10:05:46 -0500 (EST)
Received: from [22.214.171.124] (unknown [126.96.36.199])
by debian1.the-computerguy.biz (Postfix) with ESMTP id 2C008ADC0F5
for <email@example.com>; Sat, 26 Feb 2011 10:05:46 -0500 (EST)
Received: from [188.8.131.52] (account firstname.lastname@example.org HELO nozhktfps.htofosvpfbhase.ua)
by (CommuniGate Pro SMTP 5.2.3)
with ESMTPA id 132543730 for <email@example.com>; Sat, 26 Feb 2011 20:05:44 +0500
Date: Sat, 26 Feb 2011 20:05:44 +0500
X-Mailer: The Bat! (v2.00.5) Business
X-Priority: 3 (Normal)
Message-ID: <6085981689.UDO49OFH800586@kmapjygsfe.bfblvu.org >
Subject: ***SPAM***Everything on our site is On sale this Week as we are
consolidating and must get rid of it all FAST!
Thanks for the help
|All times are GMT +2. The time now is 12:46.|
Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.