Vesta Control Panel - Forum

Community Forum

Skip to content

Advanced search
  • Quick links
    • Main site
    • Github repo
    • Google Search
  • FAQ
  • Login
  • Register
  • Board index Main Section Mail Server
  • Search

help ip listed as spam

Questions regarding the Mail Server
Dovecot, Exim, RoundCube
Post Reply
  • Print view
Advanced search
7 posts • Page 1 of 1
RogerVer
Posts: 23
Joined: Tue Jul 29, 2014 7:07 pm

help ip listed as spam
  • Quote

Post by RogerVer » Thu Nov 12, 2015 10:18 am

Can someone tell me what i can do here ?
Top

DRS
Posts: 6
Joined: Wed Nov 11, 2015 9:54 pm

Re: help ip listed as spam
  • Quote

Post by DRS » Thu Nov 12, 2015 12:01 pm

It's not very hard.

First analyzes on how many list is your IP: http://multirbl.valli.org/lookup/

Then send an email to each list and ask to be removed from it.

Also try with: http://www.sorbs.net/ -> Delist an IP Address
Top

RogerVer
Posts: 23
Joined: Tue Jul 29, 2014 7:07 pm

Re: help ip listed as spam
  • Quote

Post by RogerVer » Thu Nov 12, 2015 12:44 pm

i am trying to figure out how to find which account is compromised on the server
the logs in /var/log are no help
Top

skurudo
VestaCP Team
Posts: 8099
Joined: Fri Dec 26, 2014 2:23 pm
Contact:
Contact skurudo
Website Facebook Google+ Skype
Twitter

Re: help ip listed as spam
  • Quote

Post by skurudo » Thu Nov 12, 2015 3:25 pm

Use mailq for see your log queue.

exim -Mvh message-id-from queue -- headers
exim -Mvb message-id-from queue -- body message

Search php script, which send all this spam mail.
It seems from php-shell.
You can use maldet for search this php-shell - https://www.rfxn.com/projects/linux-malware-detect/
Top

RogerVer
Posts: 23
Joined: Tue Jul 29, 2014 7:07 pm

Re: help ip listed as spam
  • Quote

Post by RogerVer » Fri Nov 13, 2015 2:12 am

i am in single user mode now because the hosting company has it blocked
and i did run maldet
didnt find anything
can i see usage per account somewhere ?
Top

skurudo
VestaCP Team
Posts: 8099
Joined: Fri Dec 26, 2014 2:23 pm
Contact:
Contact skurudo
Website Facebook Google+ Skype
Twitter

Re: help ip listed as spam
  • Quote

Post by skurudo » Fri Nov 13, 2015 10:56 am

RogerVer wrote:i am in single user mode now because the hosting company has it blocked
didnt find anything
can i see usage per account somewhere ?
But you have root access and can see mail queue? If so, then you can search for spam script and delete it.

Use mailq for see your mail queue.

exim -Mvh message-id-from queue -- headers
exim -Mvb message-id-from queue -- body message
Top

RogerVer
Posts: 23
Joined: Tue Jul 29, 2014 7:07 pm

Re: help ip listed as spam
  • Quote

Post by RogerVer » Sat Nov 14, 2015 4:06 am

thank you guys
i think i found the script and have deleted it
i had to mount the disk
then to go spool/exim/
and read through the files ( over 18K file s)

rebooted and watching it now
Top


Post Reply
  • Print view

7 posts • Page 1 of 1

Return to “Mail Server”



  • Board index
  • All times are UTC
  • Delete all board cookies
  • The team
Powered by phpBB® Forum Software © phpBB Limited
*Original Author: Brad Veryard
*Updated to 3.2 by MannixMD
 

 

Login  •  Register

I forgot my password