help ip listed as spam
help ip listed as spam
Can someone tell me what i can do here ?
Re: help ip listed as spam
It's not very hard.
First analyzes on how many list is your IP: http://multirbl.valli.org/lookup/
Then send an email to each list and ask to be removed from it.
Also try with: http://www.sorbs.net/ -> Delist an IP Address
First analyzes on how many list is your IP: http://multirbl.valli.org/lookup/
Then send an email to each list and ask to be removed from it.
Also try with: http://www.sorbs.net/ -> Delist an IP Address
Re: help ip listed as spam
i am trying to figure out how to find which account is compromised on the server
the logs in /var/log are no help
the logs in /var/log are no help
Re: help ip listed as spam
Use mailq for see your log queue.
exim -Mvh message-id-from queue -- headers
exim -Mvb message-id-from queue -- body message
Search php script, which send all this spam mail.
It seems from php-shell.
You can use maldet for search this php-shell - https://www.rfxn.com/projects/linux-malware-detect/
exim -Mvh message-id-from queue -- headers
exim -Mvb message-id-from queue -- body message
Search php script, which send all this spam mail.
It seems from php-shell.
You can use maldet for search this php-shell - https://www.rfxn.com/projects/linux-malware-detect/
Re: help ip listed as spam
i am in single user mode now because the hosting company has it blocked
and i did run maldet
didnt find anything
can i see usage per account somewhere ?
and i did run maldet
didnt find anything
can i see usage per account somewhere ?
Re: help ip listed as spam
But you have root access and can see mail queue? If so, then you can search for spam script and delete it.RogerVer wrote:i am in single user mode now because the hosting company has it blocked
didnt find anything
can i see usage per account somewhere ?
Use mailq for see your mail queue.
exim -Mvh message-id-from queue -- headers
exim -Mvb message-id-from queue -- body message
Re: help ip listed as spam
thank you guys
i think i found the script and have deleted it
i had to mount the disk
then to go spool/exim/
and read through the files ( over 18K file s)
rebooted and watching it now
i think i found the script and have deleted it
i had to mount the disk
then to go spool/exim/
and read through the files ( over 18K file s)
rebooted and watching it now