Need advice - mail server is being used to relay spam emails

• patgoh

  5 Oct 07, 20:53

  Hi all,
  
  I am running my own webhosting Manager, hosting my own sites. Using Cpanel.
  
  Recently, my mail server is being used to relay spam emails. i.e. my email a/c is being used to spam thousands of emails. So, I become the spammer.
  
  Anyone knows how to fix this problem ?
  
  I have changed the mail setting of all my email a/c of domain/subdomain to :fail: instead of :blackhole". thus prevent incoming spam emails.
  
  Now my big problem is how to prevent outgoing spam emails from my mail server.
  
  All advice greatly appreciated.
  
  Best Regards,
  patgoh
  
  
• ndmmxiaomayi

  5 Oct 07, 21:13

  If you suspect that, better check your server logs for signs of being hacked in. Look out for multiple tries to log in to a certain account.
  
  Also check your server for odd scripts.
• Jason

  5 Oct 07, 21:24

  I am not familiar with the specifics of cpanel but a quick search for 'cpanel open mail relay' threw this up:
  
  http://help.godaddy.com/article.php?article_id=1456&topic_id=211#exim
  
  To set the default mail behavior to :fail:, you will want to execute the following command through SSH:
  echo "defaultmailaction=fail" >> /var/cpanel/cpanel.config
  
  Good luck!
• patgoh

  5 Oct 07, 21:37

  Originally posted by ndmmxiaomayi:

  If you suspect that, better check your server logs for signs of being hacked in. Look out for multiple tries to log in to a certain account.
  
  Also check your server for odd scripts.

  Hi ndmmxiaomayi,
  
  Thanks for the quick reply.
  
  In fact I am seeing many hacking attempts when i see the logs. Some trying a few thousand times, using many different user ID.
  
  I had tried to check the IP address and warned some of the IP owners, so far nobody responded and also there are just too many of the hackers trying to hack my server.
  
  I have given up on this as I dont know what action to take.
  
  Best Regards,
  Patgoh
  
• ceecookie

  5 Oct 07, 21:44

  U can refer the hacking problem to the Singapore Police if the IP is local.Hacking is a crime under the Computer Misuse Act.If the IP address are foreign,u can refer to the respective country's Police.
• patgoh

  5 Oct 07, 21:45

  Originally posted by Jason:

  I am not familiar with the specifics of cpanel but a quick search for 'cpanel open mail relay' threw this up:
  
  http://help.godaddy.com/article.php?article_id=1456&topic_id=211#exim
  
  To set the default mail behavior to :fail:, you will want to execute the following command through SSH:
  echo "defaultmailaction=fail" >> /var/cpanel/cpanel.config
  
  Good luck!

  Hi Jason,
  
  Thank you very much for the link. This link is very useful.
  
  Best Regards,
  Patgoh
• patgoh

  5 Oct 07, 21:55

  Hi ceecookie,
  
  It is very hard to trace and track down the hacker. They are very smart. The IP address captured by your server log is usually hackjacked sites.(not their own)
  
  They hacked into other's website and make use of other's site to hack others.
  
  One of my sites was once being used to phishing paypal site. I was being reported and threatened with actions.
  
  Upon receiving the complaint, I checked my File Manager and found some suspicious files. So I immediately deleted them and apologised to them.
  
  
• ndmmxiaomayi

  5 Oct 07, 22:01

  Originally posted by patgoh:

  Hi ndmmxiaomayi,
  
  Thanks for the quick reply.
  
  In fact I am seeing many hacking attempts when i see the logs. Some trying a few thousand times, using many different user ID.
  
  I had tried to check the IP address and warned some of the IP owners, so far nobody responded and also there are just too many of the hackers trying to hack my server.
  
  I have given up on this as I dont know what action to take.
  
  Best Regards,
  Patgoh
  

  Hi patgoh,
  
  You can email the ISP.
  
  Do a WHOIS of of their IP address and email the relevant ISP.
  
  There will be an abuse email address, usually something like this:
  
  [email protected]
  
  I can help you contact another admin who will be able to help you if you need more help.
  
  If you are using Linux servers, a WHOIS can be done easily.
  
  whois IP address from the Command Prompt aka Terminal aka Bash.
  
  If you need more details, do a dig.
  
  dig IP address
  
  Or to get some details, try:
  
  dig -x IP address / server name
• hiphop2009

  5 Oct 07, 23:31

  oh my god jason posted here!
• yiha093

  5 Oct 07, 23:35

  Originally posted by hiphop2009:

  oh my god jason posted here!

  x2x2
• ndmmxiaomayi

  6 Oct 07, 00:43

  Originally posted by hiphop2009:

  oh my god jason posted here!

  It's not the first time he posted here already.
• ndmmxiaomayi

  6 Oct 07, 02:01

  By the way patgoh, if you have a Gmail account, look up one of the security groups and join it.
  
  Then post your question there. You will be able to get better help there as there are some security experts there.
  
  Also try join Security Focus mailing lists, there are some good help there.
• patgoh

  6 Oct 07, 11:42

  Originally posted by ndmmxiaomayi:

  By the way patgoh, if you have a Gmail account, look up one of the security groups and join it.
  
  Then post your question there. You will be able to get better help there as there are some security experts there.
  
  Also try join Security Focus mailing lists, there are some good help there.

  OK, would do so.
  
  Thanks your valuable advice.
  
  patgoh