Need advice - mail server is being used to relay spam emails

patgoh SG

Hi all,

I am running my own webhosting Manager, hosting my own sites. Using Cpanel.

Recently, my mail server is being used to relay spam emails. i.e. my email a/c is being used to spam thousands of emails. So, I become the spammer.

Anyone knows how to fix this problem ?

I have changed the mail setting of all my email a/c of domain/subdomain to :fail: instead of :blackhole". thus prevent incoming spam emails.

Now my big problem is how to prevent outgoing spam emails from my mail server.

All advice greatly appreciated.

Best Regards,
patgoh Smile

ndmmxiaomayi SG

If you suspect that, better check your server logs for signs of being hacked in. Look out for multiple tries to log in to a certain account.

Also check your server for odd scripts.

Jason SG

I am not familiar with the specifics of cpanel but a quick search for 'cpanel open mail relay' threw this up:

http://help.godaddy.com/article.php?article_id=1456&topic_id=211#exim

To set the default mail behavior to :fail:, you will want to execute the following command through SSH:
echo "defaultmailaction=fail" >> /var/cpanel/cpanel.config

Good luck!

patgoh SG

Hi ndmmxiaomayi,

Thanks for the quick reply.

In fact I am seeing many hacking attempts when i see the logs. Some trying a few thousand times, using many different user ID.

I had tried to check the IP address and warned some of the IP owners, so far nobody responded and also there are just too many of the hackers trying to hack my server.

I have given up on this as I dont know what action to take.

Best Regards,
Patgoh

ceecookie SG

U can refer the hacking problem to the Singapore Police if the IP is local.Hacking is a crime under the Computer Misuse Act.If the IP address are foreign,u can refer to the respective country’s Police.

patgoh SG

Hi Jason,

Thank you very much for the link. This link is very useful.

Best Regards,
Patgoh

patgoh SG

Hi ceecookie,

It is very hard to trace and track down the hacker. They are very smart. The IP address captured by your server log is usually hackjacked sites.(not their own)

They hacked into other's website and make use of other's site to hack others.

One of my sites was once being used to phishing paypal site. I was being reported and threatened with actions.

Upon receiving the complaint, I checked my File Manager and found some suspicious files. So I immediately deleted them and apologised to them.

ndmmxiaomayi SG

Hi patgoh,

You can email the ISP.

Do a WHOIS of of their IP address and email the relevant ISP.

There will be an abuse email address, usually something like this:

[email protected]

I can help you contact another admin who will be able to help you if you need more help.

If you are using Linux servers, a WHOIS can be done easily.

whois IP address from the Command Prompt aka Terminal aka Bash.

If you need more details, do a dig.

dig IP address

Or to get some details, try:

dig -x IP address / server name

hiphop2009 SG

oh my god jason posted here!

yiha093 SG

x2x2 Shocked

ndmmxiaomayi SG

It's not the first time he posted here already. Laughing

ndmmxiaomayi SG

By the way patgoh, if you have a Gmail account, look up one of the security groups and join it.

Then post your question there. You will be able to get better help there as there are some security experts there.

Also try join Security Focus mailing lists, there are some good help there.

patgoh SG

OK, would do so.

Thanks your valuable advice.

patgoh