possible way to stop spammers from forging my website's domain in the "From" or "Reply To" fields? I just received 1700 bounced e-mails in my inbox from spammers using my domain in the "From" address. Really freaking annoying, and I don't want my website to get blacklisted.
View 6 RepliesI was wondering if anyone has any methods to stop spammers? Currently i am keeping watch on the mail queue and making sure nothing unsual. I have in WHM configuration setup to not allow more 200 mail messages per account per hour but for some reason it will hit thousands. WHMCS does seem to suspend them automatically or maybe its because of WHM BUT only when its too late.
Any thoughts or suggestions?
Have a persistent spammer who kept emailing my clients, even non existent domain accounts and getting the bounced emails to be send to a particular yahoo address. I tried to block in all ways but can't seem to stop him. His spams are from all over the world. Any suggestions?
View 3 Replies View RelatedI have a massive spam problem on my server, which I cannot seem to find a cure for. Here is an example of the headers from an example email (from WHM) that is stuck in the mail queue:
Quote:
1HiU0X-0006Y3-O6-Hmailnull 47 12<>1177932329 0-ident mailnull-received_protocol local-body_linecount 78-allow_unqualified_recipient-allow_unqualified_sender-frozen 1177932333-localerrorXX1vrroark@freemail.ru144P Received: from mailnull by host.zaggs.com with local (Exim 4.63)id 1HiU0X-0006Y3-O6for vrroark@freemail.ru; Mon, 30 Apr 2007 12:25:06 +0100045 X-Failed-Recipients: download@host.zaggs.com029 Auto-Submitted: auto-replied058F From: Mail Delivery System <Mailer-Daemon@host.zaggs.com>024T To: vrroark@freemail.ru059 Subject: Mail delivery failed: returning message to sender047I Message-Id: <E1HiU0X-0006Y3-O6@host.zaggs.com>038 Date: Mon, 30 Apr 2007 12:25:06 +01001HiU0X-0006Y3-O6-DThis message was created automatically by mail delivery software.A message that you sent could not be delivered to one or more of itsrecipients. This is a permanent error. The following address(es) failed: download@host.zaggs.com (generated from abraham@keysupplier.com) retry timeout exceeded------ This is a copy of the message, including all the headers. ------Return-path: <vrroark@freemail.ru>Received: from [220.157.245.77] (port=3648 helo=localhost.localdomain)by host.zaggs.com with smtp (Exim 4.63)(envelope-from <vrroark@freemail.ru>)id 1HiU0X-0006Xu-7rfor abraham@keysupplier.com; Mon, 30 Apr 2007 12:25:06 +0100Message-ID: <10fb01c78b19$683b6042$8bc8505a@freemail.ru>From: Noticeable <vrroark@freemail.ru>To: abraham@keysupplier.comSubject: I am 79 years young!Date: Mon, 30 Apr 2007 14:19:48 +0300MIME-Version: 1.0Content-Type: multipart/alternative; boundary="----=_NextPart_000_0000_9E7D5C31.01A57A34"X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express V6.00.2900.2180X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180This is a multi-part message in MIME format.------=_NextPart_000_0000_9E7D5C31.01A57A34Content-Type: text/plain; charset="iso-8859-1"Content-Transfer-Encoding: 7bit A few words about HGH LifeI have been taking HGH Life for five weeks and there is a noticeable improvementin me overall. Waking up without muscular pain is the most obvious! WhenI run out, I shall be ordering as much as my pension will allow. I am inEngland and am 79 years young!Order HGH Life online ------=_NextPart_000_0000_9E7D5C31.01A57A34Content-Type: text/html; charset="iso-8859-1"Content-Transfer-Encoding: quoted-printable<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML><HEAD><META http-equiv=3DContent-Type content=3D"text/html; =charset=3Diso-8859-1"><META content=3D"MSHTML 6.00.2900.2912" name=3D"GENERATOR"></HEAD><BODY text=3D#000000 bgColor=3D#ffffff><font size=3D"3" face=3D"Times New Roman"><p align=3D"center"><font =face=3D"Arial" color=3D"#009900" size=3D"5"><strong>A few =words about HGH Life™</strong></font></p><p align=3D"center"><font face=3D"Arial">I have been taking HGH =Life™ <strong>for five weeks </strong>and there is a noticeable =improvement in me overall. Waking up without muscular pain is the most =obvious! When I run out, I shall be ordering as much as my pension will =allow. I am in England and am <strong>79 years =young</strong>!"</font></p><p align=3D"center"><a href=3D"http://worldwdefull.com"><strong><font =face=3D"Arial" color=3D"#ff6600" size=3D"4">Order HGH Life™ =online</font></strong></a></p></font></BODY></HTML>------=_NextPart_000_0000_9E7D5C31.01A57A34--
I can confirm that the person who is doing this IS NOT using the 'nobody' user because I am keeping a spam_log for that.
How else is a user able to use our server for spam? Please help as I would like to get this sorted ASAP.
Is there any way to stop spammers from spoofing my address? I've had issues ever since I started this server with getting bounced spam where the "From:" field was (jibberish)@mydomain.com which was annoying but not that constant.
I came online this morning to check my mail and had over 1200 e-mails and all of them have "online@wellsfargo.com" as the "From:" address, but the message-ID has my domain name in it..
Quote:
------ This is a copy of the message, including all the headers. ------
Return-path: <nobody@host.mydomain.com>
Received: from nobody by host.mydomain.com with local (Exim 4.63)
(envelope-from <nobody@host.mydomain.com>)
id 1Hju9b-0002y3-TH
for lwilder1999@yahoo.com; Fri, 04 May 2007 05:32:43 -0400
To: lwilder1999@yahoo.com
Subject: Update Your Account Records
From: Wells Fargo Online <online@wellsfargo.com>
Reply-To:
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Message-Id: <E1Hju9b-0002y3-TH@host.mydomain.com>
Date: Fri, 04 May 2007 05:32:43 -0400
There's gotta be some way (make that 1204.. just got 4 more bounces) to block spammers from doing this. Could someone help a newbie out?
I've been getting a lot of "Undeliverable" emails sent to my email address. On these messages, the spammer is using my email on the "From" part of the email...... So whenever he sends out spam, the person(s) getting spammed think it's from me..... And the thousands of Undeliverable email error messages are also sent to me.
Is there a way to stop this from Happening? ....... Besides changing my email address?
I am having this problem my mail server does not work i am having this message: 500 Bloody Amateur! Proper forging of mail requires recognizable SMTP commands!
View 2 Replies View RelatedI am having difficulty sending data from completed form by email.
I have modified a Html_quickform from PHP Anthology which works fine on the server.
I also included & Instantiated phpmailer to send the recipient.all the info set out in the form when submitted.
The email also works fine,I receive the email ok.
However none of the completed fields show up in the body of the email message except for one field only,that is 'body' but not the completed field or 'when' or any multiple fields submitted.
I'e tried deleteing $form->getSubmitValue('body') from the Form
and sending $form->getSubmitValue('when');only
The 'when' field shows up in the email message.
It's either one or the other but not both together.
Do I need to set up an Array to collect all fields in a single $data variable?
// Add the body of the message
$mail->Body = $form->getSubmitValue('body');
$mail->Body = $form->getSubmitValue('when');
I have problem with my windows plesk when i login show me a page to fill administrator detail but when i complete it this error appear .
Error: Unable to update administrator information:
Some fields are empty or contain an improper value. ('login' = '')
I'm setting up a server that has both Plesk 11.5 and SmarterMail 11.6 on it. I'm trying to get Plesk set to use the SmarterMail, and it sees it fine in the Server Components, but when I try to set it as the default and put in the password information it comes back and says: Error: Some fields are empty or contain an improper value.
I thought maybe it didn't like some of the characters I had in the password, and tried simplifying that but it didn't work. So I'm wondering if it is just because Plesk 11.5 won't work with SmarterMail 11.6 yet?
Problem after upgrading to 12
Error: Unable to update administrator information:Some fields are empty or contain an improper value.
('login' = '')
I have a mail server and MTA is exim.I have 20 email ids and one email "wdreport@mydomain.com" when i sent mail through this id, client and other users receive blank reply what is the problem.
Is this email server problem or not.
Virpus - what hppd no reply to cancellation ?
806581 - Ticket id for reference
My friend wanted to move from virpus as he was having some issues, he mentioned all his reasons in the ticket and asked for the refund amount which was already existent in the virpus account, which he had paid them much earlier.
There was no reply to his ticket even after 2 days ..
So, he asked me to send an pm to Ken, haven't got reply from Ken either.
Recently, the sales dpt, replies haven't been up to the mark at virpus , their tech support still sounds good though,
Never expected this longer delay virpus - Ken, its almost 4 days since the ticket has been created and submitted to you,
sorry for creating a ticket, but u have left no other choice, as I neither got reply from mr.Ken in the past 2 days nor there was a reply to the support ticket.
i have dedicate server and i have my all sites in xhtml/wml and i have all mobile users so i had 10 mbps uplink server before 4 days but after upgrade it 10 mbps to 100 mbps my all philippines users get error "NO GETWAY REPLY" or "No response "when they trying to open my sites so what is problem ?is it this problem in my server or their network ?they call their provider smart and provider tech said its not their fault but other countries user have no problem
View 2 Replies View RelatedI'm having some problems with my script, i think its not really a script error...
- Script connects to rapidshare to send a file to the user
- Rapidshare allows unlimited parallel connections, so no problem
- Though some of the time (not alot), i get a connection error.
- Connection error is: Empty reply from server
- Strange thing is, i get this when i do a curl connection to rapidshare
- ping, telnet, fsockopen, all is working, but it seems that i don't get a reply from the server
Well, is this a problem on my side or on the rapidshare servers?
Also, is there a problem to fix this?
Server is using:
- curl 7.15.5
- php 5.21
- apache 2.2.3
there's no firewall setup on my site..., also i can't find anything in iptables,...
I'm a customer of crissic and now their server is down for about 40hours.
And Skylar is not responding again.
Anyone else having my problem?
What should I do?
Can anyone from LSN help me and restart his server? This time is much worse than Cpanel license being expired. At least at that time websites worked...
We are using Apache 2.2 prefork on Debian GNU/Linux.
Sometimes it happen to us that we have really lot of apache processes (slots) in state "sending reply". This is not freed for several hours. Server status looks like:
The question is how it is possible that some apache process can be locked to one client for several hours. Other clients are being served by free slots, however what if we will have used all the slots and not freed them?
I have a domain name for example test.com, and have subdomains for it 1.test.com and mail.test.com
main domain working fine but both of subdomains not working in webbrowser they just reply ping requests
ping 1.test.com.
it's output of /etc/init.d/named status
number of zones: 12
debug level: 0
xfers running: 0
xfers deferred: 0
soa queries in progress: 0
query logging is OFF
server is up and running
O.S: CentOS release 4.4 (Final)
DNS: bind-9.2.4-16.EL4
Apache: httpd-2.0.52-28.ent.centos4
CPanel: None
Please note that is all is working fine over a 3 year just stopping today
I have had an account with a small UK hosting site. Now about two days ago I submitted a ticket to them here we are and no reply yet, I even emailed the admin, yet to no reply.
View 14 Replies View RelatedHow can I force sendmail to ignore it when a user sets the From: and Reply-to: headers for an email, such as a PHP script? I would like to force it so it always uses whatever email I set.
I cannot seem to find how to do this... sendmail config is quite difficult.
I've fire off several email to sales asking about coloing a single server and got no reply whatsoever. are these two providers too big now to talk to a small fish?
View 10 Replies View RelatedAll time in cron on my servers I using:
cp --reply=yes /dev/null /dir/logfile
but on my new server this don`t working and error is:
cp: the --reply option is deprecated; use -i or -f instead
I have opened an emergency ticket with Midphase/10TB since Dec 23 and until now, no response from support even the ticket was assigned.
The issue is regarding customer privacy which Midphase/10TB leak my direct contract information ( name, address, cellphone..) to 3rd party.
I know it is holidays, but 4 days without reply is very bad.
Anyone have experience the same issue(no reply)?
i have already canceled my plan with zone.net more than 1 month ago and no longer use their service, but they are still charging my credit card. i tried emailing them several times and did not get a reply. dishonest webhost i would say, i tried to resolve it, but they refuse to reply to emails so theres nothing i could do other than reverse the charge.
View 10 Replies View Relatedwhen somebody send email to hisname@hisdomain.com I'm getting that email in my mailbox (administrator email in Plesk settings).There is no CC or BCC in email recipient.I've tried to turn off the auto-reply and I'm not getting any emails.
View 10 Replies View RelatedI have set up a vacation filter in Horde, but only in once in a while it really returns a vacation message, depending on who is sending an email. In most cases,the message arrives without triggering a response.The messagelog shows two scenarios, one for an successful vacation response and one for emails that fail to trigger a response.Sucessful event:
Oct 9 10:48:24 server dovecot: service=lda, user=xyz@mydomain.com, ip=[]. sieve: msgid=<408-EAS2941777BF41EEBE6640B691D3A00@axy.gbl>: sent vacation response to <guntherk@hotmail.com>
and then
Oct 9 10:48:24 server qmail: 1412844504.308454 starting delivery 21782: msg 33566019 to remote abc@externaldomain.com
then the message is stored into the users inbox.
Unsuccessful event:
Oct 9 10:55:39 server dovecot: service=lda, user=xyz@mydomain.com, ip=[]. sieve: msgid=<trinity-90b5e87d-183b-49b8-8e3e-d2f98b96df3e-1412844932925@uvw-com>: discarded vacation reply to <>
then the message is stored into the users inbox.
The actual version of Plesk (v12.0.18) on Centos 6.5 with Dovecot & Qmail is beeing used.
Any thoughts, or opinions are welcome. Looking for options on how to stop this.
Recently I've started receiving spam that appears to originate from a hosted domain on my VPS. It appears to only be an issue with this website account and not the VPS generally.
I've disabled the IMAP service to ensure the spam was not being sent from the server. The spam continues which leaves the POP email accounts as a possibility or something else.
My hosting provider says it looks like email spoofing.
Someone seems to be using the address at foobar.com to send out spam. The method that he has employed is called email spoofing. Email spoofing is the practice of changing your name in email so that it looks like the email came from somewhere or someone else. However, you need not be concerned.
Individuals, who are sending "junk" email or "SPAM", typically want the email to appear to be from an email address that may not exist. This way the email cannot be traced back to the originator. The spammer is not using our server to send out spam, hence your email address will never be blacklisted.
There is really no way to prevent receiving a spoofed email. Remember that although your email address may have been spoofed this does not mean that the spoofer has gained access to your mailbox.
The following are headers of two spam emails. Both of these addresses are setup as forwarders and not actual email accounts. The spam came to our attention because it is being sent to addresses on foobar.com with headers as also originating from foobar.com
I changed the actual names for privacy
host.vpsdomain.com [123.123.123.123] - VPS domain
foobar.com - website account on VPS
myemailaccount@gmail.com - address foobar forwarders send to
Delivered-To: myemailaccount@gmail.com .....
It looks like someone spammng from our server. I have checked exim_mainlog and got the this info.
2007-01-23 03:12:32 1H99Fz-0004wl-RV => erio@erio.com R=lookuphost T=remote_smtp H=mail.erio.com [217.220.27.241]
2007-01-23 03:12:40 1H99Fz-0004wl-RV => brown2525@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> beth46@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> dstanfie@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> harris3943@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> yumyyelow@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> gloverlm@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> debilu@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mosleyclan4@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> 61369@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> melabong@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> k_mcmull@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> anniern@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> bannaj1@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> lizzied@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> gillumd@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> pfeiferk36@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mommyof2@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> tongem@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> whitsonswrecker@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mmal63@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> goosynina1@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> malenat@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> jlhk@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> tawndawn@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> usnssn@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> crazybutcute0304@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> thomas0421@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> mercibw@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> crouch1966@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> pj16@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> alba93@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> sassyd69@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> bettysue57@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> jimfiscus@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> nvonalme@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> breweragency@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
2007-01-23 03:12:40 1H99Fz-0004wl-RV -> annaksimpson@bellsouth.net R=lookuphost T=remote_smtp H=mx00.mail.bellsouth.net [205.152.58.32]
In the log file is showing like this.
2007-01-22 19:11:24 1H99Fz-0004wm-Vp <= <> R=1H99Fz-0004wl-RV U=mailnull P=local S=605030
2007-01-22 19:11:24 1H99Fz-0004wl-RV <= stlawson100@yahoo.com.hk U=churchre P=local S=3558 id=23894.217.194.149.171.1169511083....el@65.xx.xx.xx
I couldn't find who is sending.