Hi, today i was banned from hotmail aparently someone enter our server to one account of one client and sent spam all over the net...
platinumservermanagement already told us the name of the account used and we change the password,
can you please tell me where can i check the out mail logs (am using centos & exim) to see if anyone else is sending out spam? or the number of emails sent?
I use cpanel.
Is there any way to disallow connections to SEND mail FROM my server to specific IPs? (Similarly to how you can limit connections to sshd from certain IPs)
I realize I cannot disable everything completely, as yahoo and the likes will have to connect to deliver mail. But no one of any use is going to try and connect to send mail, but a spammer.
No one has gotten in and abused it as of yet (knock on wood), but SMTP is being restarted at random and I can only imagine that this is being caused by one of these scumbags probably ddos'ing me. It takes eons to browse these logs, even if they restart via logrotate periodically!
I have often seen the entry mailnull in the mail logs of exim.
I don't understand it. What is meant by mailnull? where can i get information about it?
We have been having some problems with one of our mail servers lately. Server is running Smarter Mail 4.x with declude.
Some spammers have been targeting this particular to send spam through this server. This putting lot of load on the server because declude is processing the SPOOL in Smarter Mail and spool goes upto 2000-20000 during the day. We have been checking the headers and blocking the IP's continuously of these spam but these people are using dynamic ip's. And it doesn't seem like single spammer. Content is quite different.
Blocking full ranges of certain IP Range helps though but then lot of legitimate mail is getting blocked as well.
Is there any good suggestion or a serious mail server admin who can have a look and actually sort it.
This is causing serious delays on our mail delivery through this mail server.
A spammer (probably www.powerball.com) is sending spams using one of my email addresses as his / her "from" address. This hanged my mail server last week and it took more than 60 hours to solve the problem.
My host replied me the problem was "You have over 100,000 emails in your mail queue due to a large amount of Frozen emails that were either deferred by the remote servers or sent to invalid addresses repeatedly".
From this morning, my emails are blocked again. I can't send / receive mails using any of my email accounts (from this server). I don't know how long this will take again to solve the situation, and I'm afraid that this may not be the last time.
Now I don't know what to do. Ideally, a logical solution could be to delete any bounced mail automatically (I'm using nutsmail + squirrel mail).
- exim_mainlog starts at 03/18/2007 (not aware of any rotating log crons)
- grep info@someexternaldomain.com /var/log/exim_mainlog is empty, even after sending to that email from localdomain.com today, a few times
- localdomain.com is found fine in localdomains, trueuserdomains
- localdomain.com sent just fine to another local domain on server plus gmail account. Delivery receipt to both domains plus the info@someexternaldomain.com were "succesful"
I've received from info@someexternaldomain.com many times back and forth without issues, yet today nothing shows up in exim_mainlog NOR any other logs inside /var/log
I getting this error when our clients are sending mail from outlook but they are able to send mail from webmail.
we are using exim mail server and whm . i can't understand where is problem , anybody can help me ?
Sending' reported error (0x800CCC6A) : 'Your
outgoing (SMTP) e-mail server has reported an internal error. If you
continue to receive this message, contact your server administrator or
Internet service provider (ISP). The server responded: 451 Please try again
later.
We are getting critical warning of disk space as a result of our exim logs, specifically exim_mainlog and exim_rejectlog.
What is the proper ssh command to delete or minimize these?
I am not that familiar with the correct commands. Both files are located /var/log/
I have problem with exim in my dedicated. All days I have more tham 1000 messages in queue. I delete frozen messages and run exim -v -q and after delete all message. Next day I have more that 1000 message in queue.
I see that some local emails was not delivered. So I saw in exim log errors messages as:
===
Message 1K5SHE-0001LE-LS is not frozen
delivering 1K5SHE-0001LE-LS
LOG: MAIN
== dadinho@xx.org R=virtual_user T=virtual_userdelivery defer (13): Permission denied: while opening or reading /home/levarte/mail/xx.org/dadinho/maildirsize
===
But I have not any file called "/home/levarte/mail/xx.org/dadinho/maildirsize"
What means this error message?
Is there a way to track outgoing mail that's sent from a Linux server? I'm running on Fedora 8 now, and would like to confirm and check mail that's being sent out by a PHP application.
View 4 Replies View RelatedI received abuse, and I would like to know if there is a good method to check for clients who are sending out spam mail, so I can take action.
If you know any methods that would work to find clients who are sending out spam mail,
Today my server started to go off-line and each time i restarted it went down within couple minutes. So i looked into it and found that i had over 7000 emails in Exim Mail Queue. All of them are spam. I deleted them through WHM and now everything seems good again but....
My question is how can i check what caused this problem? Has one of my domains been compromised with and sending out spam? What can i do?
Whenever I send mail, it never gets sent and I get the following error under "View Mail Statistics" in WHM:
1 xxx@aol.com R=fail_remote_domains: unrouteable
mail domain "aol.com"
I have only recently noticed these errors, as my mail was working before.
Just started to have problems sending emails out but no problem receiving.
Seems to be a exim problem.. tried updating it but the problem still exist but everytime I restart exim then it works for a few hours before the problem comes back.