How To Monitor Spammer Sactivity

May 26, 2007

I just setup my own LAMP server.

It is only used for my own domains so I want to be able to watch all mail that gets sent from my server, via php or otherwise.

Basically I just want to be able to personally monitor what mail is getting sent from my server so that I can watch for possible spammer activity.

I am using postfix and webmin.. I have sendmail installed to, but I don't think it is getting used..

I guess theres got to be a log somwhere... but I am not sure where it is?

I have postfix set to CC me of all mail that gets sent but, it doesnt seem to work all the time.. just for certain things..

View 3 Replies


ADVERTISEMENT

My Server Seems To Be A Spammer

Apr 29, 2009

I have recently been receiving reports from AOL's feedback loop that my server is sending out spam. I have checked the whole server, but cannot find anything strange.

There are some strange things with these feedback reports. I'll post a few lines below (i crossed out my domain with xxx):

Quote:

Received: from andersenreesel by holderem.xxx.biz with local (Exim 4.23)

Received: (qmail 64859 invoked by uid 24901)

Received: from janislanhami by xxx.biz with local (Exim 4.26)

Received: (qmail 43829 invoked by uid 147); 08 Apr 2009 21:22:39 -0000

Received: from raphaelpinkertone by standei.xxx.biz with local (Exim 4.23)

Received: from imanoldelphine by dispatched.xxx.biz with local (Exim 4.23)

Received: from conrado by hostic.xxx.biz with local (Exim 4.23)

The first issue i have is with the subdomains, like "dispatched", "standei", "hostic", etc. These subdomains do not exist on my system. Also, my server does not run the exim MTA.

Another issue i have is the "invoked by uid" statements with uid's 147 and 24901. These UID's do not exist on my system. The passwd file uid's go to around 110.

Apart from these strange things, the IP that is listed in the upper part of the headers:

Quote:

Received: from xxx.biz (xxx.biz [85.xxx.xxx.xxx])

The domain and IP address is correct there, which should indicate that the spam was sent from my system. Or wasn't it?

View 11 Replies View Related

IIS SMTP Spammer

May 10, 2009

to stop the IIS SMTP Spammers how you find the culprit spammers site I tried the smtp monitor but not avail.

View 10 Replies View Related

Chinese Spammer ...

Jun 24, 2008

I host a vBulletin forum on a US server. I've been getting a lot of signups from one particular spammer, wanting to post about gold harvesting for WoW. I've blocked his IP's, however he keeps using proxies.

He constantly signs up under the name "Array"... Is there a way I can block him for good? I can't moderate user sign-ups, as I'm mostly away from my computer and can't moderate them all the time.

View 1 Replies View Related

How To Catch This Spammer

May 16, 2007

None of domain in this email is hosted with us but there are thousand of emails day some body blast in our queue. We are failed to detect. We have enabled phpnobody spam logging but failed to get track of this user.

how to catch this spammer. There are no clues of to catch him.

[root@sm4 ~]# /root/qmHandle -m3261696

--------------
MESSAGE NUMBER 3261696
--------------
Received: (qmail 7056 invoked from network); 16 May 2007 05:34:18 -0500
Received: from axicom.net (HELO User) (67.112.176.250)
by 14.32.5446.static.theplanet.com with SMTP; 16 May 2007 05:34:18 -0500
Reply-To: <notice@boamilitary.com>
From: "Bank of America Military Bank"<notice@boamilitary.com>
Subject: Notification from Bank of America Military Bank
Date: Wed, 16 May 2007 04:44:51 -0700
MIME-Version: 1.0
Content-Type: text/html;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 1
X-MSMail-Priority: High
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

<title>Military Bank Online and Bill Payer Deactivation</title>
<FONT face=Arial size=2> </FONT>
<DIV>
<p><font face="Arial" size="2" color="#FFFFFF"> ...<img border="0" src="http://power-web43.net/images/boa.bmp"></font></p>
<p><font face="Arial" size="2">&nbsp;&nbsp; Dear
Member,</font></p>
<DIV><font face="Arial" size="2">&nbsp;&nbsp; This is your official notification
from Bank of America Military Bank that the service(s) listed below<BR>
&nbsp;&nbsp; will be deactivated and deleted if not renewed immediately. Previous
notifications have<BR>
&nbsp;&nbsp; been sent to the Billing Contact assigned to this account. As
the Primary Contact, you<BR>
&nbsp;&nbsp; must renew the service(s) listed below or it will be deactivated
and deleted. <BR>
<BR>
<BR>
&nbsp;&nbsp; <b> <a target="_blank" href="http://moremail.epicalliance.com/america.php"><FONT color=#003399>Renew
Now</FONT></a>&nbsp;</b>your <b>Military Bank Online </b>and<b> Bill Payer </b>
services.</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2"><BR>
&nbsp;&nbsp; SERVICE: <b>Military Bank Online </b>and<b> Bill Payer</b>.<BR>
&nbsp;&nbsp; EXPIRATION: <b>May,&nbsp;18 2007</b></font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2"><BR>
&nbsp;&nbsp; Thank you for using Military Bank Online.
<br> &nbsp;&nbsp; We appreciate your business and the opportunity to serve you.</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;&nbsp;&nbsp;Bank of America Military Bank
Member Service</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2"><BR>
&nbsp;&nbsp; *****************************************************************************<BR>
&nbsp;&nbsp; IMPORTANT MEMBER SERVICE INFORMATION<BR>
&nbsp;&nbsp; *****************************************************************************</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;&nbsp; Please do not reply to this message.
For any inquiries, contact Member Service.</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;</font></DIV>
<DIV><font face="Arial" size="2">&nbsp;&nbsp; <BR>
&nbsp;&nbsp; Copyright © 2007 &nbsp;Bank of America Corporation. All rights reserved.</font></DIV>
</DIV>

None of domain in this email is hosted with us but there are thousand of emails day some body blast in our queue. We are failed to detect. We have enabled phpnobody spam logging but failed to get track of this user.

how to catch this spammer. There are no clues of to catch him.

View 10 Replies View Related

Found The Spammer

Dec 31, 2007

How can I found the spammer on our server?

one of our customer trying to send mail with a PHP file! but I cannot found this account, can you help me to found this user?

View 6 Replies View Related

Hostmonster And Bluehost Spammer

Dec 26, 2008

Hostmonster and Bluehost Spammer

What is the relationship between Hostmonster and Bluehost?

One spammer has a domain with an NS1.HOSTMONSTER.COM but their IP belongs to Bluehost.

View 7 Replies View Related

Keep Getting An Email Spammer On My Server

May 26, 2008

Now first I will say I have NO idea how such spamming works, how a punk can get on my server and sent emails out.

I have had a team to look at it they also did something, but now it happens again for the 5th time, what can i do, are there any software or tools one can use like a antivirus to check the server and how can I avoid such sh..

View 14 Replies View Related

How I Can Stop Spammer From My Server

Jul 14, 2008

How i can stop Spammer from my server?

my control panel is CPANEL !

what software i must install?

View 4 Replies View Related

Spammer On CPanel Server

Mar 31, 2008

i have the following inside: /usr/local/apache/domlogs

worldlanguage.com-smtpbytes_log
deafper4mer.org-smtpbytes_log missingchildrenblog.com-smtpbytes_log worldlpgas.com-smtpbytes_log
deathball.net-smtpbytes_log missingkids.com-smtpbytes_log worldnet.att.net-smtpbytes_log
deberrym.freeserve.co.uk-smtpbytes_log mistressj.com-smtpbytes_log worldswithoutend.com-smtpbytes_log
djchass.com-smtpbytes_log ms9.hinet.net-smtpbytes_log zollnergarmisch.de-smtpbytes_log
djessentials.com-smtpbytes_log msa.hinet.net-smtpbytes_log zomtide.com-smtpbytes_log
djgavin.com-smtpbytes_log msn.com-smtpbytes_log zoominfo.com-smtpbytes_log
djlw.com-smtpbytes_log mtaconsulting.com-smtpbytes_log ztree.com-smtpbytes_log
djphear.com-smtpbytes_log mtco.com-smtpbytes_log zuneluv.com-smtpbytes_log
dkburnap.com-smtpbytes_log mtdemocrat.com-smtpbytes_log zwergenland-sterkrade.de-smtpbytes_log
dmans.com-smtpbytes_log mtu-net.ru-smtpbytes_log zyit.com-smtpbytes_log
dmatrans.com-smtpbytes_log mulberrycorner.com-smtpbytes_log zymico.com-smtpbytes_log
dmoz.org-smtpbytes_log multexinvestornetwork.com-smtpbytes_log zytor.com-smtpbytes_log
dncinc.com-smtpbytes_log multimedia.cl-smtpbytes_log zzangbbori.com-smtpbytes_log
dnpeters.com-smtpbytes_log mundosofa.com-smtpbytes_log
doble.com-smtpbytes_log murphyspage.com-smtpbytes_log

all this domains are NOT hosted on my server (there are a lot more of this entries.)

I has ben told that this domain namens are used while spaming.

Is there any way to idetify what acocunt has ben hacked and sends spaming via pop3 or apache.

I note a lot of pop3 connections fron russian, china vietnam and high cpu load this happens.

(nobody sernder has already ben dsable il WHM tweaks)

View 0 Replies View Related

How Did This Forum Spammer (sagepowder) Do This

Jan 7, 2007

I just found posts every a few days from an apparent spammer "sagepowder" in my forum (not so popular and has nothing to do with skiing). The subject is always "new here".

The content is "Any snowboarders or skiiers on this forum? I am planning a trip to BC on a snowboarding trip next week" or "I am new here, just saying hello".

I checked the apache log and it doesn't seem to be a robot script posting this. i.e. it browses to the index page, picked up my hidden field that blocks robots, post new topic, the go back to index page.

What surprised me is that when I google this guy, I got 108,000 results with the same content on tons of forums! All with total post number of 1 or 2 on each forum:
[url]

How did he do this? How to block this?

View 7 Replies View Related

What Is This Email Spammer Trying To Accomplish

Sep 26, 2007

I recently moved web services for one of my hosted domains (let's call it example.com) from one server (let's call it .org) to another server (let's call it .net) example.com has been on .org for about 5 years. .org handled all example.com web services, and all email. I recently updated example.com's DNS record to point www.example.com and example.com to the .net server. I didn't change the MX record or mail.example.com to point to .net. Mail continues to be delivered normally to example.com on the .org server.

Except now spammers are hitting the .net server, e.g.

Sep 26 09:26:03 host postfix/smtpd[15098]: NOQUEUE: reject: RCPT from unknown[12.171.150.130]: 554 5.7.1 <AutumnvagaryMontano@example.com>: Relay access denied; from=<> to=AutumnvagaryMontano@example.com proto=SMTP helo=<mdgen-print.marylandgeneral.org>

Is it normal practice for spammers to send dictionary attack based spam to a domain's server that doesn't even handle email? All the spam coming is clearly just random email addresses not based on anything that exsists at the domain, and most of the addresses are so very random I can't imagine they exsist anywhere.

View 1 Replies View Related

Anyone Else Seeing WordPress Spammer DDOS

Jan 5, 2007

For about a month or so now I have a domain I host under serious attack from what I think are spammers. It's a wordpress site, and they are getting big numbers of POST requests to the WordPress comments file, e.g.

Code:

POST /wp-comments-post.php HTTP/1.1
It's a well distributed attack, and I'm doing well with some scripts I wrote to block the requests to the wp-comments-post.php file. The real comment file has long since been moved, so any POST to the file gets firewalled. It's several thousand IPs from all over the place.

I don't believe it's a malicious attempt to bring the site down, but I'm guessing it's a blog comment spammer that has something set wrong and he's pounding this site to death by accident. I could be wrong on that though.

Anyone have any good defense scripts to share?

View 7 Replies View Related

How We Can STOPED FOREVER To This Spammer

May 14, 2007

in our case, HACKER no DELETE files...

He send Spam by POST to file.php

We have APACHE_suexec + PHP in SAFE_MODE=true;

Server is down 3 times in < of 24 hours by this motive.
In this moment We have more of 20.000 mails to send to Bellsouth and Yahoo...

We know this becouse we run

exim -bpr | exiqsumm -c | head

Count Volume Oldest Newest Domain
----- ------ ------ ------ ------
26797 66MB 7h 5m yahoo.com
3260 615KB 3h 3h bellsouth.net
1253 540KB 9h 2h webtv.net
1134 329KB 3h 2h excite.com
926 261KB 5h 3h optonline.net
226 258KB 3h 3h sbcglobal.net
----------------------------------------------

Wath we can do?

How we can stoped this mails?

How we can STOPED FOREVER to this spammer?

View 2 Replies View Related

Plesk 12.x / Windows :: MailEnable Locate Spammer

Nov 5, 2014

My System is a Windows Server 2012 r2 with Plesk 12.

On this system i have installed MailEnable as my Mailserver.

So at the moment something is spam on this server, but i can't find out who is it.

Received: from win02.XXXXXX([MY IP] helo=WIN02.home)
(envelope-from <root@XXXXXXXX>)
id 1XlyHP-00038b-R0
for x; Wed, 05 Nov 2014 11:57:37 +0100

[Code].....

The header is meaning that the spams come from root@, but there is no account with the name root@...

On linux it is so easy to find the spam with qmail or postfix. Why mailenable it is so difficult

View 3 Replies View Related

Plesk 12.x / Linux :: Disable Php Mail For Spammer Clients?

Dec 9, 2014

Sometimes my clients install untrusted scripts to their account what causes spamming, because these scripts sending high number of spam emails. Is there an automatically way to disable php mail function, or disable the account temporary?

[URL]

View 3 Replies View Related

Hundreds Of "Mail Delivery Failed" Thanks To Spammer

Sep 22, 2007

Someone f'in spammer has used my legitimate email address as the from address for their spam emails. Now I am getting hundreds of

"Mail delivery failed: returning message to sender" in my inbox.

I use cpanel to host the domain/email, is there anything I can do?

View 2 Replies View Related

What Do You Monitor

May 28, 2009

if you use a site monitoring service (or two) do you need to setup monitors for each website/domain on your VPS or can you just monitor the primary services on the VPS?

Pluses/Minuses for either way?

View 3 Replies View Related

Monitor Bandwidth

Oct 7, 2009

I have a windows vps and I want to monitor my bandwidth. How can I do this? I tried using a program called DU Meter but it's counting bandwidth on all users on that node and not mine =[

View 6 Replies View Related

How To Monitor Ram Usage

Feb 26, 2009

Can you recommend a method to check ram usage of my vps for the last 24 hrs?

View 7 Replies View Related

Monitor Application

Jan 7, 2009

I want to monitor my application to make sure it is 24x7 uptime, if there is anything interrupt, I will be notified by email/SMS right away. There are several web monitoring service, but they all monitor ports, not application. I have bad experience, like, althoguh the web server is alive, but the application is already dead.

So, I want to monitor application instead of monitor a port. Anybody knows where I may find this kind of service?

View 2 Replies View Related

How To Monitor Server

Apr 26, 2009

i want to monitor my server. i try mrtg buti cant install it. so how can i monitor my server?

View 14 Replies View Related

How Do You Monitor Your XEN VPS's Bandwidth

Aug 6, 2008

I know cacti / MRTG can produce traffic graphs, but how you actually get Cacti to graph the VM's on a physical server?

View 9 Replies View Related

What Does Everyone Use To Monitor Their Servers?

Mar 4, 2008

What does everyone use to monitor their servers? I've come across a pretty impressive service from Panopta but haven't head of them before. Has anyone tried them out?

View 11 Replies View Related

Monitor Traffic

Jun 30, 2008

I want to be able to monitor (with statistic) and cap traffic on 3+ servers.

how is this done best?

I was thinking of somekind of switch or server set inbetween the servers and the internet monitoring and keeping data on the traffic use etc.

but what do you do?

and how to make such a monitor redundant so if it fails the network is not cut off from the world?

View 12 Replies View Related

Bandwidth Monitor

Jul 10, 2007

Does any one know a bandwidth monitor that shows me stats and which programs or Ports and or Servers are using bandwidth and how much they are using in real time?

View 11 Replies View Related

Uptime Monitor

Dec 2, 2007

I see a lot of web hosts that link to webhostingstuff.com which tracks the uptime of their main page. i would like to offer a similar service, where i track and list the uptime of hosts. can anyone point me in the proper direction for this? is there a particular script that I can purchase? how is this done?

View 9 Replies View Related

Monitor Traffic

Apr 2, 2007

Don't know if this is the right place to ask for this but here goes.

I have a 20U rack space and i use 4U of this space (1U + 2U servers and a 1U switch).

There is a 20Mbit internet connection on a 100Mbit network.

But here comes my problem, some friends have there servers in my rack space to, There is 12 servers that are my friends and i want to know how much traffic they use.

I want to know how many GB traffic they use to i can charge them (they don't pay right now).

2 of my friends servers must max take 50gb traffic!

Is there a switch that can do theys two things?

Show traffic and limit traffic?

View 7 Replies View Related

Hardware Monitor

Aug 25, 2007

My server has a tyan thunder 8kse (s2892) motherboard, and i'm looking for some script to monitor it. Unfortunately, tyan only offers such applications for windows. So, how can i monitor the motherboard in linux? Or preferably, webbased.

View 1 Replies View Related

Domain Name Server (DNS) Monitor

Jul 24, 2008

What VPS should I need for backup dns bind and nagios for monitoring (ram, bandwidth etc..) ?

And from where should I choose?

View 5 Replies View Related

How Do You Monitor Your Ranges For Blacklisted IPS

Oct 4, 2009

We have a few customers who have multiple C classes with us and we are wondering how most of you monitor for blacklisting.

We currently randomly pick a few IPS and check them once a month but this is not very thorough. We were wondering if there is a program out there that can check say a /20 automatically once a month or atleast something we can initiate an automated check once a month with?

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved