Qmail Abuse - Server Log

Nov 20, 2006

I'm a web programmer with little knowledge of server maintenace, tasks, configurations, etc.

I run a website hosted a dedicated box with godaddy. It appears my MAX SMTP limit (25,000) is reached at times. I know for a fact my subscribers are not generating this many emails.

1) Is there a way I can see a log file all of the email messages that were sent using my SMTP qmail account?

2) I've entertained the possibility that someone has "hijacked" my qmail account and is using it send out spam messages?

Any help in being able to get to a log for qmail or to run some other kind of diagnosis to figure out what's exactly going on with my server and why my max smtp limit is reached constantly.

View 3 Replies


ADVERTISEMENT

Install QMAIL Mail Server With Qmail Admin And All..

Aug 24, 2007

i have a fedora core 4 server.. and i want to install a good Qmail email server to host some emails of diferent domains..

On searching i found that Qmail should be install with those associated programs/system for a better server :

Qmail itself
EZmlm and EZmlm-idx
Autoresponder
Vpopmail
VQadmin
maildrop
QmailAdmin
Courier-imap/imaps with Courierpassd
Squirrelmail web mail program ......

View 7 Replies View Related

How To Stop Mail-server Abuse

Mar 30, 2009

in the last 2 weeks has increased the spam mail to external users using our mail accounts.

So a user receives spam believing that it is sent from our sites.

I think the best method is to create a txt file in dns but I have many doubts about how to proceed.

Looking at one of the e-mail back to our mail server I see that emails are sent via outlook.

This is an example of the emails: ...

View 7 Replies View Related

My Server Marked As Abuse: Spam

Feb 7, 2007

I have a client on my server from ThePlanet. That client sends a newsletter once a week to about 50,000 recipients with a program that i built. The list was purchased from a company that sells targeted directory listings.

Each email has a very clear opt out link, and one click takes them off the list. There is also a direct link to the contact form, as well as the information of the company sending the mass emails (me). This should satisfy all regulatory requirements to comply with existing laws.

Now, these emails have been sent once a week for about a month now. Today, ThePlanet issued a support ticket entitled "Abuse: Spam Source". It seems that there was a problem from aol, and one of the emails was redacted.

Reading through ThePlanet terms of service, it seems that they only allow closed system mass mailings. So now I am faced with a problem, because I have a client who expects to send out emails next week with a system i built, and I have a hosting provider that is demanding some sort of "proof" that these emails are solicited.

For the record, this newsletter isn't junk spam like selling viagra or pumping a stock. It is a free weekly summary of significant new york appellate cases, and it has been very well received by the attorneys on the mailing list. There have been ridiculously few opt outs ( < 2%), and there have been literally *hundreds* of emails coming back to show their gratitude for the free service. Not even one comment has been negative.

So what can I do now? A significant number of attorneys on this list are expecting the newsletter, but it cant be sent due to this problem.

The best that I could come up with so far is to send an "Opt in" mass email, where users must click the link to opt in, and everyone else would be removed from the mass email. I could then use the unique keys used for opt ins as "proof" for ThePlanet that the emails are solicited.

View 5 Replies View Related

Server Abuse At Limestonenetwork And Data Restore

Apr 16, 2009

We have server in limestonenetwork for couple months, everything good until several abuse issues to our IP for several times recently. Based on instruction from Ryan A., Abuse Department Manager, I have suspend/terminate the suspected accounts in timely manner, each time there's abuse issue.

But today surprisingly, they terminate our server immediately without prior notification. I fully understand that this is my fault not to watch our hosting client for abuse issues.

I only need to get the data back for several hours so I can move the data to other server. Based on their tos limestonenetworks.com/service_info/tos.html I did not see any about temporary data restore so I think we still have right to get our data back.

question

is it true that I can not have my data back at all based on their tos ? since I can not find this matter mentioned on their tos.

View 14 Replies View Related

Abuse Bot

Apr 26, 2009

if any one knows of an abuse bot for web hosting companies that will automatically detect phishing, spam, etc.

I know that this isn't a huge issue for paid hosting providers but it is somewhat problematic for free hosts.

View 0 Replies View Related

ISP Abuse

Aug 21, 2007

Last week my VPS hosting provider has suspended my server because of a SPAM petition made by spamcop.com.

The problem is that the incriminated spam message was not sent from any IP adress of my VPS, or a domain hosted on my VPS. Still this, my ISP has suspended my server without sending me any warning e-mail.

Only guilt that i have is that the spammer found some e-mail adresses in one webportal hosted by my server and he mentioned this on the last 2 lines of the message: "This message was sent to you be cause we found your e-mail adress on a public website and this website is....www.somewebsite.com.

The admins of my ISP didn't asked me about the potential fraud and closed my VPS for almost 24 hours without warning me. I was in vacantion for 10 days and i didn't know about the fact that my clients are in trouble.

Now i'm asking you: Does the ISP made a right thing suspending my VPS only because on of my hosted domains was mentioned in the spam message, and no IP adresses or domains names of my VPS were in the X-Originating-IP header lines?

View 7 Replies View Related

Email Abuse

Jun 25, 2008

Apparently smtp servers from other countries are using our email addresses in the 'reply to'. Because of this much failed messages replies (message is blocked; user doesn't exist) are returned to our email accounts. Is there a way to handle abuse like this? We aren't an open relay but for some reason all the mail is coming back to us. Is there a way to combat this?

View 5 Replies View Related

OVH DMCA/Abuse Address

Nov 13, 2008

Does anyone have the abuse/DMCA complaint email for OVH as I need to file a complaint but cant find it.

View 3 Replies View Related

Handling Abuse From Your Own Customers

May 31, 2008

I was wondering what other people did to prevent their networks from being used as platforms for network abuse. I just setup an inward facing snort server, myself- But I was wondering what other providers (especially other low-cost VPS providers)

View 2 Replies View Related

Abuse Issue (Tickets From FDC)

Jan 23, 2008

I got Abuse issue Tickets from FDC today, Which i have install new OS few days ago, only have 2 website i know they would not send out any spam email or anything..

Due to the below email, their is an abuse issue with your server. You have 24hrs to respond on how you will correct this issue before we null route the ip. Further complaints, without action may result in deactivation of your server.

Thanks for your cooperation.

--begin disclaimer
You are receiving this message because you are listed as contact of
one of the networks or domains involved in this incident. If you are
not the correct contact please ignore this message.
--end

Dear Mr,

Please investigate the incident described in the following partial log,
giving the treatment as your AUP permit, reporting the measures to all
recipients of this message.

In case of non acceptable treatment or reincidence, it will be taken
restrictive measures to protect .BR registry.

Info---------------------------------------------------------------------
Timezone: GMT -2:00

The port in question was 10000 - registered in IANA[2] for: Network Data
Management Protocol

The e-mail contact it was gotten by the following consultation:
whois -h whois.lacnic.net 66.90.101.xxx
Whois-----------------------------------------------------------------------

% Joint Whois - whois.lacnic.net
% This server accepts single ASN, IPv4 or IPv6 queries

OrgName: FDC Servers.net, LLC
OrgID: FDCSE
Address: 141 West Jackson Blvd, Suite 1135
City: Chicago
StateProv: IL
PostalCode: 60604
Country: US

NetRange: 66.90.64.0 - 66.90.127.255
CIDR: 66.90.64.0/18
NetName: FDCSERVERS
NetHandle: NET-66-90-64-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Allocation
Comment:
RegDate: 2003-08-18
Updated: 2004-02-26

OrgAbuseHandle: ABUSE438-ARIN
OrgAbuseName: ABUSE department
OrgAbusePhone: +1-312-913-9304
OrgAbuseEmail: abuse@fdcservers.net

OrgNOCHandle: NOC1402-ARIN
OrgNOCName: Network Operations Center
OrgNOCPhone: +1-312-913-9304
OrgNOCEmail: abuse@fdcservers.net

OrgTechHandle: PKR5-ARIN
OrgTechName: Kral, Petr
OrgTechPhone: +1-630-729-0228
OrgTechEmail: abuse@fdcservers.net

# ARIN WHOIS database, last updated 2008-01-22 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
Logs-----------------------------------------------------------------------
Jan 22 11:51:08.961984 66.90.101.xxx.59733 > xxx.xxx.2.8.10000: S [tcp sum
ok] 1684154077:1684154077(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl
117, id 47077, len 48)
Jan 22 11:51:08.962002 66.90.101.xxx.59733 > xxx.xxx.2.15.10000: S [tcp sum
ok] 2112584473:2112584473(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl
116, id 54111, len 48)
Jan 22 11:51:08.962018 66.90.101.xxx.59733 > xxx.xxx.2.11.10000: S [tcp sum
ok] 784051742:784051742(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl 117,
id 34960, len 48)
Jan 22 11:51:08.962043 66.90.101.xxx.59733 > xxx.xxx.2.16.10000: S [tcp sum
ok] 188686613:188686613(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl 117,
id 8194, len 48)
Jan 22 11:51:08.962057 66.90.101.xxx.59733 > xxx.xxx.2.10.10000: S [tcp sum
ok] 1829533742:1829533742(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl
117, id 26158, len 48)
Jan 22 11:51:08.962080 66.90.101.xxx.59733 > xxx.xxx.2.12.10000: S [tcp sum
ok] 1559560773:1559560773(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl
116, id 4558, len 48)
Jan 22 11:51:08.962093 66.90.101.xxx.59733 > xxx.xxx.2.9.10000: S [tcp sum
ok] 60930635:60930635(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl 117, id
551, len 48)
Jan 22 11:51:08.965238 66.90.101.xxx.59733 > xxx.xxx.2.3.10000: S [tcp sum
ok] 1935758257:1935758257(0) win 65535 <mss 1460,nop,nop,sackOK> (ttl

View 6 Replies View Related

Postmaster@ And Abuse@ Addresses

Nov 19, 2007

How do you handle your postmaster and abuse addesses for each of your shared hosting accounts? I obviously dont want to receive them all as root and i dont have catchall accounts enabled. I was thinking about setting up aliases to point to their cpanel username account, but i dont know about you, but i hate those accounts and i highly doubt my clients are going to ever check them. These addresses seem to be high targets for spam as well. I have an anti-spam solution, but high volume targets still let a bit of spam through.

View 1 Replies View Related

Robot: AdtuitionBot Abuse Notice

Mar 25, 2009

One of the sites I help run has 1.5 million pages of parts that can be ordered and information about those parts. We started seeing a ton of hits at around 20-30 pages per second over the past couple days.

There is no information about them on the internet and they are also masking as GoogleBot.

Be on the lookout as I am pretty sure they are trying to steal content and post it up for search results. They are using Amazon EC2 servers to do it also.

This is how they are identifying themselves:
Mozilla/5.0 (compatible; Adtuitionbot/1.0; +http://www.google.com/bot.html)"

Offending IPs: 174.129.155.59, 72.44.52.93

In a 24 hour period, we blocked 408,821 requests from them.

View 0 Replies View Related

DedicatedNow/FortressITX No Response To Abuse

Apr 30, 2008

Recently we received reports of spam being sent out in massive amounts from an old IP address we had with DedicatedNow/FortressITX, apparently the IP still has reverse DNS setup for our domain name for some reason and we are still receiving spam reports.

I have sent them two emails/tickets, which were logged into their ticket system and have had no response from them in regards to this. They have not taken any action because I am still receiving spam reports from the same IP address, surprising they have not taken any action towards spam on their servers.

I have also requested that they remove the reverse DNS entry, no response to that as well.

Emails were sent with the spam reports from junkemailfilter.com.

Perhaps this will get their attention and they will look into the problem and put a stop into the spam issue.

View 13 Replies View Related

LT & TP Abuse Dept Emails Address

Jul 7, 2008

how i can get in touch with the abuse dept of layeredtech.com and theplanet.com's abuse dept as IPs from these seem to be making a suspected DDoS attack on my server?

View 1 Replies View Related

Is It Possible That A Web Hosting Company May Abuse Your CC Info

Feb 16, 2007

As known, we should provide our credit card information to pay hosting costs.. two questions arise here...

1) What stops a hosting company from stealing or abusing your personal information?

2) What if I want to pay hosting invoices month by month (manually), is it possible and what should I do to go this way?

View 14 Replies View Related

Layered Technologies Abuse Contact Information

Jun 8, 2008

I am trying to get a hold of the abuse department of Layered Technologies. They host a splog which is continually ripping my content - takes the content down after a complaint - just to publish it again after a few hours.

I only have sales@layeredtech.com - and even so they promise to forward the request - the latest rip is from yesterday evening and still on the other site.

I really like to have this resolved.

View 14 Replies View Related

Terrible Singtel EXPAN's Abuse/network Department (in HK)

Mar 20, 2007

Usually, I won't start a thread. But this time, I think I will share my 1-year experience, so people will know how Singtel EXPAN (HK) network/abuse department works.

Firstly, their network is extremely good most of the time. I only made a few complaints about network (3-4 minor problems... except the one caused by the earthquake)

So, I am a happy customer for first 10 months. However, my nightmare starts 2 months ago:

1. Early Feb, the abuse/network team received a phising scam (AOL) complaints against a site on a dedicated server customer (which sold hosting as a part time job). So, a technican has forward us the email and then phoned me about that. I immediately forwarded it to my customer.... After 30 minutes, the technican phoned me again and told me that they had blocked the IP since I didn't fix it.
Finally, this customer cancelled next month. [EWM ticket #3143589]

2. After 10-20 days, we got a new customer that want to send mailing list. I said as long as you responded to all complaints and the rate isn't high, you can use the server for mailing list. Within 20 days, we got few complaints via email (in standard template) ... so I forward them to my customers and they removed them promptly. Then, one day, a technician phoned me and told me they will block the IP at 5:00pm... but they phoned me at 2:00pm... So, I begged them to extend the deadline to 24-48 hours because the customer come from US... After a day, another spam complaint (from this customer's previous HK provider )... so, I turned off the switch port of his server immediately.

This time, I really appreciate the extended deadline. However, after this incident, their patient were all gone.

3. Last week, Microsoft privacy team reported that one of the site is linking to privated copy of Windows Vista (which is hosted in Radidshare.de) and providing license key/ key generator.

So, the technician phoned me and give me 30 minutes. I said the site is a popular forum with 130K+ members and 10K+ members online... sometimes, somethings may be overlooked. This time, no extended time.... Luckily, the forum owner is online in MSN. So, he deleted the thread immediately and I reported it to Microsoft and Singtel. Microsoft Anti-privacy team did reply and thank us while Singtel kept silent. [MS Ref. 878XX]

4. 2 days ago, someone "complained" about "Spam Activities" on 1 server. The complains are about 2 URLs in a server were redirecting to a sites that was infected by virus/ was hosting virus. Again they phoned me and told me to fix within 30 minutes or they suspend my network.... This time, I can't contact the owner and we don't have access to the server... so I suspended this server. [??No email ticket reference??]

5. Yesterday, a technician phoned me again and told me to fix a spam complaint within 30 minutes. But, this time, the complain is so short that I can paste it here:
--------------------------------------------
Subject: UNDER ASSAULT BY SPAM!

XXX.XXX.XXX.XXX has been assaulting my formmail script for

days. Please make it stop!
--------------------------------------------

Since my skill level is too low, I can only think of 1 solution..... [EWM ticket # 3188660]

---- personal opinion -----
Singtel EXPAN DC (Shatin) has a good infra-structure and helpful onsite technicians. But, their abuse/ network department is a joke. (Just like an over-budget police department in SimCity. ) That make, their colocation is not suitable for any hostings/ dedicated server providers. It is not recommended to anyone that doesn't sit next to the phone 24 hours a day.

View 14 Replies View Related

Layered Tech Not Acting On DoS Abuse Report - What's An Acceptable Response Time

Jun 3, 2008

So we have a single Layered Tech box hitting our server with around 90 MBit/s for almost 12 hours straight now, resulting in over 400 GB excess traffic so far. An abuse report was sent about 4 hours ago (Ticket-ID: XZP-97559-339) with evidence included, but so far there was 0 reaction besides the auto-reply.

A phone call to the number listed on their website resulted only in a message that there is no one available at extension XYZ. I didn't try repeat calls since playing international phone tag is not quite my idea of fun.

I realise that it was/still is early in the morning at their location, but nonetheless, I'd expect a company their size to respond a lot faster to reports such as this.

View 14 Replies View Related

Qmail

Jun 23, 2007

I see many mails in the queue lists,and from the title I think is spam.

But how I can see from which customer is?

In process,it says as client the Root

What Can I Do?

The Sending mail domain,is not hosting in us - I check it.

View 0 Replies View Related

Qmail - Does Not Like Recipient???

Nov 14, 2006

Hi,

I can receive emails from qmail but couldn't send out any... I checked my mail logs and found:

Nov 14 17:53:20 server relaylock: /var/qmail/bin/relaylock: mail from 11.22.333.444:37277 (server.domain.com)
Nov 14 17:53:23 server qmail: 1163498003.114915 delivery 708: failure: 11.22.333.444_does_not_like_recipient./Remote_host_sai$

Nov 14 17:53:19 server qmail-queue[11421]: mail: all addreses are uncheckable - need to skip scanning (by deny mode)


11.22.333.444 is my server ip. Why Do I got this error and how to fix it??
Anyone help please greatly appreciate.

Thank you

View 0 Replies View Related

Inter7 And Qmail

Dec 9, 2006

I recently upgraded my Qmail systems. Since Inter7 was the one who did it for me previously, I contracted them to do it. Two years ago I was very impressed, my load was a high 20s, after they finished it was in its low 4-5 with 4 CPU processors.

This time I asked for an upgrade for the Qmail in general and also its spam filters as I am getting more and more spams and the load is increasing. They stabilise the server loads, add tons of fantastic new layers of spamming protection, helped monitored and customised their scripts to my systems.

Real professionals and real knowledgeable people when it comes to Qmail. I had nothing but praises two years ago. Two years now, I have still nothing but praises.

View 0 Replies View Related

Exim Or Qmail Better?

Dec 11, 2007

ive been asked to use exim coz its easier to use with spamassasin.

but is exim as safe as qmail?

ive heard qmail offers better safety.

View 11 Replies View Related

Seconday MX Qmail

Jul 8, 2008

I am trying to setup qmail to handle secondary mx for 1 domain name. Panel installed is LXADMIN.

I had modified the /var/qmail/control/smtproutes and /var/qmail/control/rcpthosts, also restarted qmail.

To test this secondary mx, I had modified the domain's dns to point the first mx to something invalid like "heheeeehead.com" so that I hope it will send to the second mx which is my secondary mx.

It did send to the secondary mx but with an error as follows:
<dan@domain.com>:
Sorry, I couldn't find any host named mail.domain.com. (#5.1.2)

Its true the host mail.domain.com is invalid as I had pointed to invalid domain like "heheeeehead.com". But why doesn't the qmail wait a while and retry? Because I got the bounced back error almost immediately after I sent.

The current default value for /var/qmail/control/queuelifetime is 604,800 seconds, or 7 days.

So I'm not sure why it bounced back immediately.

But I'm not sure if this is the correct way to test backup mx.

View 6 Replies View Related

Qmail And Spamassassin

Sep 29, 2006

Hi i'm trying to use spamassassin from each user using .qmail from each mail user but i can't it dosen't works. Also i wish to know if i have any rule on spamassassin to check some words like sex viagra ,etc and if it's found it will delete it.

View 0 Replies View Related

Maildrop .qmail

Nov 13, 2006

i'm trying to filter spam from inbox folder to spam folder but i wish to know if it's posible to use maildrop directly without vdelivermail because i don't have vdelivermail.

View 0 Replies View Related

Qmail Log Format

Oct 30, 2008

qmail log format. The log format in the file /usr/local/psa/var/log/maillog is wrong and is showing as below. It is missing the email account name and the mailbox name. Any idea why is causing this and how can modify the log format in file?
Current log format
======================================
Oct 27 17:31:33 host123 smtp_auth: smtp_auth: SMTP user : logged in from (null)@isp.isp.com [11.11.22.22]
======================================
======================================
The actual log format should be as follows.
======================================
Oct 27 09:28:18 server smtp_auth: smtp_auth: SMTP user test12@domain.com : /var/qmail/mailnames/domain.com/test12 logged in from unknown@isp.isp-11.11.11.11.isp.net.in [11.11.11.11]
======================================
Details:
[root@ser control]# rpm -q psa-qmail
psa-qmail-1.03-cos5.build84080425.19
[root@ser control]# rpm -q drweb-qmail
drweb-qmail-4.33-cos5.build84080425.19
[root@ser control]# rpm -q psa
psa-8.4.0-cos5.build84080425.19

View 0 Replies View Related

Qmail Attack

Feb 23, 2008

my server load is currently

load average: 13.23, 11.34, 10.53

when i look at the apache server-status, it says i am using .723% of cpu.. so i don't think that is the problem.. i ran this command..

/var/qmail/bin/qmail-qstat

and it came out with..

messages in queue: 3061
messages in queue but not yet preprocessed: 29

is that a lot of messages in queue?

when i do top.. these are some of the processes that come up first..

10749 popuser 18 0 12.9 0:00.39 0.1 2924 380 304 D qmail-local
368 popuser 16 0 2.7 0:15.32 3.9 30720 19m 2244 S spamd
10712 mailman 18 0 1.7 0:00.07 0.6 5764 3124 1800 D gate_news
10678 root 17 0 0.7 0:00.09 0.2 3820 1064 780 R top
178 root 15 0 0.3 81:43.17 0.0 0 0 0 D kjournald
1827 root 15 0 0.3 76:52.47 0.1 2412 456 380 D syslogd
9170 qmails 15 0 0.3 50:27.14 0.1 2448 540 372 D qmail-send
9174 qmailr 16 0 0.3 7:55.07 4.6 83080 23m 264 S qmail-rspawn
9413 root 16 0 0.3 0:00.09 0.5 10292 2708 1956 S sshd
10089 popuser 18 0 0.3 0:01.15 0.1 3312 380 304 R qmail-local
10345 popuser 18 0 0.3 0:00.35 0.1 1540 376 304 D qmail-local
1 root 16 0 0.0 0:43.19 0.0 1888 92 64 S init
2 root 34 19 0.0 20:19.12 0.0 0 0 0 S ksoftirqd/0
3 root 5 -10 0.0 0:03.87 0.0 0 0 0 S events/0

View 13 Replies View Related

Set Qmail Log Directory

Aug 1, 2007

How do i set qmail to log to other directory other than /var/log/qmail/qmail-xxxx/current ?

This is a FreeBSD system

View 11 Replies View Related

Which Folder To Backup In Qmail?

Dec 27, 2007

just wondering which folder in qmail would contain my inbox and sent emails?

View 4 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved