URGENT - server spamming

baggs1981 · Sep 13, 2007

Hi all,

New (ish) server just a couple of users, 1 is sending shed loads of spam:

Mainlog shows repeated:

2007-09-13 22:22:21 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:23 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address
2007-09-13 22:22:23 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:23 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address
2007-09-13 22:22:23 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:28 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address
2007-09-13 22:22:28 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:32 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address
2007-09-13 22:22:32 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:32 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address
2007-09-13 22:22:32 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:34 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address
2007-09-13 22:22:34 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:38 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address
2007-09-13 22:22:38 H=mail9.messagelabs.com [85.158.140.179] incomplete transaction (QUIT) from <>
2007-09-13 22:22:39 H=mail9.messagelabs.com [85.158.140.179] F=<> rejected RCPT <[email protected]>: Unrouteable address

any advice on:

a) solving the issue?
b) how this could happen?

DirectAdmin Support · Sep 13, 2007

Hello,

Causes can be anything from poorly written perl/php script, to kernel exploits.. but bad web contact forms are usually the cause.

Try this to limit the dailiy limit of outbound email:
http://help.directadmin.com/item.php?id=81

John

URGENT - server spamming

baggs1981

Verified User

DirectAdmin Support

Administrator