HELP! Server sending out many outbound email messages

B

blitzer

Verified User
Joined
May 12, 2009
Messages
35
Appreciate any help here.

My server has been sending out tons of outbound emails.
An example from the Server logs show the following

2010-04-23 04:06:53 1O50Pe-0000kD-E7 ** [email protected] F=<[email protected]> R=lookuphost T=remote_smtp: SMTP error from remote mail server after MAIL FROM:<[email protected]> SIZE=4430: host mx4.hotmail.com [65.55.92.136]: 550 SC-001 Mail rejected by Windows Live Hotmail for policy reasons. Reasons for rejection may be related to content with spam-like characteristics or IP/domain reputation problems. If you are not an email/network admin please contact your E-mail/Internet Service Provider for help. Email/network admins, please visit http://postmaster.live.com for email delivery information and support

I certainly do not have any [email protected] account on my server and have less than 20 domains on my server.

If anyone could give advice or point me in the right direction, would be most grateful
 
Thanks for your reply but how do i set the email sending limits?
Click to expand...
Go to DirectAdmin.com
Click Support
Click Knowledgebase
Search limit email
Click How to limit the number of emails sent by each user (prevent spammer)
 
blitzer said:
Problem is i cant seem to trace which user account the php script is being abused.
Click to expand...
The php mail-header-patch should be useful for this, but unless those emails get bounced back to the server (unlikely), like you say, you can't actually tell...... Maybe Floyd can bring some light on this
 
Peter Laws said:
The php mail-header-patch should be useful for this, but unless those emails get bounced back to the server (unlikely), like you say, you can't actually tell...... Maybe Floyd can bring some light on this
Click to expand...

If he follows the directions in post #6 he will probably find the user. If its a php script then finding the user may not be enough, after all you want the script that is doing it. The user will probably need help with this.

So ... Chances are too that there are many undeliverable spam emails in the spool that will shed light on the problem script.

Code: 
grep -r X-PHP-Script /var/spool/exim/input/

This will tell you all the php scripts that are sending out email that is still in the queue. Probably legit email that scripts send out are already processed and are not present.
 
Thanks a bunch guys!

John of DA gave me some useful tips and i managed to resolve the issue.
Seems that one of my account user's password was compromised resulting in massive spam from my server.

Appreciate the help!
 
You must log in or register to reply here.
Back
Top