Skip to main content

Server Side Spam Block Information

efuzone
Hello, Now a days some of our customers getting emails from their own emails, and subject is not same some people get subject with their own name etc, and email has body for example your email address is hacked, I am hacker blah blah. I have checked source i know it is from outside email and i have blocked IP in CSF. I can also apply global filter in domain for example body: contains: hacked, hacker, bitcoin etc but the issue is i have many domains in one server I want to apply something through exim or server side so it should be apply globally and email discarded if body contains some phrase which i will add there.. Please tell me is there any solution.

Comments

6 comments

Date Votes
  • cPanelMichael
    Hello @efuzone, The following document explains how to setup an email filter system-wide: How to Customize the Exim System Filter File - cPanel Knowledge Base - cPanel Documentation Let me know if this helps. Thank you.
    0
  • efuzone
    Hello, This is not what i am looking for, I have multiple servers and users complaining they are getting emails from their own emails and there is written. I have full access of your email etc pay me through bitcoin to avoid losses etc.. When we check emails are from other ips and other hosts. Lets suppose if we block that host. It will come from another hosts. How to handle this situation.
    0
  • cPanelMichael
    Hello @efuzone, One additional option to consider is Require remote (domain) HELO found under the ACL Options tab in WHM >> Exim Configuration Manager >> Basic Editor. This option will prevent someone from using local domains hosted on the cPanel server as the FROM address during the SMTP transaction with an error like this: "REJECTED - Bad HELO - Host impersonating [testing.tld]"
    Additionally, you could enable the following options under the ACL Options tab in WHM >> Exim Configuration Manager >> Basic Editor to reject emails that fail DKIM verification: Allow DKIM verification for incoming messages Reject DKIM failures Thank you.
    0
  • efuzone
    Hello, See what type of emails users getting. Your account is infected! Renew the password right this moment! You probably do not heard about me and you obviously are most likely wanting to know for what reason you're receiving this email, proper? I'm ahacker who exploitedyour emailand all devicesseveral months ago. blah blah blah Great, in my opinion, 1000 USD is basically a reasonable price for our small riddle. You will make your payment by bitcoins (if you don't understand this, search "how to purchase bitcoin" in any search engine). My bi*** wallet address: ***************** (It is cAsE sensitive, so just copy and paste it). Important: You will have only 2 days in order to make the ...................
    0
  • Infopro
    Related thread:
    0
  • cPanelMichael
    See what type of emails users getting.

    Can you share the message header (ensuring to remove real domain names and IP addresses) along with the entry from /var/log/exim_mainlog? EX: exigrep MSG-SUBJECT /var/log/exim_mainlog
    Replace "MSG-SUBJECT" with the subject associated with the one of those emails. Ensure to remove real domain names and IP addresses when you paste the output here. Thank you.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post