SPAMD making connection to an external IP?

neo_user

• August 26, 2019 08:47

Dear All, My server is running Cent0S 7 with latest cpanel on google cloud. I am also running CSF. I ran nestat -ntueapl on my server and found below udp 0 0 192.168.1.10:51391 5.9.124.53:24441 ESTABLISHED 0 6631798 4946/spamd child I have blocked 24441 in CSF and also in hosts.deny and restarted the spamd service however, in just 5 mins it established the connection again. The IP 5.9.xxx.xx is from hetzner and listed as spam and even a lot fo people complained about it. How can I stop this connection and why Firewall is not blocking the traffic even when the IP is in block list. Please help

• 

  cPanelLauren

  • August 27, 2019 18:37

  This is an outbound connection from your server on port 51391 to an external spam service run by Spam Experts on their port 24441 Blocking 24441 on your server would be pointless as there's no connection being made to your server on that port, furthermore, there isn't a need to block this considering this is being used in Spam Scanning.

  0
• 

  keat63

  • August 29, 2019 12:54

  THis is quite normal, i've seen this also.

  0

Please sign in to leave a comment.