Skip to main content

Overloaded with spams, unbearable !!!

psytanium
Please I need your assistance. I'm managing a VPS server, I contacted the support on Bluehost, they told me to help my self, its not their responsibility. I'm using MS Outlook as a mail client, I receive more than 100 spam email every day, everyday the same spams, same subjects, content, but the sender change from day to day this way: - Removed - etc... I can't handle this situation anymore, even many of my users are experiencing this disaster.

Comments

17 comments

Date Votes
  • Infopro
    Greetings, can you tell us what you have set for the "Default Address" in your cPanel account? Let's start there. :)
    0
  • psytanium
    under Tweak => Mail Initial default/catch-all forwarder destination is set to "Fail".
    0
  • cPanelMichael
    Hello :) I suggest enabling SpamAssassin and reviewing the following thread for information on how to help prevent SPAM: Additional Spam Prevention Options Also, the following document lists some additional options you can enable to help prevent SPAM: Exim - ACL Options Thank you.
    0
  • Infopro
    ]under Tweak => Mail Initial default/catch-all forwarder destination is set to "Fail".

    That setting has to do with New Accounts created after you enable it. Is it properly set in the cPanel account(s)? I saw your example emails before removing them from your post. Emails to someuser1@ yourdomain.com, someuser2 @ yourdomain.com someuser23 @yourdomain.com etc. can be a result of these setting in your cPanel not being enabled properly. You're taking in everything any spammer throws at you. Might not be your issue of course, but certainly worth mentioning to you here, and worth a peek to make sure.
    0
  • psytanium
    ]Hello :) I suggest enabling SpamAssassin and reviewing the following thread for information on how to help prevent SPAM: Additional Spam Prevention Options Also, the following document lists some additional options you can enable to help prevent SPAM: Exim - ACL Options Thank you.

    [LIST]
  • Spam assassin is enable since 1 year ago in my cpanel.
  • In WHM, Service Configuration " Exim Configuration Manager " all options are set to default. only the following are not set t default:
      ]
    • Ratelimit incoming connections with only failed recipients
    • Trust X-PHP-Script headers to determine the sender of email sent from processes running as nobody
  • [COLOR="silver">- - - Updated - - -
    ]That setting has to do with New Accounts created after you enable it. Is it properly set in the cPanel account(s)? I saw your example emails before removing them from your post. Emails to someuser1@ yourdomain.com, someuser2 @ yourdomain.com someuser23 @yourdomain.com etc. can be a result of these setting in your cPanel not being enabled properly. You're taking in everything any spammer throws at you. Might not be your issue of course, but certainly worth mentioning to you here, and worth a peek to make sure.

    In WHM, Server Configuration " Tweak Settings " Mail Initial default/catch-all forwarder destination: - System account (default) - Fail (Selected) - Blackhole is that true ? should I change to default ?
    • 0
  • Infopro
    is that true ? should I change to default ?
    No. You also login to your cPanel account, find the "Default Address" area, in your cPanel, not WHM, and check the Default Address settings there.
    0
  • psytanium
    ]No. You also login to your cPanel account, find the "Default Address" area, in your cPanel, not WHM, and check the Default Address settings there.

    There is no default address in BlueHost cPanel, i think they disabled it from cPanel. I think in this case, all users are committed to the WHM settings.
    0
  • Infopro
    There is no default address in BlueHost cPanel, i think they disabled it from cPanel. I think in this case, all users are committed to the WHM settings.
    Makes sense, but you should find out anyway, ask them about it.
    0
  • psytanium
    ]Makes sense, but you should find out anyway, ask them about it.

    I aked them and linked them to this threat, they told me this option is disabled by default. I have set the spam assassin level to 1. 1 is the highest level right ? I will let you know if i will notice reduced spams. If you have more hints let me know please.
    0
  • triantech
    Hey psytanium, Hope you find the following thread useful :
    0
  • psytanium
    Well, i have increased the spam assassin levels progressively til i reached "1", at 1 spams are reduced by ~80%, I received around 12 spams per day instead of ~100. But many clean emails were send to Junk folder, others were blocked and returned to the sender. I started receiving phone calls from my clients unable to send me emails. Now I turned back spam assassin to level 5. again tons of spams. In addition I have a serious problem, i cannot send or receive emails from all addresses on a specific domain. if i sent them emails, it will return with "No Such User Here". I tried to turn off spam assassin completely, still cannot send or receive emails to this specific domain. I tried to white-list their domain from Apache SpamAssassin" Configuration by entering *@specific-domain.com. no success. Many mail clients like gmail, yahoo, etc have MUCH BETTER spam filters than Apache. I appreciate some help here. [COLOR="silver">- - - Updated - - - I was suffering from spams, now and exactly after i modified spam assassin filter level I have a second problem, "No Such User Here". Please i have to solve the new problem first. I appreciate your assistance.
    0
  • Infopro
    This might be of some help, depending on the spam I suppose: SpamAssassin doesn't process new TLDs .link .click .rocks (and more) - cPanel Forums The message "No Such User Here" is most commonly used for the Default Address settings message: Default Address - cPanel Forums If you're getting that message when you send an email to another account, you're sending the email to the wrong email address. It bounced.
    0
  • psytanium
    ] The message "No Such User Here" is most commonly used for the Default Address settings message: Default Address - cPanel Forums If you're getting that message when you send an email to another account, you're sending the email to the wrong email address. It bounced.

    emails on my domain and emails on his domain exchanged many emails until I modified the Spam assassin, now i cannot send him email AND he cannot send me emails. this is the exact message i receive:
    ===================================== This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: sales@domain.com No Such User Here ------ This is a copy of the message, including all the headers. ------ Return-path: Received: from [178.135.xxx.xx] (port=59893 helo=LudwigPC) by server.othdmain.com with esmtpa (Exim 4.84) (envelope-from ) id 1YDcj4-00032A-H6; Tue, 20 Jan 2015 17:36:27 +0000 From: "Ludwig user" To: Cc: Subject: test Date: Tue, 20 Jan 2015 19:36:13 +0200 Message-ID: <01c801d034d7$97f14990$c7d3dcb0$@othdmain.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_01C9_01D034E8.5B7A8EC0" X-Mailer: Microsoft Outlook 14.0 Content-Language: en-us Thread-Index: AdA015V1Agxlsg3cQuaeCjkq95VDCA== This is a multipart message in MIME format. ------=_NextPart_000_01C9_01D034E8.5B7A8EC0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Test ==========================================
    0
  • Infopro
    That return error is not related to Apache SpamAssasin.
    0
  • psytanium
    Alright, I appreciate all your help here. I created account filters to discard the frequent spams, and i set Spam Assassin to 3, now its much better. Still have to solve the "No Such User Here" problem on another thread. cheers!
    0
  • keat63
    Under Exim Configuration Manager, on the RBL tab, do you have RBL's enabled. This will stop quite a number of spam.
    0
  • Infopro
    These are helpful as well, IMO: WHM " Plugins " ConfigServer Security & Firewall, LFD Block Lists.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post