Spam issue to yahoo

raul benitez

• March 25, 2015 15:38

We unfortunately had a spam bot on our server that was sending a massive about of spam to yahoo accounts. We finally found it and disable it but are still see the affects. We have CENTOS 5.10 x86_64 standard [Removed] installed. If I watch the exim logs I'm noticing hundreds of connections to yahoo servers with returns. When I do a isof -1 to see connections and i see constant ones to yahoo servers. IF I look at the exim mail log in real time you can see there are hundreds of connections happening with spoofed accounts. [Removed - Actual Email Addresses Were Posted] How can I stop this? I followed everything in the cpanel documents to prevent spam and yet its still happening. Any suggestions will be appreciated.

• 

  24x7server

  • March 26, 2015 04:09

  Hello, I can see your mail server IP is blacklisted in some spam databases and due to that you are getting this issues. You will have to check your server mail setting. Here are the some usefull tips to prevent mail abuse. Please check it at

  0
• 

  cPanelMichael

  • March 26, 2015 13:49

  Hello, Check your mail queue to see if SPAM messages are still in the queue for delivery. If so, you may want to remove them so that future delivery attempts stop. Thank you.

  0
• 

  raul benitez

  • March 27, 2015 18:35

  I already followed those instructions and i'm still getting thousands of bounce backs form yahoo severs from spooof accounts. below is a snip of the exim_mainlog. I can't seem to stop this whatever I do. [Removed - Posting Actual Email Accounts]

  0
• 

  24x7ss

  • March 27, 2015 18:51

  First clear the server mail queue and change the mail routing IP of the server by modifying /etc/mailips. Makre sure IP you are adding in mailips file is not blacklisted. You can check the IP in mxtoolbox.

  0
• 

  cPanelMichael

  • April 06, 2015 13:36

  Hello,

  I already followed those instructions and i'm still getting thousands of bounce backs form yahoo severs from spooof accounts. below is a snip of the exim_mainlog. I can't seem to stop this whatever I do.

  
  I removed the output from your previous post because you posted actual email addresses to a public forum. Could you elaborate on how you determined the emails were spoofed and not actually sent from your server? Thank you.

  0
• 

  raul benitez

  • April 06, 2015 15:14

  ALL those emails were spoofed every single one of them.

  0
• 

  raul benitez

  • April 06, 2015 15:15

  BTW its still happening and I cant figure out a way to stop it outside of just shutting down the server and yes I already implemented all the suggested edits to exim.

  0
• 

  cPanelMichael

  • April 09, 2015 14:22

  Could you open a support ticket using the link in my signature so we can take a closer look? You can post the ticket number here so we can update this thread with the outcome. Thank you.

  0

Please sign in to leave a comment.