1

I have a small system that sends about 15 email/day to my personal email account. I have set up the web form so that the users email is set as sender when I send the email to my inbox so it's easy for me to answer with just a reply. The problem is now that my IP is getting stuck in http://cbl.abuseat.org/ as a spam IP. My volumes are so low so I did not think this would be a problem and my messages contains no capital letters, no xxx-words or what I think are other problems. Just plain text with my users questions.

What can I do to prevent this. The mail server is on the same ip as my web server with the same domain, but the server that I'm sending my mails to is the one of my ISP. The server I'm using is hMailServer and it is basically default settings.

3 Answers 3

5

Your server is one of the following:

  1. hacked
  2. cracked
  3. Open Relay
  4. Gateway for a Spam bot
  5. A Windows server containing a Spam bot

You have to hire a professional to help you out.

If you want to do something on your own then you do:

  1. Network traffic monitoring
  2. Identifying mail sending process
  3. Watch mail server logs

Then remove the root cause. But you have to know what you are doing.

On the other hand your statements contradict each other. You say that you use your ISP's mail server (which is not on the blacklist) but then you say your mail server used for sending mails directly to users is on a dynamic IP range. Sending directly from dynamic IPs is discouraged exactly because of the problem you have now!

2

Maybe your server is compromised and is sending out spam. The CBL will tell you why you were listed from a link at the URL you posted - what do they say?

Take a look at the headers of the last time a message made it through. This may give you an idea of how the mailserver you are receiving the mail through is treating it, and may give you some further hints as to what is marking it as spam.

0

Webform?

If your web form is not very tightly constructed, it will be used to send spam. Bots scour the web for forms that send email, then probe them to find out if they can be used to send spam (usually by sending some test messages to an email address used to confirm success). If a weakness is found, it will be used for spam and phishing attacks.

Web to email forms are a classic entry point for compromising a server through email injection. The linked example is about PHP, but the principle applies to any web form that calls a mail function in the webserver or scripting language.

These functions typically do not require a mail server is installed on your server - unless you tell them otherwise they will send the mail directly. This, your mail server logs will likely not tell you anything about what your web form is doing.

There are other forms of injection attack that could result in worse compromises of the server, up to and including gaining root access.

Be extremely careful whenever you allow users to send text to your web server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .