1

I am the owner of a server and I have got a spam problem on one of the accounts.

The spammer keeps sending lots of mails from fake non-existing addresses from (only) one of my domains. [email protected], [email protected], yetanother [email protected].

Where troubledomain.com is my "trouble" domain.

  • CentOS 6.6 final (yum updated)
  • Updated all Wordpress installs on the server including all the plugin's
  • Changed ftp passwords
  • Deleted the whole (spamming) account and created a new one (different name)
  • Set the max emails to 1

I google'd for days, tried stuff but the IP of the server still gets blacklisted by spamhouse and I get daily emails from DirectAdmin "Warning: 1 emails have just been sent by (USER)".

Part of the mail_queue:

ID  Time    Size    Sender  Frozen  Recipient(s)    Select
1Ye8vP-0008OH-0t    0m  2.1K    <>  yes [email protected]

1Ye8vP-0008OM-6H    0m  1.9K    <>  yes [email protected]

1Ye8va-0008Ob-UA    0m  746 <[email protected]>   no  [email protected]

Part of the Exim_Mainlog

2015-04-03 23:51:59 1Ye9VP-0004ur-QI <= <> R=1Ye9VO-0004tD-Jd U=mail P=local S=2120 T="Mail delivery failed: returning message to sender" from <> for [email protected]
2015-04-03 23:51:59 1Ye9VO-0004t2-8N Completed
2015-04-03 23:51:59 1Ye9VP-0004us-QI ** [email protected] F=<> R=virtual_aliases: 
2015-04-03 23:51:59 1Ye9VP-0004us-QI Frozen (delivery error message)
2015-04-03 23:51:59 1Ye9VP-0004ur-QI ** [email protected] F=<> R=virtual_aliases: 
2015-04-03 23:51:59 1Ye9VP-0004ur-QI Frozen (delivery error message) 

Its really driving me crazy. I thought when i deleted the whole account on DirectAdmin and created a new on, changed all the passwords it would be cleaned, but it started again on the same account.

I installed Maldet and scanned the whole server (sometimes it finds stuff and clean it. This is the last log:

TOTAL FILES: 436208 
TOTAL HITS: 2 
TOTAL CLEANED: 1 

CLEANED & RESTORED FILES: 
/maldetect-1.4.2/files/clean/gzbase64.inject.unclassed 

FILE HIT LIST: 
{HEX}gzbase64.inject.unclassed.15 : /maldetect-1.4.2/files/clean/gzbase64.inject.unclassed => /usr/local/maldetect/quarantine/gzbase64.inject.unclassed.19892 
{CAV}Php.Malware.Mailbot-1 : /home/USER/domains/troubledomain.com/public_html/wp-content/uploads/2016/04/functions.php => /usr/local/maldetect/quarantine/functions.php.5294 

Don't really understand why it cleaned 1 of the 2 hits and what to do with them and how to prevent this. If i would do another search tomorrow it will find another file in the Wordpress folder and even if its cleaned spam will still be send.

Again, im not the best administrator there is, but I'm willing / happy to learn..

Note: if you need any information, please tell me how to get it, that way my responses will me much quicker

UPDATE:

I found this when yet another spam session was going on:

[root@SERVERNAME virtual]# lsof -i | grep smtp
exim       1503    mail    3u  IPv6   3247      0t0  TCP *:smtp (LISTEN)
exim       1503    mail    4u  IPv4   3248      0t0  TCP *:smtp (LISTEN)
exim      13999    mail    7u  IPv4  39633      0t0  TCP SERVERNAME:40610->mta-v2.mail.vip.gq1.yahoo.com:smtp (ESTABLISHED)
exim      14140    mail    9u  IPv4  40073      0t0  TCP SERVERNAME:56045->mx2.free.fr:smtp (SYN_SENT)

Can somebody please share some ideas how to stop this evil stuff?

UPDATE #2

I did some more diggin and found that its sending all the spam from my local machine (from the eximstats mainlog):

Top 50 rejected ips by message count
------------------------------------
  Messages   Rejected ip
      1222   local

Also when i check the for more highest email usage:

Highest         Value                           Count   Percent
Sender          [email protected]   473     3
Authentication                                  0       0
Sending Host                                    0       0
Sending Script                                  0       0

When i check the headers of the one of the spam messages is see this:

1YfY3p-0004GS-3R-H
mail 8 12
<>
1428430637 0
-ident mail
-received_protocol local
-body_linecount 29
-max_received_linelength 150
-allow_unqualified_recipient
-allow_unqualified_sender
-frozen 1428430637
-localerror
XX
1
[email protected]

Also this message:

The most common path that the messages were sent from is /, at 15564 emails (7782%). If the path is a system path, it likely means the email was sent through smtp rather than using a script.

Hope this gives more info about the problem and suggestions how to solve this problem that makes me crazy.

8
  • Is your server configured as a open mail relay?
    – armani
    Apr 3, 2015 at 22:36
  • Web interface panels such as Cpanel, plesk or directadmin are off-topic.
    – user186340
    Apr 3, 2015 at 23:07
  • @andre, I've seen this, but the question isn't about a web interface, i just gave that info, i cant help that people answer web interface related...
    – RoRo
    Apr 4, 2015 at 0:03
  • 2
    Get rid of the offending user. Apr 5, 2015 at 4:28
  • 1
    Wipe your server and start from scratch. Your server appears obviously compromised if I read you correctly and files are being edited on the server directly by unknown actors.
    – gparent
    Apr 7, 2015 at 18:31

1 Answer 1

2

Directadmin has built in features to ratelimit accounts outbound email by doing the following:

If you wish to have a custom limit for one or more email address, create a limit in the following path, which will override the /etc/virtual/user_limit file.

echo 100 > /etc/virtual/domain.com/limit/user

where "user" is without the @domain.com. http://www.directadmin.com/features.php?id=1246

If you want to just block the user from sending mail completely, could look for what IP address it is coming from in /var/log/exim_mainlog and then block that with your firewall. Though if this is a legitimate user that you don't want to block, perhaps education and ratelimiting would be better.

To answer the question about how the mail is being sent even if you changed the account passwords, it could be from a script in the website files that wouldn't need to authenticate to send mail. Try to find any offending scripts of this nature.

12
  • Well i know web interface question are off-topic, and i know how to block user emails, but thats the problem, like explained in my initial message, the user always changes. it only should use [email protected] but it uses like 100xxx different fake non existing users. As for finding the offending script, any suggestions how to do it. Like i said before i tried it with Maldet, it finds stuff but then a day later there is another threat found..
    – RoRo
    Apr 3, 2015 at 23:50
  • Is the troubledomain.com always the same? or does the domain change as well?
    – Joe
    Apr 6, 2015 at 15:25
  • Another way to trace where the emails are coming from would be to go to Admin Level -> Mail Queue Admin in your Directadmin interface. Then if you can see an offending message in the queue, you can look at the full headers to try and trace where it's originating from. See details on this page: help.directadmin.com/item.php?id=455
    – Joe
    Apr 6, 2015 at 15:27
  • Its always the same domain, even deleted the whole account twice (!) and created a new one with a different username. I updated the initial message, please look at the top for more info.
    – RoRo
    Apr 7, 2015 at 18:28
  • Since the message is coming from the local machine, it is probably originating from a script on the system. Because it's always from troubledomain.com, this script originates from that user and is probably executed via web. I would look for any scripts in that user's directory that send mail. Common problems would be tell a friend type web pages or malware uploaded (which could be uploaded even though you changed passwords if it comes through an exploit in a web page).
    – Joe
    Apr 7, 2015 at 19:43

Not the answer you're looking for? Browse other questions tagged .