+- Sentora Support Forums (https://senforums.mach-hosting.com)
+-- Forum: Sentora Forum Archives (https://senforums.mach-hosting.com/forumdisplay.php?fid=5)
+--- Forum: Sentora Public Support Forums v1.0.x (https://senforums.mach-hosting.com/forumdisplay.php?fid=32)
+---- Forum: Email Support v1.0.x (https://senforums.mach-hosting.com/forumdisplay.php?fid=35)
+---- Thread: Blacklisted (/showthread.php?tid=4071)
Blacklisted - rpuig - 10-04-2017
hello everyone !
i have a new problem...
i´ve just find out that the ip of my server is listed in 5 blacklists.
all reports are saying is because of spamming. My question is... how can i know the source of this?
my server is supposed to be sending lots of spam but im lost in how to toubleshoot this.
any help would be appreciated.
RE: Blacklisted - TGates - 10-05-2017
For starters, check your mail logs for emails being sent from addresses that are not yours.
RE: Blacklisted - rpuig - 10-05-2017
(10-05-2017, 01:36 PM)TGates Wrote: For starters, check your mail logs for emails being sent from addresses that are not yours.
checked
lots of !"#$#" in the logs. I need help on how to stop sending spam.... please!!
RE: Blacklisted - Me.B - 10-05-2017
Check the websites for any new files uploaded in last period where the activity started you will see quicky the culpiit
RE: Blacklisted - rpuig - 10-05-2017
(10-05-2017, 06:34 PM)Me.B Wrote: Check the websites for any new files uploaded in last period where the activity started you will see quicky the culpiit
websites were checked and no suspicious activity there. I updated everything that needed to be updated.
This morning i received notification that the ip address was removed from some of the blacklists since we are no longer spamming.
Besides the updates made to plugins in wordpress sites, the only thing i made was to flush the mail queue, so i have no idea what was the cause of the problem.
RE: Blacklisted - TGates - 10-06-2017
It could have been a wordpress plugin. A lot of them have been known to have vulnerabilities
By updating everything it may have fixed the issue.
RE: Blacklisted - Me.B - 10-06-2017
weak passwords would allow hacked to use ESMTP on your servers and so to spam.
But almost 100% sure you got website hacked. do you have any CMS there? Joomla? WP? forums?
M B
RE: Blacklisted - rpuig - 10-06-2017
(10-06-2017, 05:11 AM)Me.B Wrote: weak passwords would allow hacked to use ESMTP on your servers and so to spam.
But almost 100% sure you got website hacked. do you have any CMS there? Joomla? WP? forums?
M B
just wordpress
RE: Blacklisted - TGates - 10-06-2017
I have made some changes to his postfix config but with weak passwords, those changes may not help 100% but should still help a bit. (For example: blocking email pass-through/only allow emails from server, not relay from outside sources, only valid hostnames, etc.)
His mail.log has been very quiet since I added the changes. Will keep monitoring it.
syslog still shows activity though. Watching that also.
RE: Blacklisted - wormsunited - 10-11-2017
This is the reason why i do not use Wordpress on my projects! Besides you can build your own system with ease by creating your own databases and php files, basically Wordpress installs a lot of stuff that most of the website owners do not use at all.
Plugins are the major problem you need to check plugin by plugin, check forums and updates provided. I found some issues with wordpress in this function: functions/theme-mail.php (check if that exists on your theme folder).
You should prevent direct Access to Files: If you identify the snippet above within your theme, add the following code after your opening PHP tags to prevent direct access to the file and further exploitation:
PHP Code:
if ( basename($_SERVER['PHP_SELF']) == basename(_FILE_) )
{
die('Access Denied');
}
If you develop themes or plugins and they include files that shouldn’t be used outside of the original theme or plugin, consider using this trick to prevent direct access to the files.
Even so, that should fix the issue at least. WordPress users should also keep these issues in mind and employ preventative measures such as a Web Application Firewall (WAF).
I hope this guidelines help you on your further development.