Spam Relay?

Nuke Soldier Joined: Jul 05, 2003 Posts: 18

I've started getting a lot of undeliverable message warnings from various mail daemons and so I suspect that someone is using an open mail relay or vulnerability in my site.

The bulk of my site is php-nuke 6.5. There are several pages that are simple php applications as well.

Anyone got a good white paper on closing these types of holes? I'm not really sure where to start.

Micky Evil or Very Mad

Lieutenant Joined: May 29, 2003 Posts: 231

I would say the first place to start is see if your IP is on the spammer blacklist. A lot of ISPs are using them these days. There's a few lists and you can find them by doing a search on Google. Go to Google's Group tab and enter your IP or domain there too to see if it pops up under any newsgroup for spamming.

If you aren't on a spam list and are running a mail server from home, you could be getting blocked just for that. AOL has been banning any email orginating from home mail servers or any with dynamic IPs. This is another spam prevention. Not sure who else does this besides AOL, but I wouldn't be surprised if more do the same. If you are getting blocked because of this, the only way around it is to use your ISPs SMTP connection.

Lastly, check your logs. They will give a clue if someone is exploiting something on your server. If so, most likely it will show exactly where.

Nuke Soldier Joined: Jul 05, 2003 Posts: 18

Mike,

Thanks for the advice.

To be clear, I'm hosted at Pair networks. I'm not an expert with apache logs, but I know theres a php routine that will parse the logs, so I'll check to see if there's anything that looks weird.

My main problem is that I don't really know how this type of abuse is conducted, whether phpMail is the problem or it's just sending through the smtp relay. I'm pretty new to this problem and the web hasn't been particularly enlightening.

Regards,

Micky

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Try this page to test your server:

http://www.abuse.net/relay.html