Blacklisted

[rpuig]

hello everyone !

i have a new problem...
i´ve just find out that the ip of my server is listed in 5 blacklists.
all reports are saying is because of spamming. My question is... how can i know the source of this?
my server is supposed to be sending lots of spam but im lost in how to toubleshoot this.

any help would be appreciated.

[TGates]

For starters, check your mail logs for emails being sent from addresses that are not yours.

[rpuig]

For starters, check your mail logs for emails being sent from addresses that are not yours.

checked
lots of !"#$#" in the logs. I need help on how to stop sending spam.... please!!

[Me.B]

Check the websites for any new files uploaded in last period where the activity started you will see quicky the culpiit

[rpuig]

Check the websites for any new files uploaded in last period where the activity started you will see quicky the culpiit

websites were checked and no suspicious activity there. I updated everything that needed to be updated.
This morning i received notification that the ip address was removed from some of the blacklists since we are no longer spamming.
Besides the updates made to plugins in wordpress sites, the only thing i made was to flush the mail queue, so i have no idea what was the cause of the problem.

[TGates]

It could have been a wordpress plugin. A lot of them have been known to have vulnerabilities
By updating everything it may have fixed the issue.

[Me.B]

weak passwords would allow hacked to use ESMTP on your servers and so to spam.

But almost 100% sure you got website hacked. do you have any CMS there? Joomla? WP? forums?

M B

[rpuig]

weak passwords would allow hacked to use ESMTP on your servers and so to spam.

But almost 100% sure you got website hacked. do you have any CMS there? Joomla? WP? forums?

M B

just wordpress

[TGates]

I have made some changes to his postfix config but with weak passwords, those changes may not help 100% but should still help a bit. (For example: blocking email pass-through/only allow emails from server, not relay from outside sources, only valid hostnames, etc.)

His mail.log has been very quiet since I added the changes. Will keep monitoring it.


syslog still shows activity though. Watching that also.

[wormsunited]

This is the reason why i do not use Wordpress on my projects! Besides you can build your own system with ease by creating your own databases and php files, basically Wordpress installs a lot of stuff that most of the website owners do not use at all. 

Plugins are the major problem you need to check plugin by plugin, check forums and updates provided. I found some issues with wordpress in this function: functions/theme-mail.php (check if that exists on your theme folder).

You should prevent direct Access to Files: If you identify the snippet above within your theme, add the following code after your opening PHP tags to prevent direct access to the file and further exploitation:

PHP Code:

if ( basename($_SERVER['PHP_SELF']) == basename(_FILE_) )
{
 die('Access Denied');
} 


If you develop themes or plugins and they include files that shouldn’t be used outside of the original theme or plugin, consider using this trick to prevent direct access to the files.

Even so, that should fix the issue at least. WordPress users should also keep these issues in mind and employ preventative measures such as a Web Application Firewall (WAF).

I hope this guidelines help you on your further development.