omidrayaneh
May 16th, 2013, 12:36
سلام من یه cloudlinux هاست 10 گیگ از ولت سرور گرفتم برای سایت شخصی خودم اخه سرور هاست اختصاصیه و کانفیپ امنیتی خیلی خوبی داره به تعریف خود مدیر حالا میبینم هر روز یه پیام از سیستم دایرکت ادمی ن میاد که میگه شمات بیش از حد از سرور سایت استفاده کردید بر اثر ارسال مثلا255500 ایمیل
حالا نمیدونم مشکل امنیت سرور هاست یا من اسکریپتی نصب کردم که مشکل داره حالا کمک میخوام که علت اصلی این اتفاق پیدا کنم
اینم ایمیلها
Subject: Warning: 500 emails have just been sent by pcenterc Today at 03:16
The pcenterc account has just finished sending 500 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
After some processing of the /etc/virtual/usage/pcenterc.bytes file, it was found that the highest sender was pcenterc@hostmaster.weltservers.us, at 545 emails.
The top authenticated user was pcenterc, at 545 emails.
This accounts for 109% of the emails. The higher the value, the more likely this is the source of the emails.
An authenticated username is the user and password value used at smtp time to authenticate with exim for delivery.
The most common path that the messages were sent from is /, at 545 emails (109%).
The path value may only be of use if it's pointing to that of a User's home directory.
If the path is a system path, it likely means the email was sent through smtp rather than using a script.
This warning was generated because the 500 email threshold was hit.
================================
Automated Message Generated by DirectAdmin
Subject: Warning: 192715 emails have been sent yesterday by pcenterc 05/15/2013
There have been 192715 outgoing emails yesterday from the pcenterc User account.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
This warning was generated because the 500 email threshold was passed.
Subject: Warning: 85500 emails have been sent yesterday by pcenterc 05/14/2013
There have been 85500 outgoing emails yesterday from the pcenterc User account.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
This warning was generated because the 1000 email threshold was passed.
حالا نمیدونم مشکل امنیت سرور هاست یا من اسکریپتی نصب کردم که مشکل داره حالا کمک میخوام که علت اصلی این اتفاق پیدا کنم
اینم ایمیلها
Subject: Warning: 500 emails have just been sent by pcenterc Today at 03:16
The pcenterc account has just finished sending 500 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
After some processing of the /etc/virtual/usage/pcenterc.bytes file, it was found that the highest sender was pcenterc@hostmaster.weltservers.us, at 545 emails.
The top authenticated user was pcenterc, at 545 emails.
This accounts for 109% of the emails. The higher the value, the more likely this is the source of the emails.
An authenticated username is the user and password value used at smtp time to authenticate with exim for delivery.
The most common path that the messages were sent from is /, at 545 emails (109%).
The path value may only be of use if it's pointing to that of a User's home directory.
If the path is a system path, it likely means the email was sent through smtp rather than using a script.
This warning was generated because the 500 email threshold was hit.
================================
Automated Message Generated by DirectAdmin
Subject: Warning: 192715 emails have been sent yesterday by pcenterc 05/15/2013
There have been 192715 outgoing emails yesterday from the pcenterc User account.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
This warning was generated because the 500 email threshold was passed.
Subject: Warning: 85500 emails have been sent yesterday by pcenterc 05/14/2013
There have been 85500 outgoing emails yesterday from the pcenterc User account.
There could be a spammer, the account could be compromised, or just sending more emails than usual.
This warning was generated because the 1000 email threshold was passed.