Which mailbox is compromised — find via logs?

`grep 'sasl_username' /var/log/mail.log | awk '{print $NF}' | sort | uniq -c | sort -rn` shows authenticated senders by volume. Outlier user at top of list is the abuse source. Suspend account, change password, audit recently sent mail to confirm.

ClamAV catches PHP webshells reliably?

Partly. ClamAV signatures cover known webshells; novel ones (custom-encoded by attacker) slip through. Combine ClamAV with Linux Malware Detect (maldet) which has specific PHP-malware signatures. Both as cron, alert on hits. For deeper scan, Revisium / AI-bolit (see related article) covers PHP-specific patterns.

Hardening before delisting request — what's essential?

(1) Password rotation on all user mail accounts. (2) Strong password policy enforced. (3) Rate-limit outbound mail per account. (4) Enable outbound spam detection (Imunify-Email or equivalent on cPanel). (5) fail2ban for repeated auth failures. SpamRL reviewers expect this; vague "we'll do better" without specifics gets rejected.

Delisting request — pattern?

Brief, specific: "Our IP X was listed Apr 15. Investigation found compromised account user@example.com sending spam starting Apr 10. We have: (1) suspended account, (2) rotated all user passwords, (3) implemented per-account outbound rate-limit (10 emails/hour), (4) installed maldet for ongoing malware scanning, (5) configured fail2ban for auth failures. Requesting delisting." Specifics get approved.

SpamRL Delist: How to Scan for Malware or Compromised Accounts

2 min read

18.08.2025

If your domain or IP has been flagged on SpamRL, it may be due to spam being sent from your email server, often caused by malware or compromised accounts. Identifying and resolving these issues is critical to delisting from SpamRL and avoiding future blacklisting.

SpamRL Delist Malware Scan — SpamRL delisting — find compromise, fix, then request.

For closely related SpamRL / blacklist topics, see SpamRL Blacklist Configuration, SpamRL Blocking Malicious Emails, SpamRL Delist — Malware Scanning, and BlacklistAlert — Understanding and Resolving.

Malware Scanning on Your Server

Install and Use ClamAV

Install ClamAV:
```
sudo apt-get install clamav
```
Update the virus database:
```
sudo freshclam
```
Scan your server:
```
sudo clamscan -r /var/www/html
```
Check the results and quarantine/delete infected files.

Scan for Suspicious Scripts

Look for unexpected or unauthorized PHP scripts in web directories:

find /var/www/html -type f -name "*.php" | xargs grep -i "base64_decode"

Delete or quarantine suspicious files.

Use Online Scanners for Websites

Scan your website using tools like:
- Sucuri SiteCheck
- VirusTotal

Checking for Compromised Email Accounts

Analyze Email Logs

Check the mail server logs for unusual activity (e.g., excessive emails sent):
- For Postfix:
```
sudo tail -f /var/log/mail.log
```
- For Exim:
```
sudo tail -f /var/log/exim_mainlog
```
Look for:
- High volumes of outgoing emails.
- Unauthorized email addresses.

Identify the Top Email Senders

Use command-line tools to find accounts sending the most emails:

For Postfix:

grep "from=<" /var/log/mail.log | awk '{print $7}' | sort | uniq -c | sort -nr | head -10

Disable Compromised Accounts

If you identify an account sending spam, temporarily disable it and reset the password.

Verify Your Email Server Configuration

Check for Open Relays

Ensure your mail server is not an open relay (i.e., it does not allow unauthorized email sending).
Test using tools like MXToolbox Open Relay Test.

Review Authentication Logs

Check for brute-force attacks or unauthorized logins:
```
sudo grep "authentication failure" /var/log/secure
```

Securing Your Server and Accounts

Update Software

Web Server: Update Apache, Nginx, or other web server software to the latest versions.
CMS Platforms: Ensure WordPress, Joomla, or other CMS systems are updated. Remove unused plugins/themes.

Enforce Strong Passwords

Require complex passwords for all email accounts.
Enable Two-Factor Authentication (2FA) if available.

Limit Email Sending

Set email rate limits per account to prevent excessive spam from compromised accounts.

Monitor Traffic

Use monitoring tools like iftop or nload to detect unusual outgoing traffic.

Preventive Measures

Set Up Email Authentication

SPF:
```
v=spf1 include:_spf.example.com ~all
```
DKIM: Publish a TXT record containing your DKIM public key.
DMARC: Define email authentication policy.

Scan Regularly

Automate malware scans with a cron job for ClamAV:

crontab -e

Add the following line to scan daily:

0 3 * * * clamscan -r /var/www/html

Monitor Reputation

Google Postmaster Tools.
Microsoft SNDS (Smart Network Data Services).
MXToolbox Blacklist Monitor.

Tools to Help with Scanning

Tool	Purpose
ClamAV	Scan for malware on servers.
RKHunter	Check for rootkits or unusual system changes.
Sucuri	Online scanner for websites.
Fail2Ban	Block IPs after repeated login failures.
Malwarebytes	Scan Windows servers for malware.

Delisting After Cleanup

Re-check Reputation

Use MXToolbox or Spamhaus to ensure you are no longer flagged.

Submit a Delisting Request

Visit the SpamRL provider website and provide details of the issue resolution.

Monitor for Recurrence

Set up alerts to detect spammy activity early.

Example Scenario

Issue: A compromised email account sent spam.
Action Taken:
- Disabled the account and reset the password.
- Scanned the server with ClamAV and removed malware.
- Implemented SPF, DKIM, and DMARC.
Delisting Request:
- Submitted evidence to Spamhaus and provided clean mail server logs.

By scanning for malware and compromised accounts, securing your server, and implementing authentication, you can clean up your server and ensure your IP or domain is delisted from SpamRL.

SpamRL Delist: How to Scan for Malware or Compromised Accounts

Malware Scanning on Your Server

Install and Use ClamAV

Scan for Suspicious Scripts

Use Online Scanners for Websites

Checking for Compromised Email Accounts

Analyze Email Logs

Identify the Top Email Senders

Disable Compromised Accounts

Verify Your Email Server Configuration

Check for Open Relays

Review Authentication Logs

Securing Your Server and Accounts

Update Software

Enforce Strong Passwords

Limit Email Sending

Monitor Traffic

Preventive Measures

Set Up Email Authentication

Scan Regularly

Monitor Reputation

Tools to Help with Scanning

Delisting After Cleanup

Re-check Reputation

Submit a Delisting Request

Monitor for Recurrence

Example Scenario

Hosting

Cloud Solutions

For You

VDS

Website Builders

Our services

Client Area

SpamRL Delist: How to Scan for Malware or Compromised Accounts

Malware Scanning on Your Server

Install and Use ClamAV

Scan for Suspicious Scripts

Use Online Scanners for Websites

Checking for Compromised Email Accounts

Analyze Email Logs

Identify the Top Email Senders

Disable Compromised Accounts

Verify Your Email Server Configuration

Check for Open Relays

Review Authentication Logs

Securing Your Server and Accounts

Update Software

Enforce Strong Passwords

Limit Email Sending

Monitor Traffic

Preventive Measures

Set Up Email Authentication

Scan Regularly

Monitor Reputation

Tools to Help with Scanning

Delisting After Cleanup

Re-check Reputation

Submit a Delisting Request

Monitor for Recurrence

Example Scenario

Hosting

Cloud Solutions

For You

VDS

Website Builders

Our services

Client Area

Выберите валюту