Portal Home > Knowledgebase > Articles Database > Spammer domain points to newly assigned IP address
Spammer domain points to newly assigned IP address
| Posted by cuantica, 08-23-2012, 07:22 PM |
| Hello, I got some new IP addresses pointed to one of my servers.
One domain from previous host still points to this IP address and
MX records that were reported by its nameservers are:
10 finance.mygeniuneproducts.com xx.9.244.xxx (no glue)
So I am receiving a lot of connections from other servers intented for this domain and lots of responses from Exim saying
lowest numbered MX record points to local host
I think it might be a spammer domain due to the large ammount of connections killing the server performance.
Is it possible to drop connections intented to this domain name?
|
| Posted by N402KC, 08-23-2012, 11:39 PM |
| Eek, I wonder if you can just nullroute the IP. I mean that sounds visceral, but thats my 2centz
|
| Posted by cuantica, 08-24-2012, 02:15 AM |
| Hello N402KC, that is possible. But considering I have added the IP address to use on some website it would be no good idea
|
| Posted by Hillockhosting, 08-24-2012, 09:16 AM |
| You can just install csf firewall and block the excessive connections making IP or second in set in WHM to reject them
|
| Posted by racknap1, 08-24-2012, 11:49 AM |
| Hi,
you may need to check your exim concurrent connections by running :-
tail -1000 /var/log/exim_mainlog |grep \[' |cut -d[ -f2 |cut -d] -f1|sort -n |uniq -c |sort -n
and find out that ip and block it under :-
csf -d xx.xx.xx.xx
csf -r
Hope this will work.
|
Add to Favourites 
Print this Article
Also Read
Shared Hosting
Shared Hosting
