Proxies Used to Spam

**zxpro168** · Jun 27th, 2007, 8:42 am

I would like some advice on this. Last week, spamcop sent messages to our datacentre saying that one of our servers was sending out spam. However, we could not detect any abnormal activity on that server.

We then turned the proxies on that server off and the spam complaints stopped immediately. It seems that the spam itself is not sent from our server, but someone is using the proxies to control another spam server.

I wonder if anyone has any experiences with this? How does this spamming actually work and what can we do about this?

-Derek

**grim** · Jun 27th, 2007, 8:54 am

I lost a server to it.
From what I know the proxies did not actually send the spam, the spammer used the proxy to login to a third party email server and send the spam. Bellsouth.net is the main culprit 'third party email' you can block it but there are others they will hit.

**zxpro168** · Jun 29th, 2007, 5:06 am

Thanks Grim. I wonder why would the ip of our server be reported rather the ip of the spam mail server?

**Zap** · Jun 29th, 2007, 6:12 am

Originally Posted by zxpro168

Thanks Grim. I wonder why would the ip of our server be reported rather the ip of the spam mail server?

In an attempt to save themselves, the spam server may have turned their logs (containing your proxies) over to Spamcop.

**grim** · Jun 29th, 2007, 8:38 am

Bellsouths headers have an issue from what I read, it reports the users IP as well as theirs. So instead of them being in trouble and fixing the security issue the proxy host gets hit 'from my understanding'

**zxpro168** · Jul 6th, 2007, 9:39 am

Thanks for your input. At the beginning of this month, I transferred the proxies out to hagiohost. On the 5th day, I was given a warning notice that my account was approaching the bandwidth limit. This is rather surprising to me as their claimed bandwidth usage was nearly 4 times as indicated in cpanel.

I have decided to switch them back to my own servers, but I am using

EmbedProxies.com

for most of them. That means that no proxy script is hosted on my servers. I will be interesting to see whether revenue will be affected. So far after 4 months, I have not yet experienced the Google slap.

-Derek