[alancb]

Achei muito interessante

http://www.howtoforge.com/how-to-log-email...etect-form-spam


Tou testando aqui pra ver se funciona, alguem mais disposto pra ver se vai?

[Yuri]

Para quem tem interesse o CSF faz algo parecido, você configura um número de mensagens como por exemplo 100 e se um script ou formulário enviar mais que 100 mensagens ele envia um email alertando informando usuário, os logs dos envios do exim e possíveis arquivos que podem estar enviando as mensagens, se quiser pode configurar para o csf dar chmod 0 no arquivo que fez o envio

Encontre a parte abaixo na configuração do CSF siga as instruções que funciona.

# Enable scanning of the exim mainlog for repeated emails sent from scripts.
# To use this feature you must add an extended email logging line to WHM >
# Exim Configuration Editor > Switch to Advanced Mode > in the first textbox
# add the following line (without the preceding #):
#
# log_selector = +arguments +subject +received_recipients
#
# If you already use extended exim logging, then you need to either include
# +arguments +received_recipients or use +all
#
# This setting will then send an alert email if more than LF_SCRIPT_LIMIT lines
# appear with the same cwd= path in them within an hour. This can be useful in
# identifying spamming scripts on a server, especially PHP scripts running
# under the nobody account. The email that is sent includes the exim log lines
# and also attempts to find scripts that send email in the path that may be the
# culprit
LF_SCRIPT_ALERT = Default: 0

# The limit afterwhich the email alert for email scripts is sent. Care should
# be taken with this value if you allow clients to use web scripts to maintain
# pseudo-mailing lists which have large recipients
LF_SCRIPT_LIMIT = Default: 100

# If this option is enabled, the directory identified by LF_SCRIPT_ALERT will
# be chmod 0 and chattr +i to prevent it being accessed. Set the option to 1
# to enable.
#
# WARNING: This option could cause serious system problems if the identified
# directory is within the OS directory hierarchy. For this reason we do not
# recommend enabling it unless absolutely necessary.
LF_SCRIPT_PERM = Default: 0