[Solved] Suspended: Lladnar

[lladnar]

Hi I've been suspended and no idea why.

[wolstech]

You were suspended for spam. Below is the abuse report relating to your account.

We have received a complaint about your account. Please investigate and fix within 24 hours.

Hurricane Electric Abuse Department
support@he.net

From scomp@aol.net  Sat Jul 30 14:28:06 2016
Return-Path: <scomp@aol.net>
X-Original-To: report@abuse.he.net
Delivered-To: report@abuse.he.net
Received: from smr-a02.mx.aol.com (smr-a02e.mx.aol.com [204.29.186.244])
        by abuse.he.net (Postfix) with ESMTPS id BF9085401DE
        for <report@abuse.he.net>; Sat, 30 Jul 2016 14:28:06 -0700 (PDT)
Received: from scmp-d012.mail.aol.com (scmp-d012.mail.aol.com [172.29.189.81])
        by smr-a02.mx.aol.com (AOL Mail Bouncer) with ESMTP id 2042E380008A
        for <report@abuse.he.net>; Sat, 30 Jul 2016 17:28:05 -0400 (EDT)
Received: from scomp@aol.net by scmp-d012.mail.aol.com; Sat, 30 Jul 2016 17:28:00 EDT
To: report@abuse.he.net
From: scomp@aol.net
Date: Sat, 30 Jul 2016 17:28:00 EDT
Subject: Email Feedback Report for IP 65.19.143.2
MIME-Version: 1.0
Content-Type: multipart/report; report-type=feedback-report; boundary="boundary-1138-29572-2659438-15433"
X-AOL-INRLY: stevie.heliohost.org [65.19.143.2] scmp-d012
X-Loop: scomp

--boundary-1138-29572-2659438-15433
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

This is an email abuse report for an email message with the message-id of 579C235B.6F1B272C@lladnar.com received from IP address 65.19.143.2 on Sat, 30 Jul 2016 07:00:06 -0400 (EDT)

For information, please review the top portion of the following page:
http://postmaster.aol.com/Postmaster.FeedbackLoop.php

For information about AOL E-mail guidelines, please see
http://postmaster.aol.com/Postmaster.Guidelines.php

If you would like to cancel or change the configuration for your FBL please use the tool located at:
http://postmaster.aol.com/SupportRequest.FBL.php


--boundary-1138-29572-2659438-15433
Content-Disposition: inline
Content-Type: message/feedback-report

Feedback-Type: abuse
User-Agent: AOL SComp
Version: 0.1
Received-Date: Sat, 30 Jul 2016 07:00:06 -0400 (EDT)
Source-IP: 65.19.143.2
Reported-Domain: stevie.heliohost.org
Redacted-Address: redacted
Redacted-Address: redacted@


--boundary-1138-29572-2659438-15433
Content-Type: message/rfc822
Content-Disposition: inline

Return-Path: <lladnar@lladnar.com>
Received: from stevie.heliohost.org (stevie.heliohost.org [65.19.143.2])
        (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
        (No client certificate requested)
        by mtaig-mcc02.mx.aol.com (Internet Inbound) with ESMTPS id A160C700000A2
        for <redacted>; Sat, 30 Jul 2016 07:00:06 -0400 (EDT)
Received: from [188.24.197.221] (port=39014 helo=[127.0.0.1])
        by stevie.heliohost.org with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256)
        (Exim 4.82)
        (envelope-from <lladnar@lladnar.com>)
        id 1bTRoM-0005SV-6t; Sat, 30 Jul 2016 03:47:40 -0700
Message-ID: <579C235B.6F1B272C@lladnar.com>
Date: Sat, 30 Jul 2016 03:47:41 -0700
From: "Little Miss" <lladnar@lladnar.com>
Subject: Yo
To: redacted@yahoo.com, redacted@gmail.com, redacted@gmail.com
 redacted@live.it, redacted@yahoo.com, redacted@aol.com
 redacted@gmail.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - stevie.heliohost.org
X-AntiAbuse: Original Domain - aol.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - lladnar.com
X-Get-Message-Sender-Via: stevie.heliohost.org: authenticated_id: lladnar@lladnar.com
X-Source:
X-Source-Args:
X-Source-Dir:
x-aol-global-disposition: G
Authentication-Results: mx.aol.com;
        spf=none (aol.com: the domain lladnar.com appears to have no SPF Record.) smtp.mailfrom=lladnar.com;
x-aol-sid: 3039ac1afd42579c88b619c2
X-AOL-IP: 65.19.143.2
X-AOL-SPF: domain : lladnar.com SPF : none

105lb college freaky girl  lookin for a fling nothing else 1-570-919=
-0385 is my num for pics if youre into nerdy girls 


--boundary-1138-29572-2659438-15433--

[lladnar]

someone has hacked my site then i'm not doing this. the site wasn't even functional due to drupal errors. how to proceed?

[wolstech]

I can unsuspend the site for you, however we only give you one chance to fix spam. If we receive another complaint, you will be permanently suspended.

 

Odds are the spam is being caused by malware on your site or a compromised email account. I would recommend deleting everything on your account, changing your passwords, then rebuilding your site using known-clean software. Note that many "free themes" and similar content from dubious websites, especially those made for WordPress and Joomla, have backdoors in them. Drupal is likely similar in this respect.

 

Are you ready to fix your account?

[lladnar]

no, i have to step out right now and want to take care of all that first. will just wipe out everything since i'm going to rebuild the site from scratch. havent made any changes in a long time on the site so i doubt it's a back door, probably email got hacked, so i'll have to change all those passes too. will post again when ready.

[lladnar]

ok i'm ready to wipe the site

[Krydos]

Your account has been unsuspended. Be sure to fix it quickly before more spam gets sent.

[lladnar]

thanks. doing it now

changed email passes to 100% strength and cleared out www folder, having issues deleting two php settings files from drupal in the www folder, getting permission denied, tried enabling write, still couldn't delete

[Krydos]

having issues deleting two php settings files from drupal in the www folder, getting permission denied, tried enabling write, still couldn't delete

Deleted.

[lladnar]

My web folders have been empty since your last post and I used a random character generator to make new email account passwords that yielded 100% security strength on cpanel (and haven't sent any email), yet I once again cannot access my site. Has it been suspended/banned again?

[wolstech]

No, the server is down.

 

See http://www.helionet.org/index/topic/26650-stevie-down/?view=getnewpost

[lladnar]

oh crap, lol, that would explain why the password reset email for my acct never came in.