evet. bu şekilde bir içerik var. benim sorum da şu: o formu nasıl bulabilirim.

sen gönderdin demiyor bu ip den gönderildiği için kara listeye düşmüş diyor ttnet ile görüştün mü bu konuyu?

Bildiğim konuyu bana da unutturdu. Neler yazıyor çevirebilecek var mı?

şu an mail gönderemiyoruz. cbl spamlistteyiz.

bana sonuçla gel değiştirdiniz ve hala devam ediyor mu sorun?

sunucu ip'sini değiştirdik.

statik ip kullanıyorsan ttnet in acizliğine uğramış olabilirsin blackliste alınan bir ip denk gelmişse uğraştırır ttnet ile görüşmen gerekir bir de şu adres var inceleyebilirsin By

Maillerimiz sürekli spam liste düşmekteydi. biz manuel olarak listeden çıkarıyorduk fakat artık aşağıdaki uyarıyı veriyor 48 saat beklememizi söylüyor. anladığım kadarıyla sunucumuzun içerisindeki dosyalardan biri zararlı bir içerik içeriyor. social png dosyası ile de bir bağlantısı var gibi duruyor. Sorunu nasıl çözebilirim. IP Address xx. xx. xx. xx is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet. It was last detected at 2015-03-17 08:00 GMT (+/- 30 minutes), approximately 3 hours ago. It has been relisted following a previous removal at 2015-03-14 09:27 GMT (3 days, 1 hours, 13 minutes ago) Due to how these infections are being delisted without being corrected, you cannot delist this IP address until there's been at least 48 hours of no-relisting. The host at this IP address is infected with the CryptPHP PHP malware. CryptoPHP is a threat that uses backdoored Joomla, WordPress andn Drupal themes and plug-ins to compromise webservers on a large scale. More information about this threat can be found on the referenced link below. Fox-IT: CryptoPHP - Analysis of a hidden threat inside popular content management systems Attackers Using Compromised Web Plug-Ins in CryptoPHP Blackhat SEO Campaign This infection almost certainly means that the infected web site has used pirated plugins from the nulledstylez.com, dailynulled.com sites or some other site that specializes in providing "nulled" software. Fox-IT's research has shown that every pirated theme or plug-in on these two sites has been infested with the cryptophp malware. This was detected by a TCP connection from xx. xx. xx. xx on port 59880 going to IP address 192.42.116.41 on port 80. The botnet command and control domain for this connection was "ergofilling.com". Behind a NAT, you should be able to find the infected machine by looking for attempted connections to IP address 192.42.116.41 or host name ergofilling.com on any port with a network sniffer such as wireshark or by configuring the router to block and log such connections. Equivalently, you can examine your DNS server or proxy server logs to references to 192.42.116.41 or ergofilling.com. See Advanced Techniques for more detail on how to use wireshark - ignore the references to port 25/SMTP traffic - the identifying activity is NOT on port 25. This detection corresponds to a connection at 2015-03-17 07:55:22 . Fox-IT has published a new blog item on this infection. Fox-IT has written two Python scripts that should be very good at finding these infections: check_url. py and check_filesystems. py. The first script scans a web site to find the infection, the second is used for scanning the web site's filesystem to find the infection. Please go to the above Fox-IT link to obtain these scripts and further instructions. Fox-IT recommends that you should NOT try to "repair" the infection. The infected account should be reinstalled from scratch. I shall repeat the previous paragraph: removing the "social. png" file DOES NOT remove the infection. "social. png" is only just one small piece of it. The infected account should be reinstalled from scratch. This listing cannot be delisted until at least 48 hours (2 days) have elapsed from the last listing. In 2 days from the above listing timestamp, come back here and you'll be able to delist this IP. Delisting inhibited Follow the above instructions to get it delisted. Hepsini görmek için tıklayın... -

gelen tüm mailler mi spam kutusuna düşüyor anlamadım daha açıklayıcı bilgi verebilir misin? soru sordurtmayın bi kere de yav

By özetle diyor ki ip adresi cbl de karalisteye düşmüş trojan gönderen spam, proxy veya diğer botnet formlarından olabilirmiş kullanılan ip adresten cryptphp php malware gönderilmiş sonrasında çözüm yolları sunmuş