{"id":371,"date":"2026-09-19T11:37:03","date_gmt":"2026-09-19T11:37:03","guid":{"rendered":"https:\/\/rbl.watch\/blog\/cpanel-exim-spam-tespiti\/"},"modified":"2026-09-19T11:37:03","modified_gmt":"2026-09-19T11:37:03","slug":"cpanel-exim-spam-tespiti","status":"publish","type":"post","link":"https:\/\/rbl.watch\/blog\/cpanel-exim-spam-tespiti\/","title":{"rendered":"cPanel ve Exim&#8217;de Spam Script&#8217;ini Bulma"},"content":{"rendered":"\n<div style=\"border-left:4px solid #f59e0b;background:#fffbeb;padding:14px 18px;border-radius:8px;margin:0 0 8px;\">\n<strong>\u26a0\ufe0f \u00d6nce \u015funu bilin:<\/strong> Kara listeden <strong>\u00e7\u0131karma talebi son ad\u0131md\u0131r.<\/strong> Script&#8217;i silmeden \u00e7\u0131karma istemek IP&#8217;nizi hemen yeniden listeler ve self-service \u00e7\u0131karma hakk\u0131n\u0131z\u0131 yakar. \u00d6nce kayna\u011f\u0131 kapat\u0131n. Bkz. <a href=\"\/blog\/delist-oncesi-kontrol-listesi\/\">\u00e7\u0131karma \u00f6ncesi kontrol listesi<\/a>.\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Payla\u015f\u0131ml\u0131 hostingde spam kayna\u011f\u0131 genelde ele ge\u00e7irilmi\u015f bir e-posta hesab\u0131 de\u011fil, <strong>istismar edilen bir PHP dosyas\u0131d\u0131r.<\/strong> Exim&#8217;in <code>cwd=<\/code> (current working directory) alan\u0131, mailin hangi dizinden tetiklendi\u011fini do\u011frudan verir \u2014 bu, setin en y\u00fcksek isabetli tekni\u011fidir. Platform emin de\u011filseniz <a href=\"\/blog\/sunucudan-spam-tespiti\/\">te\u015fhis ak\u0131\u015f\u0131na<\/a> bak\u0131n (cPanel portlar\u0131: 2083\/2087, DirectAdmin: 2222 \u2014 o da Exim tabanl\u0131d\u0131r, ayn\u0131 komutlar ge\u00e7erlidir).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">cwd= Y\u00f6ntemi: Mail Hangi Dizinden \u00c7\u0131k\u0131yor?<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Mail hangi dizinden \u00e7\u0131k\u0131yor \u2014 istismar edilen script'i bar\u0131nd\u0131ran dizini bulur\ngrep cwd \/var\/log\/exim_mainlog | grep -v \/var\/spool \\\n  | awk -F'cwd=' '{print $2}' | awk '{print $1}' \\\n  | sort | uniq -c | sort -n | tail<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u00c7\u0131kt\u0131n\u0131n en \u00fcst\u00fcnde beliren dizin (\u00f6r. <code>\/home\/kullanici\/public_html\/wp-content\/uploads<\/code>) su\u00e7lunun bulundu\u011fu klas\u00f6rd\u00fcr. <code>\/var\/spool<\/code> sat\u0131rlar\u0131 normal kuyruk i\u015flemidir, o y\u00fczden elenir.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kuyruk Analizi<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Kuyruk b\u00fcy\u00fckl\u00fc\u011f\u00fc ve en \u00e7ok bekleyen alan adlar\u0131\nexim -bpc\nexim -bp | exiqsumm | tail<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Bir Mesaj\u0131n Ba\u015fl\u0131\u011f\u0131ndan Script Yolu (X-PHP-Script)<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code># Bir mesaj\u0131n ba\u015fl\u0131klar\u0131ndan script yolunu oku\nexim -Mvh &lt;mesaj-id&gt;\n# \u00c7\u0131kt\u0131da X-PHP-Script ba\u015fl\u0131\u011f\u0131, maili \u00fcreten dosyan\u0131n tam yolunu verir<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Kritik Ad\u0131m: Dosyay\u0131 Daraltma (cwd&#8217;den Sonra)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00c7o\u011fu rehber <code>cwd=<\/code> komutunu verip b\u0131rak\u0131r. As\u0131l i\u015f, o dizindeki <strong>hangi dosyan\u0131n<\/strong> sorumlu oldu\u011funu bulmakt\u0131r. \u0130ki sinyali birle\u015ftirin:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># 1) \u015e\u00fcpheli dizinde son de\u011fi\u015fen PHP dosyalar\u0131 (arka kap\u0131 s\u0131k s\u0131k yeni\/de\u011fi\u015fmi\u015ftir)\nfind \/home\/kullanici\/public_html -name '*.php' -mtime -3 \\\n  -printf '%TY-%Tm-%Td %TH:%TM  %p\\n' | sort\n\n# 2) Apache eri\u015fim logu: o script'e hangi IP, ne zaman POST atm\u0131\u015f\ngrep 'supheli-dosya.php' \/home\/kullanici\/access-logs\/* | grep POST | tail<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Dosya de\u011fi\u015fiklik zaman\u0131 ile Apache POST kayd\u0131n\u0131n \u00e7ak\u0131\u015ft\u0131\u011f\u0131 an, arka kap\u0131n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 and\u0131r. Bu iki sinyal, do\u011fru dosyay\u0131 neredeyse kesin bi\u00e7imde i\u015faret eder.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">WHM Taraf\u0131<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Mail Delivery Reports:<\/strong> WHM \u00fczerinden hangi hesab\u0131n ne kadar mail g\u00f6nderdi\u011fini raporlar.<\/li>\n<li><strong>Saatlik g\u00f6nderim limitleri (Max hourly emails):<\/strong> Hesap ba\u015f\u0131na limit koyarak tek bir sitenin IP&#8217;yi bat\u0131rmas\u0131n\u0131 \u00f6nleyin.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">S\u0131ralama Uyar\u0131s\u0131: \u00d6nce Script, Sonra Kuyruk<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u0130stismar edilen script&#8217;i silmeden kuyru\u011fu temizlerseniz, script \u00e7al\u0131\u015fmaya devam etti\u011fi i\u00e7in kuyruk yeniden dolar. <strong>Do\u011fru s\u0131ra:<\/strong> (1) script&#8217;i sil\/karantinaya al, (2) hesab\u0131n parolas\u0131n\u0131 de\u011fi\u015ftir, (3) sonra kuyru\u011fu temizle.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Temiz ve limitli bir g\u00f6nderim ortam\u0131 i\u00e7in <a href=\"https:\/\/www.ihs.com.tr\/web-hosting\/cpanel-hosting.html\" target=\"_blank\" rel=\"noopener\">y\u00f6netilen cPanel hosting<\/a> \u00e7\u00f6z\u00fcmleri saatlik limit ve tarama katmanlar\u0131n\u0131 haz\u0131r sunar. PHP kaynakl\u0131 g\u00f6nderimin derinlemesine tespiti i\u00e7in <a href=\"\/blog\/php-mail-spam-tespiti\/\">PHP mail() spam<\/a> makalesine bak\u0131n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kaynak Kapand\u0131 m\u0131? Son Kontrol<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2610 <code>cwd=<\/code> ile bulunan dizindeki zararl\u0131 dosya silindi\/karantinada<\/li>\n<li>\u2610 \u0130lgili hesab\u0131n parolas\u0131 de\u011fi\u015fti, eklentiler\/CMS g\u00fcncellendi<\/li>\n<li>\u2610 Kuyruk (<code>exim -bpc<\/code>) temizlendi<\/li>\n<li>\u2610 Hesap ba\u015f\u0131na saatlik g\u00f6nderim limiti WHM&#8217;de ayarland\u0131<\/li>\n<li>\u2610 IP yeni tespit alm\u0131yor \u2014 <a href=\"\/blacklist-check\">kontrol edin<\/a>, sonra <a href=\"\/blog\/delist-oncesi-kontrol-listesi\/\">\u00e7\u0131karmay\u0131 de\u011ferlendirin<\/a><\/li>\n<\/ul>\n\n","protected":false},"excerpt":{"rendered":"<p>\u26a0\ufe0f \u00d6nce \u015funu bilin: Kara listeden \u00e7\u0131karma talebi son ad\u0131md\u0131r. Script&#8217;i silmeden \u00e7\u0131karma istemek IP&#8217;nizi hemen yeniden listeler ve self-service \u00e7\u0131karma hakk\u0131n\u0131z\u0131 yakar. \u00d6nce kayna\u011f\u0131 kapat\u0131n. Bkz. \u00e7\u0131karma \u00f6ncesi kontrol listesi. Payla\u015f\u0131ml\u0131 hostingde spam kayna\u011f\u0131 genelde ele ge\u00e7irilmi\u015f bir e-posta hesab\u0131 de\u011fil, istismar edilen bir PHP dosyas\u0131d\u0131r. Exim&#8217;in cwd= (current working directory) alan\u0131, mailin hangi &#8230; <a title=\"cPanel ve Exim&#8217;de Spam Script&#8217;ini Bulma\" class=\"read-more\" href=\"https:\/\/rbl.watch\/blog\/cpanel-exim-spam-tespiti\/\" aria-label=\"Read more about cPanel ve Exim&#8217;de Spam Script&#8217;ini Bulma\">Devam\u0131n\u0131 oku<\/a><\/p>\n","protected":false},"author":2,"featured_media":372,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-371","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nasil-yapilir"],"_links":{"self":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts\/371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/comments?post=371"}],"version-history":[{"count":0,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts\/371\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/media\/372"}],"wp:attachment":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/media?parent=371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/categories?post=371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/tags?post=371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}