{"id":379,"date":"2026-09-19T11:37:43","date_gmt":"2026-09-19T11:37:43","guid":{"rendered":"https:\/\/rbl.watch\/blog\/php-mail-spam-tespiti\/"},"modified":"2026-09-19T11:37:43","modified_gmt":"2026-09-19T11:37:43","slug":"php-mail-spam-tespiti","status":"publish","type":"post","link":"https:\/\/rbl.watch\/blog\/php-mail-spam-tespiti\/","title":{"rendered":"PHP mail() ile G\u00f6nderilen Spam Nas\u0131l Bulunur?"},"content":{"rendered":"\n<div style=\"border-left:4px solid #f59e0b;background:#fffbeb;padding:14px 18px;border-radius:8px;margin:0 0 8px;\">\n<strong>\u26a0\ufe0f \u00d6nce \u015funu bilin:<\/strong> Kara listeden <strong>\u00e7\u0131karma talebi son ad\u0131md\u0131r.<\/strong> Arka kap\u0131y\u0131 silmeden \u00e7\u0131karma istemek IP&#8217;nizi hemen yeniden listeler ve self-service \u00e7\u0131karma hakk\u0131n\u0131z\u0131 yakar. Bkz. <a href=\"\/blog\/delist-oncesi-kontrol-listesi\/\">\u00e7\u0131karma \u00f6ncesi kontrol listesi<\/a>.\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Spam kayna\u011f\u0131 mail sunucusunda de\u011fil <strong>web sunucusunda<\/strong> oldu\u011funda, mail loglar\u0131 tek ba\u015f\u0131na yetmez: PHP&#8217;nin <code>mail()<\/code> fonksiyonuyla g\u00f6nderilen postalar \u00e7o\u011fu zaman kimlik do\u011frulamas\u0131 olmadan \u00e7\u0131kar ve log&#8217;da g\u00f6nderen script g\u00f6r\u00fcnmez. Bu makale, platformlar aras\u0131 bu kesi\u015fen sorunu \u2014 istismar edilmi\u015f bir PHP dosyas\u0131n\u0131 \u2014 nas\u0131l bulaca\u011f\u0131n\u0131z\u0131 anlat\u0131r. Genel ak\u0131\u015f i\u00e7in <a href=\"\/blog\/sunucudan-spam-tespiti\/\">te\u015fhis rehberine<\/a>, Exim&#8217;e \u00f6zg\u00fc <code>cwd=<\/code> y\u00f6ntemi i\u00e7in <a href=\"\/blog\/cpanel-exim-spam-tespiti\/\">cPanel\/Exim<\/a> makalesine bak\u0131n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u00d6nce Sinyali A\u00e7\u0131n: mail.log ve X-PHP-Originating-Script<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP, her <code>mail()<\/code> \u00e7a\u011fr\u0131s\u0131n\u0131 (ve onu tetikleyen script&#8217;i) kaydedebilir; ama bu genelde kapal\u0131d\u0131r. \u0130ki katman\u0131 a\u00e7\u0131n:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># php.ini i\u00e7inde PHP'nin mail \u00e7a\u011fr\u0131lar\u0131n\u0131 kaydetmesi i\u00e7in:\nmail.log = \/var\/log\/php-mail.log\n# (mail.add_x_header = On ile de ba\u015fl\u0131klara script bilgisi eklenir)<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Postfix taraf\u0131nda ise <code>header_checks<\/code> ile <code>X-PHP-Originating-Script<\/code> (veya <code>X-PHP-Script<\/code>) ba\u015fl\u0131\u011f\u0131n\u0131 loglayarak, hangi dosyan\u0131n mail \u00fcretti\u011fini kal\u0131c\u0131 bi\u00e7imde kay\u0131t alt\u0131na alabilirsiniz. Bu iki ayar\u0131 \u00f6nceden kurmak, bir sonraki olayda te\u015fhisi dakikalara indirir.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Son De\u011fi\u015fen Dosyalardan \u015e\u00fcpheliyi Daraltma<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Arka kap\u0131lar (backdoor \/ mailer script) genelde yeni y\u00fcklenmi\u015f ya da yak\u0131n zamanda de\u011fi\u015ftirilmi\u015ftir. Arka kap\u0131 av\u0131n\u0131n ba\u015flang\u0131c\u0131:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Son 2 g\u00fcnde de\u011fi\u015fen PHP dosyalar\u0131 \u2014 arka kap\u0131 av\u0131n\u0131n ba\u015flang\u0131c\u0131\nfind \/var\/www -name '*.php' -mtime -2 -printf '%TY-%Tm-%Td %TH:%TM  %p\\n' | sort\n\n# \u015e\u00fcpheli imzalar: base64\/eval ile gizlenmi\u015f kod\ngrep -RIl --include='*.php' -E 'eval\\(|base64_decode\\(|gzinflate\\(|str_rot13\\(' \/var\/www | head<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">WordPress \/ Joomla Eklenti \u0130stismar\u0131n\u0131n \u0130zleri<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>wp-content\/uploads<\/code> i\u00e7inde <strong>.php dosyas\u0131<\/strong> (uploads klas\u00f6r\u00fcnde normalde PHP olmaz \u2014 g\u00fc\u00e7l\u00fc \u015f\u00fcphe).<\/li>\n<li>Tema\/eklenti dizininde ada uymayan, rastgele isimli dosyalar.<\/li>\n<li>G\u00fcncel olmayan eklentiler ve <code>xmlrpc.php<\/code> \u00fczerinden k\u00f6t\u00fcye kullan\u0131m.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u0130leti\u015fim Formu K\u00f6t\u00fcye Kullan\u0131m\u0131 ile Ger\u00e7ek Arka Kap\u0131 Ayr\u0131m\u0131<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Her PHP kaynakl\u0131 spam bir arka kap\u0131 de\u011fildir. Me\u015fru bir <strong>ileti\u015fim\/kay\u0131t formunun<\/strong> k\u00f6t\u00fcye kullan\u0131lmas\u0131 da benzer g\u00f6r\u00fcn\u00fcr ama farkl\u0131 \u00e7\u00f6z\u00fcl\u00fcr: formun kayna\u011f\u0131 me\u015fru dosyad\u0131r, sorun eksik do\u011frulama (CAPTCHA\/rate limit) veya a\u00e7\u0131k y\u00f6nlendirmedir. Ger\u00e7ek arka kap\u0131 ise gizlenmi\u015f kod i\u00e7erir ve do\u011frudan g\u00f6nderim yapar. Apache eri\u015fim logunda o dosyaya gelen <code>POST<\/code> isteklerinin IP ve zaman desenine bakarak ikisini ay\u0131r\u0131n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kal\u0131c\u0131 Koruma<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Gerekmiyorsa PHP <code>mail()<\/code> fonksiyonunu kapat\u0131n (<code>disable_functions<\/code>).<\/li>\n<li>G\u00f6nderimi <strong>kimlik do\u011frulamal\u0131 SMTP<\/strong> \u00fczerinden zorunlu k\u0131l\u0131n (uygulama SMTP ile g\u00f6ndersin).<\/li>\n<li><code>uploads<\/code> gibi dizinlerde PHP \u00e7al\u0131\u015ft\u0131rmay\u0131 engelleyin (web sunucusu kural\u0131).<\/li>\n<li>CMS ve eklentileri g\u00fcncel tutun; bilinmeyen dosyalar\u0131 d\u00fczenli taray\u0131n.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">PHP uygulamalar\u0131n\u0131z\u0131 izole, g\u00fcncel ve taranan bir ortamda \u00e7al\u0131\u015ft\u0131rmak i\u00e7in <a href=\"https:\/\/www.ihs.com.tr\/web-hosting\/cpanel-hosting.html\" target=\"_blank\" rel=\"noopener\">y\u00f6netilen cPanel hosting<\/a> \u00e7\u00f6z\u00fcmleri malware tarama ve g\u00f6nderim limitlerini haz\u0131r sunar. Tekrar\u0131 \u00f6nlemek i\u00e7in <a href=\"\/blog\/spam-tekrarini-onleme\/\">kal\u0131c\u0131 \u00f6nlemler<\/a> makalesine bak\u0131n.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kaynak Kapand\u0131 m\u0131? Son Kontrol<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u2610 Zararl\u0131\/arka kap\u0131 PHP dosyas\u0131 silindi (yaln\u0131zca yeniden adland\u0131rma yetmez)<\/li>\n<li>\u2610 \u0130stismar edilen CMS\/eklenti g\u00fcncellendi, a\u00e7\u0131k kapat\u0131ld\u0131<\/li>\n<li>\u2610 mail.log ve X-PHP-Script loglamas\u0131 kal\u0131c\u0131 olarak a\u00e7\u0131k<\/li>\n<li>\u2610 <code>uploads<\/code> dizininde PHP \u00e7al\u0131\u015ft\u0131rma engellendi<\/li>\n<li>\u2610 Kuyruk temizlendi ve IP yeni tespit alm\u0131yor \u2014 <a href=\"\/blacklist-check\">kontrol edin<\/a>, sonra <a href=\"\/blog\/delist-oncesi-kontrol-listesi\/\">\u00e7\u0131karmay\u0131 de\u011ferlendirin<\/a><\/li>\n<\/ul>\n\n","protected":false},"excerpt":{"rendered":"<p>\u26a0\ufe0f \u00d6nce \u015funu bilin: Kara listeden \u00e7\u0131karma talebi son ad\u0131md\u0131r. Arka kap\u0131y\u0131 silmeden \u00e7\u0131karma istemek IP&#8217;nizi hemen yeniden listeler ve self-service \u00e7\u0131karma hakk\u0131n\u0131z\u0131 yakar. Bkz. \u00e7\u0131karma \u00f6ncesi kontrol listesi. Spam kayna\u011f\u0131 mail sunucusunda de\u011fil web sunucusunda oldu\u011funda, mail loglar\u0131 tek ba\u015f\u0131na yetmez: PHP&#8217;nin mail() fonksiyonuyla g\u00f6nderilen postalar \u00e7o\u011fu zaman kimlik do\u011frulamas\u0131 olmadan \u00e7\u0131kar ve log&#8217;da &#8230; <a title=\"PHP mail() ile G\u00f6nderilen Spam Nas\u0131l Bulunur?\" class=\"read-more\" href=\"https:\/\/rbl.watch\/blog\/php-mail-spam-tespiti\/\" aria-label=\"Read more about PHP mail() ile G\u00f6nderilen Spam Nas\u0131l Bulunur?\">Devam\u0131n\u0131 oku<\/a><\/p>\n","protected":false},"author":2,"featured_media":380,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-379","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nasil-yapilir"],"_links":{"self":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts\/379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/comments?post=379"}],"version-history":[{"count":0,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/posts\/379\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/media\/380"}],"wp:attachment":[{"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/media?parent=379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/categories?post=379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rbl.watch\/blog\/wp-json\/wp\/v2\/tags?post=379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}