Results 1 to 7 of 7

Thread: Exim Sending Out Spam

  1. #1
    Join Date
    Nov 2010
    Posts
    44

    Exim Sending Out Spam

    I am seeing spam being sent out by Exim but I can't quite pinpoint where is the issue.

    2018-05-11 11:44:02 1fGyyQ-0002rk-10 <= 2945523201@qq.com H=(sxbxxh.org) [180.121.132.156] P=smtp S=1130 id=dfc43c40a87c2595eb7ff60118582090@qq.com T="11顶级博彩领袖!注册领18⒏綵金咨询企鹅专员【1991966418】王之【336468。com�" from <2945523201@qq.com> for Mailer-Daemon@server.hostname.com

    Any ideas how do I go about fixing this issue? Is this an issue with my Exim config?

  2. #2
    Join Date
    Feb 2008
    Location
    Québec, Canada
    Posts
    157
    I don't think the problem is the exim config... It's probably a compromised account on your server or something like this......

    Do you know witch account is the sender?

  3. #3
    Join Date
    Nov 2010
    Posts
    44
    I can't quite tell which account from the Exim log. What would be the best method to identify those emails?

  4. #4
    Join Date
    Feb 2008
    Location
    Québec, Canada
    Posts
    157
    Start by looking who is in the top 5 senders:

    grep "<=.*P=local" /var/log/exim/mainlog | awk '{print $6}' | sort | uniq -c | sort -nr | head -5
    Check top sending path
    grep cwd /var/log/exim/mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

  5. #5
    Join Date
    Nov 2010
    Posts
    44
    It seems that the 2 of the top 3 senders are 'root' and 'diradmin' users.

    The top 3 sending paths are:
    1239 /usr/local/directadmin
    2183 /
    3473 /etc/csf

    The top sender seems weird.

  6. #6
    Join Date
    Feb 2008
    Location
    Québec, Canada
    Posts
    157
    Hi,

    add me on skype (webalternativeorg) and I will be happy to take a look if you give me some access to the server..

    Regards,
    - Web Alternative
    - DirectAdmin Hosting - DirectAdmin Reseller Hosting - Managed VPS

  7. #7
    Join Date
    Nov 2010
    Posts
    44
    Quote Originally Posted by webaltern View Post
    Hi,

    add me on skype (webalternativeorg) and I will be happy to take a look if you give me some access to the server..

    Regards,
    Thanks, I will add you on Skype.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •