server sending lot of mail, but unknow from which user

seachen · May 13, 2010

may i know how to check which user is spamming from server?

I check the message content, it is as below:

Email Headers

1OCgCr-0004cT-I0-H
mail 8 12
<[email protected]>
1273787077 0
-helo_name dnjrtu.com
-host_address 59.35.98.71.3873
-host_auth login
-interface_address 124.217.246.223.25
-received_protocol esmtpa
-body_linecount 37
-max_received_linelength 86
-auth_id power
-host_lookup_failed
XX
1
[email protected]

223P Received: from [59.35.98.71] (helo=dnjrtu.com)
by vps2208.surpassdns.com with esmtpa (Exim 4.69)
(envelope-from <[email protected]>)
id 1OCgCr-0004cT-I0
for [email protected]; Fri, 14 May 2010 05:44:42 +0800
080I Message-ID: <7cc76a4fee3441ec8ae51d5233c40ee7@65708b21f38f47968b1002cd26244a10>
036 Date: Thu, 13 May 2010 21:40:45 GMT
018 Mime-Version: 1.0
051 X-mailer: Microsoft Outlook Express 6.00.3790.4286
014 X-Priority: 3
087F From: =?utf-8?B?IOiqsOeahOWls+WPi+aAp+aEm+W9seeJhyBRRFdQSQ==?= <[email protected]>
029T To: [email protected]
041 Subject: =?BIG5?B?RlehRzY5MDI2fkVDQ1E=?=
103 Content-Type: multipart/alternative;
boundary="=====003_Dragon75fd0d1e51a649db9be7c2ed36c84b82_====="

E-Mail Body Chunk

1OCgCr-0004cT-I0-D
--=====003_Dragon75fd0d1e51a649db9be7c2ed36c84b82_=====
Content-Type: text/plain;
charset="BIG5"
Content-Transfer-Encoding: quoted-printable

--=====003_Dragon75fd0d1e51a649db9be7c2ed36c84b82_=====
Content-Type: text/html;
charset="BIG5"
Content-Transfer-Encoding: quoted-printable

<html>=0D=0A=0D=0A<head>=0D=0A<meta=20name=3D"GENERATOR"=20content=3D"Micros=
oft=20FrontPage=205.0">=0D=0A<meta=20name=3D"ProgId"=20content=3D"FrontPage.=
Editor.Document">=0D=0A<meta=20http-equiv=3D"Content-Type"=20content=3D"text=
/html;=20charset=3Dbig5">=0D=0A<title>hBfR=20TBb=20eHNH=20jUMdJ還&#x5f=
88;嫩的女學生下課被拖&=
#x53bb;強姦中出LZVMV=20dDN=20mfAO=20gNT</title>=0D=0A=
</head>=0D=0A=0D=0A<body>=0D=0A=0D=0A<p=20align=3D"center">=0D=0A<font=20fac=
e=3D"=BC=D0=B7=A2=C5=E9"=20size=3D"6">=0D=0A<a=20href=3D"http://x4tsehxdbs.q=
fdvlv.cn#@.auhldusrhf.com"=20style=3D"text-decoration:=20none">=0D=0A<font=20=
color=3D"#FFFFFF">sKX=20JVAi=20GLuPgzEc=20vFvzmQN=20LgJBK=20sjtDaRMXz=20IXOn=
=20IxthoV =0D=0A<font=20color=3D"#FF0000">還很嫩=
的女學生下課被拖去&#24=
375;姦中出 =0D=0A<font=20color=3D"#FFFFFF">ovCCy=
=20qHpqZSN=20gkDIUWAr=20hWscxTH=20NXHL=20nXTBw=20qyadzMWpS=20rELnhSqI=
 =0D=0A<font=20color=3D"#FFFFFF">wKRinnqG=20wzvCV=20AJiaYSPY=20Zzcld=20fL=
wStDgJ=20WgbBSOI=20VNsODWN=20FAdNbuAm =0D=0A<font=20color=3D"#FFFF=
FF">BouEITiW=20KMVx=20RkQut=20OcyvjkTBErkkSN=20frTuRbV=20pmUkijVu=20AtD=20vI=
aOau =0D=0A<font=20color=3D"#FFFFFF">JMCgZg=20sOqlURFQ=20QaLsj=20K=
HTvXyurxm=20zTkqfZliZ=20rYJHQV=20PRSf=20qkEFSeYCoy =0D=0A</a>=0D=0A=
=0D=0A<font=20face=3D"=BC=D0=B7=A2=C5=E9">=0D=0A<a=20href=3D"http://6=
n7ehxdbs.334139.cn#@.chqcsxgbj.com">=0D=0A<font=20color=3D"#CC33FF"=20size=3D=
"6">我有興趣立即前往<=
/a><font=20color=3D"#FFFFFF">NHCiPUU=20kfwN=20gEy=20qbScPpgobaIcgWWm=20EfCM=20=
jZHE=20uXXECwTzz=20BEeZeBFMExbnDLUl =0D=0A</a> =0D=0A=
=A1@=0D=0A=0D=0A</body>=0D=0A=0D=0A</html>
--=====003_Dragon75fd0d1e51a649db9be7c2ed36c84b82_=====--

nobaloney · May 14, 2010

seachen said:
may i know how to check which user is spamming from server?

I check the message content, it is as below:

Code:

223P Received: from [59.35.98.71] (helo=dnjrtu.com) by vps2208.surpassdns.com with esmtpa (Exim 4.69) (envelope-from <[email protected]>)

The email appears to be coming from 59.35.98.71 (dnjrtu.com). Is that your server?

If not, then the mail is coming from someone logging in from that IP#.

Jeff

server sending lot of mail, but unknow from which user

seachen

Verified User

nobaloney

NoBaloney Internet Svcs - In Memoriam †