We have a CentOS server, running Sendmail and ISPConfig as the panel. We recently noticed a huge increase in traffic coming from a phoney yahoo account. The logs show hundreds of emails being sent in a short time.
We are trying to isolate the script, but we have multiple sites running and don't know where to look first.
-- Since there have been no results, I assume either people don't know, it's never going to be easy or I'm not supplying enough information.
We have tried searching the files on the server for '@yahoo' and similar, but there's a chance it's getting the email address from an external site or file. Can we easily determine any references to external files? We use internal .js files for everything, so there shouldn't be too many of them.
or any other idea..