Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Alright, I'm tired of spam being sent out from my server. I've installed CSF as a firewall and it keeps on saying Local Host Relay for user 127.0.0.1

Received: by 10.50.183.228 with SMTP id ep4csp81296igc;
        Tue, 21 Feb 2012 08:07:52 -0800 (PST)
Received: by 10.216.138.36 with SMTP id z36mr5848554wei.22.1329840472165;
        Tue, 21 Feb 2012 08:07:52 -0800 (PST)
Return-Path: <root@myhostname>
Received: from myhostname (myhostname. [109.236.81.230])
        by mx.google.com with ESMTPS id p27si18775372weq.52.2012.02.21.08.07.51
        (version=TLSv1/SSLv3 cipher=OTHER);
        Tue, 21 Feb 2012 08:07:52 -0800 (PST)
Received-SPF: pass (google.com: best guess record for domain of root@myhostname designates 109.236.81.230 as permitted sender) client-ip=109.236.81.230;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of root@myhostname designates 109.236.81.230 as permitted sender) smtp.mail=root@myhostname
Received: from root by myhostname with local (Exim 4.69)
    (envelope-from <root@myhostname>)
    id 1RzsFt-0000LJ-If
    for srivastava.akshay1@gmail.com; Tue, 21 Feb 2012 17:07:53 +0100
To: srivastava.akshay1@gmail.com
Subject: lfd on myhostname: LOCALHOSTRELAY Alert for 127.0.0.1
From:  <root@myhostname>
Message-Id: <E1RzsFt-0000LJ-If@myhostname>
Date: Tue, 21 Feb 2012 17:07:53 +0100
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - myhostname
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [0 0] / [47 12]
X-AntiAbuse: Sender Address Domain - myhostname
X-Source: /usr/bin/perl
X-Source-Args: lfd - (child) reporting exceeded LOCALHOSTRELAY limit
X-Source-Dir: /etc/csf

Time:  Tue Feb 21 17:07:53 2012 +0100
Type:  LOCALHOSTRELAY, localhost - 127.0.0.1
Count: 150 emails relayed
Blocked: No

Sample of the first 10 emails:

2012-02-21 17:07:50 1RzsFp-0008VC-QL <= noreply@srt.com H=localhost (User) [127.0.0.1] P=smtp S=1203 T="HELLO" for lilattitude@golenwest.net lilauthority10@yahoo.com lilayear06@yahoo.com lilaznangel30@yahoo.com lilaznboi780@aol.com lilaznicepixie@yahoo.com lilaznsh0rty@yahoo.com lilaznskinybones@yahoo.com lilaznxchica24@yahoo.com lilb_60@yahoo.com lilb_sd76@yahoo.com lilb102@webdsi.com lilb22@hotmail.com lilb2ful34@aol.com lilb7172002@yahoo.com lilbabie24@yahoo.com lilbabiehan@hotmail.com lilbaby03l@yahoo.com lilbaby0994@yahoo.com lilbaby1961@yahoo.com lilbaby32396@yahoo.com lilbabyangel_21@yahoo.com lilbabybailey@yahoo.com lilbabygarnes@yahoo.com lilbabygirl_198706@yahoo.com lilbabytinyt@yahoo.com lilbadboy007@sbcglobal.net lilbake80@yahoo.com lilballer4lyfe29@yahoo.com lilbasketballgrl01@yahoo.com lilbb473@aol.com lilbean822@aol.com lilbear51@aol.com lilbeardsley@yahoo.com lilbeba@aol.com lilbebe1228@aol.com lilbee@localnet.com lilbekahjo@yahoo.com lilbellmayo@hotmail.com lilben26@hotmail.com lilbenix45671@yahoo.com lilbet63@yahoo.com lilbeto65@yahoo.com lilbets_j@hotmail.com lilbigboo6@yahoo.com lilbiglaw@yahoo.com lilbikemoma02@yahoo.com lilbing84@hotmail.com lilbird517@yahoo.com lilbit3354@cox.net
2012-02-21 17:07:51 1RzsFq-0008VD-09 <= noreply@srt.com H=localhost (User) [127.0.0.1] P=smtp S=1203 T="HELLO" for lilbit36737@yahoo.com lilbit43615@yahoo.com lilbit458@aol.com lilbit5309@aol.com lilbit647@yahoo.com lilbit68_cj@yahoo.com lilbit79922@yahoo.com lilbita_chronic@hotmail.com lilbitcrazee@gmail.com lilbitofeverything77@yahoo.com lilbitofred69@yahoo.com lilbitotrubel@yahoo.com lilbitpie38@sbcglobal.net lilbitrose224@yahoo.com lilbits99@yahoo.com lilbitt@verizon.net lilbitty1975@comcast.net lilbittymunchkin23@yahoo.com lilbitz529@aol.com lilbitznaz@aol.com lilbiza@hotmail.com lilbkg1987@yahoo.com lilblond_chick@yahoo.com lilblondey411@netscape.net lilblu1014@yahoo.com lilblubu2@yahoo.com lilblueberry86@yahoo.com lilblurubi@yshoo.com lilbob922@yahoo.com lilboo152004@yahoo.com lilboo4u2020@yahoo.com lilboogie42069@yahoo.com lilboohammer@yahoo.com lilbookworm1984@yahoo.com lilbooty7373@yahoo.com lilboss2009@live.com lilboutdat2003@yahoo.com lilbp12369@yahoo.com lilbrain05@aol.com lilbrat1964@yahoo.com lilbrats_63@yahoo.com lilbrewcrew@gmail.com lilbro0166@yahoo.com lilbrother@sbcglobal.net lilbrownsuga@aol.com lilbrutus83@yahoo.com lilbubba131@comcast.net lilbug_nw@yahoo.com lilbunny2001@yahoo.com lilbutterflies@hotmail.com
2012-02-21 17:07:51 1RzsFr-0008Vi-4y <= noreply@srt.com H=localhost (User) [127.0.0.1] P=smtp S=1203 T="HELLO" for lilbutterfly64@yahoo.com lilbxshirley@yahoo.com lilbyrd_317@yahoo.com lilc_rob@yahoo.com lilcajun@bellsouth.net lilcajun1944@cs.com lilcal31@aol.com lilcal64@netscape.net lilcalfroper@yahoo.com lilcampbell09@yahoo.com lilcarina12@yahoo.com lilcarmala@yahoo.com lilcarren@yahoo.com lilcasper-1990@hotmail.com lilcat0403@yahoo.com lilcatina16@yahoo.com lilceejee@yahoo.com lilchampstlboi@yahoo.com lilchcky33@hotmail.com lilchef98@yahoo.com lilchelsei1590@yahoo.com lilcherokee2006@yahoo.com lilcherriegirl_00@hotmail.com lilchf10@comcast.net lilchico_co2006@yahoo.com lilchihuahuapup@aol.com lilchpin51@juno.com lilchrisbooman@yahoo.com lilci83@yahoo.com lilcilla0015@aol.com lilcindy98@yahoo.com lil-clem@hotmail.com lilclifflip@aim.com lilcna3@yahoo.com lilcoachise@aol.com lilcol325@yahoo.com lilconntrydonna@yahoo.com lilcoop79@aol.com lilcooper4985@yahoo.com lilcougdog520@yahoo.com lilcountry326@yahoo.com lilcountrygrl177@aim.com lilcountryqt87@aol.com lilcountygal_33@yahoo.com lilcow1024@yahoo.com lilcrazy@ptd.net lilcrazyd05@yahoo.com lilcrazygirl170@yahoo.com lilcrazylady32@yahoo.com lilcrazypunk07@yahoo.com

I've changed the name of my hostname

Can anyone tell me how I can trace the spam sender ? Thanks.

share|improve this question

2 Answers 2

Just my two cents:

since is connecting to 127.0.0.1 on your server can be a (malicious) script.

Is your server also a webserver? If so, I would check the web directory (directories if using multi/virtual hosts) for suspicious scripts (for example grep for mail() functions within PHP scripts).

Also, if using some sort of webmail interface on the same server it will connect to 127.0.0.1. It could be then that some of your users had the account broken-in (weak passwords?) and the spammers are using those credentials to send spam. If that's the case you should check the webmail logs to know which user(s) send what, not just the smtp server logs.

share|improve this answer
1  
+1 for compromised webmail account –  poke Feb 21 '12 at 17:21

Building on top of @MrShunz answer, if the server is also a webserver it needn't be a malicious script causing this. Bots actively scour the internet for poorly written web forms that send email, for example a feedback form. These can easily be victims of injection attacks which fool the mailserver into sending spam anonymously.

Here is a good discussion of how email injection exploits work, and can be prevented, in PHP forms.

If you do have a webserver on this mailserver, I would recommend you audit all forms and scripts on sites run through this server to see if you have this particular problem. If the server is small and you manage all the sites, you may even know where such forms are.

If you are seeing the spam messages arrive in generic mailboxes (noreply@srt.com?) you might find that there are forms hosted on this server designed to send to these addresses that have been exploited.

share|improve this answer

protected by Michael Hampton Jul 27 at 13:30

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.