Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

hello i have a exim server , and have a lot of spam last 24 hours , i watch exim_mainlog and see this

mailnull 47 12
1333115355 0
-helo_name eicghqfebwyn
-host_auth courier_login
-received_protocol smtp
-body_linecount 3
-max_received_linelength 228

227P Received: from[] helo=eicghqfebwyn)
by with smtp (Exim 4.69)
(envelope-from <>)
id 1SDcCZ-0005DX-JQ; Fri, 30 Mar 2012 10:49:16 -0300
015 Subject: jrtmh
229T To:,,,,,,,,,
041F From: “Sufssb” <>
038 Date: Fri, 30 Mar 2012 16:48:13 +0200
018 Mime-Version: 1.0
043 Content-Type: text/plain; charset=us-ascii


Este es un ejemplo del mensaje :
uwzi rfwy exois

But i cant track the spammer , any ideas to track this , a friend says me possible trojan send spam on server


share|improve this question
Are you masking you domain, and replacing it with If so, why is your mail server accepting emails to be sent to and – becomingwisest May 2 '12 at 4:02
up vote 2 down vote accepted

Well, you already have the IP address that the message was sent from ( What more do you want? Honestly, "tracking" spammers (whatever you mean by that) is a losing battle. Your time would be much better spent setting up Exim to use a reasonable RBL and Spamassassin or the like.

share|improve this answer
yes i have the ip, but block this and discover another and another and another, maybe its a script on server but i cant track – mbarrerar May 2 '12 at 4:01
What exactly do you mean by "track"? As I said in my answer, you're trying to fight a losing battle. – EEAA May 2 '12 at 4:02
trying find the spamscript on the server or how block the spammers of this – mbarrerar May 2 '12 at 4:07
track with: tcpdump -i eth0 -w and wireshark and the spammer auth with real password, in a nutshell 3 computers with worms. – mbarrerar May 2 '12 at 18:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.