Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

hello i have a exim server , and have a lot of spam last 24 hours , i watch exim_mainlog and see this

mailnull 47 12
1333115355 0
-helo_name eicghqfebwyn
-host_name 186-106-221-159.fastnet.com
-host_auth courier_login
-received_protocol smtp
-body_linecount 3
-max_received_linelength 228
-auth_id contact@xxxxxxxx.com

227P Received: from 186-106-221-159.fastnet.com([] helo=eicghqfebwyn)
by srv.xxx.net with smtp (Exim 4.69)
(envelope-from <contact@xxxxxxxx.com>)
id 1SDcCZ-0005DX-JQ; Fri, 30 Mar 2012 10:49:16 -0300
015 Subject: jrtmh
229T To: mcats21@gmail.com, bently.fistwird@hotmail.com, gunna10@yahoo.com, f-d.9@hotmail.com, anandajit26@yahoo.com, kolkata.enjoy@gmail.com, ajtoney14@yahoo.com, ben.storm@t-online.de, superman25_2005@yahoo.com, stagedawg@gmail.com
041F From: “Sufssb” <contact@xxxxxxxx.com>
038 Date: Fri, 30 Mar 2012 16:48:13 +0200
018 Mime-Version: 1.0
043 Content-Type: text/plain; charset=us-ascii


Este es un ejemplo del mensaje :
uwzi http://hxrLF.page.tl rfwy exois

But i cant track the spammer , any ideas to track this , a friend says me possible trojan send spam on server


share|improve this question
Are you masking you domain, and replacing it with contact@xxxxxxxx.com? If so, why is your mail server accepting emails to be sent to gemail.com and hotmail.com? –  becomingwisest May 2 '12 at 4:02

1 Answer 1

up vote 2 down vote accepted

Well, you already have the IP address that the message was sent from ( What more do you want? Honestly, "tracking" spammers (whatever you mean by that) is a losing battle. Your time would be much better spent setting up Exim to use a reasonable RBL and Spamassassin or the like.

share|improve this answer
yes i have the ip, but block this and discover another and another and another, maybe its a script on server but i cant track –  mbarrerar May 2 '12 at 4:01
What exactly do you mean by "track"? As I said in my answer, you're trying to fight a losing battle. –  EEAA May 2 '12 at 4:02
trying find the spamscript on the server or how block the spammers of this –  mbarrerar May 2 '12 at 4:07
track with: tcpdump -i eth0 -w and wireshark and the spammer auth with real password, in a nutshell 3 computers with worms. –  mbarrerar May 2 '12 at 18:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.