Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

hello i have a exim server , and have a lot of spam last 24 hours , i watch exim_mainlog and see this

1SDcCZ-0005DX-JQ-H
mailnull 47 12
<contact@xxxxxxxx.com>
1333115355 0
-helo_name eicghqfebwyn
-host_address 186.106.221.159.3741
-host_name 186-106-221-159.fastnet.com
-host_auth courier_login
-interface_address 190.38.1.34
-received_protocol smtp
-body_linecount 3
-max_received_linelength 228
-auth_id contact@xxxxxxxx.com
-deliver_firsttime
XX
10
mcats21@gmail.com
bently.fistwird@hotmail.com
gunna10@yahoo.com
f-d.9@hotmail.com
anandajit26@yahoo.com
kolkata.enjoy@gmail.com
ajtoney14@yahoo.com
ben.storm@t-online.de
superman25_2005@yahoo.com
stagedawg@gmail.com

227P Received: from 186-106-221-159.fastnet.com([186.106.221.159] helo=eicghqfebwyn)
by srv.xxx.net with smtp (Exim 4.69)
(envelope-from <contact@xxxxxxxx.com>)
id 1SDcCZ-0005DX-JQ; Fri, 30 Mar 2012 10:49:16 -0300
015 Subject: jrtmh
229T To: mcats21@gmail.com, bently.fistwird@hotmail.com, gunna10@yahoo.com, f-d.9@hotmail.com, anandajit26@yahoo.com, kolkata.enjoy@gmail.com, ajtoney14@yahoo.com, ben.storm@t-online.de, superman25_2005@yahoo.com, stagedawg@gmail.com
041F From: “Sufssb” <contact@xxxxxxxx.com>
038 Date: Fri, 30 Mar 2012 16:48:13 +0200
018 Mime-Version: 1.0
043 Content-Type: text/plain; charset=us-ascii

1SDcCZ-0005DX-JQ-D

Este es un ejemplo del mensaje :
uwzi http://hxrLF.page.tl rfwy exois

But i cant track the spammer , any ideas to track this , a friend says me possible trojan send spam on server

thanks

share|improve this question
    
Are you masking you domain, and replacing it with contact@xxxxxxxx.com? If so, why is your mail server accepting emails to be sent to gemail.com and hotmail.com? –  becomingwisest May 2 '12 at 4:02
add comment

1 Answer

up vote 2 down vote accepted

Well, you already have the IP address that the message was sent from (186.106.221.159). What more do you want? Honestly, "tracking" spammers (whatever you mean by that) is a losing battle. Your time would be much better spent setting up Exim to use a reasonable RBL and Spamassassin or the like.

share|improve this answer
    
yes i have the ip, but block this and discover another and another and another, maybe its a script on server but i cant track –  mbarrerar May 2 '12 at 4:01
    
What exactly do you mean by "track"? As I said in my answer, you're trying to fight a losing battle. –  EEAA May 2 '12 at 4:02
    
trying find the spamscript on the server or how block the spammers of this –  mbarrerar May 2 '12 at 4:07
    
track with: tcpdump -i eth0 -w and wireshark and the spammer auth with real password, in a nutshell 3 computers with worms. –  mbarrerar May 2 '12 at 18:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.