This question already has an answer here:
I need help diagnosing this: http://www.projecthoneypot.org/ip_220.127.116.11 It says my server has been sending spam for 4 months!
I try to be a responsible mail server admin, I hate spam, I do everything I am capable of to prevent it from happening. I need to figure out what is going on and where it is coming from so I can stop this.
I have watched the logs and tcpdumped traffic and I cannot find anything out of the ordinary. Everything going out is legitimate emails from users. There is no sign of spam, and no sign of increased traffic.
Network is locked down by a firewall/gateway server running shorewall. The 18.104.22.168 IP address is one of several static IP addresses I have, but it is the ONLY IP address I use for mail and it is dedicated to only that purpose. It is 1:1 NAT translated to an internal server at 192.168.50.9 (bismark - my mail server) The firewall is configured to allow traffic in/out on port 25 ONLY from this server, and ONLY mapped to that outbound IP. This works, I've tested it, there's no way in or out on port 25 from any other computer on the network.
This leaves me with the conclusion that any spam originating from that IP address must indeed be coming from my mail server but I have no idea how. My only guess is a compromised user account password (it does allow external SMTP auth, defended against brute force by fail2ban)
I can't see any spam going out at the moment. How do I monitor for it? How will I know if it starts again? More importantly, how do I make sure it will never start again? Help! I don't want to be one of the bad guys!