1

Ther eis spam being sent from my server right now and I have no idea where it is originating from. Here is the log entry from one of the emails:

Dec 11 20:04:55 ip-10-170-94-31 sendmail[20858]: sBBK4rfZ020856: to=<anderson_saan@hotmail.com>, ctladdr=<apache@ip-10-170-94-31.us-west-1.compute.internal> (48/48), delay=00:00:02, xdelay=00:00:02, mailer=relay, pri=126531, relay=relay.jangosmtp.net. [64.56.118.248], dsn=2.0.0, stat=Sent (6893 bytes received in 00:00:00; Message id 201412112004570841 accepted for delivery)

How can I go about tracing this back to whatever is sending the emails?

2
  • 2
    You can start by grep queue ID or grep sBBK4rfZ020856 in maillog
    – masegaloeh
    Dec 11 '14 at 21:14
  • There's a fair chance that it's from a cracked php website. Something like matteomattei.com/… can wrap the php mail call and grab some meaningful logs, which often include things like from addresses that might relate to one of your websites.
    – naught101
    Dec 2 '15 at 2:57
2

I found the problem by looking in the Apache logs. Apparently, the FTP password was hacked and there was a post.php file placed in all of the web directories that allowed them to send emails.

1

If your mail server is spamming, stop it and look at the queue files for clues.

If it could be from PHP, add a mail.log directive where appropriate (eg Apache php_admin_value).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.