This question already has an answer here:
- How do I deal with a compromised server? 13 answers
I have 2 domains on my dedicated server running debian.
One of them is linked to a wordpress site, mydomain.com.
I've noticed that on both my sites, lately, the performances were horrible so I started to look for a reason.
I noticed that in the last few days, my daily syslogs were as big as 800mb, filled with notices of deferred emails coming from emails looking like firstname.lastname@example.org, obviously programmaticaly generated.
I updated my wordpress, deleted the deferred queue (all 130 000 deferred mails making it) of postfix, and waited 10mn.
After 10mn, the queue is filled with 4000 mails and counting, and can't locate any fishy script anywhere.
I can't find any information about such an exploit, so I'd like to know what I could do get rid of that spam that is killing my server.
If that can help, it seems that every address sends batches of 20 emails.