I have a VPS configured to use PHP to send out periodical alerts via email (sendmail) where I connect via SMTP to a google apps email account. The server is using EXIM as the transfer agent.
In the EXIM logs, exim_mainlog, I am seeing SMTP connections from IP addresses that seem to be successfully connecting and sending spam messages.
2018-04-03 12:48:53 SMTP connection from [126.96.36.199]:27892 (TCP/IP connection count = 1) 2018-04-03 12:48:54 SMTP connection from 202077050129.static.ctinets.com () [188.8.131.52]:27892 closed by QUIT
I am at a loss on how or where to start to prevent these unauthorized SMTP connections?