Spammers send emails from our Server with nonexistent email accounts

Fatih Aytekin

• August 10, 2015 09:37

Hi, Today, we noticed that our several IPs were added to some blacklists. We changed the outgoing IP and when we looked at Mail Queue Manager we noticed that some spammers are sending spam emails from our server with nonexistent accounts. This spam action is still in progress. How can they send emails from nonexistent accounts with success? How can we stop this attack? We will be appreciated if you help us for the issue. Best Regards Fatih Ayetkin

• 

  cPanelMichael

  • August 10, 2015 16:58

  Hello :) Do you notice any additional information when viewing the message headers of these SPAM messages? What entries do you see for these messages in /var/log/exim_mainlog? This command will help determine which directory the messages are coming from if the SPAM messages are sent through PHP:
  awk '/cwd=\/home\// {print $3}' /var/log/exim_mainlog|sort|uniq -c|sort -n
  Thank you.

  0

Please sign in to leave a comment.