mail continuing to be sent

Hi guys, I was noticing that, as usual I had the eximstat database full (6GB). After I flushed it, I discover that the number of rows were increasing again, and I decided to investigate. I then tried to tail the mail log, and that's the output:

Oct  2 12:29:49 server dovecot: lmtp(15555): Connect from local
Oct  2 12:29:50 server dovecot: lmtp(colpo@ns.example.it): c6kWG/w18VfFPAAAdYhRpA: msgid=: saved mail to INBOX
Oct  2 12:29:50 server dovecot: lmtp(15557): Disconnect from local: Successful quit

Every second I have a couple of this kind of connection. It seems that someone is using the local mailserver (from inside) to continuously send email. So I start thinking that maybe one of the websites I host was hacked, but I don't know how to spot where the mail are sent from (account, script, etc). Anyone can help me?

sharkufc

October 02, 2016 22:09

ok, maybe I found a solution:
ps -C exim -fH eww | grep home
this command shows the user and the script from which the email is being creating

October 03, 2016 13:26

I continue to update this thread. What I found out is that if I check the emixstats tables, I have a lot of rows in defers table such this one:

2016-10-03 08:22:06    1bqjjE-0005P1-7G    tc@yahoo.com    remote_smtp    mta6.am0.yahoodns.net    63.250.192.45    SMTP error from remote mail server after MAIL FROM: SIZE=2334: 421 4.7.1 [TS03] All messages from 176.56.238.108 will be permanently deferred; Retrying will NOT succeed. See https://help.yahoo.com/kb/postmaster/SLN3436.htm    lookuphost            864376

It seems that something is going on but I cannot understand if someone is trying to send email from within the server of from outside. Is there anyone that faced the same issue?

cPanelMichael

October 06, 2016 21:14

Hello, The output in your last response shows messages sent to Yahoo from: FROM:
Are the deferred messages coming from the same domain name? If so, you should investigate the cPanel account associated with that domain name to determine if that email account is compromised, or if scripts installed to that account are sending emails. The following thread should also help: How can I find out if my server is sending spam? Thank you.

mail continuing to be sent

Comments

Didn't find what you were looking for?