Scan all emails for URL

forensis

• July 11, 2017 10:45

I am trying to scan all of the messages to/from my domain for a particular URL (which may be embedded as a link in the text of the email) to look for particular spyware. I have gotten as far as logging into a serial console via my VPS control panel (using terminal command on a Mac). I entered the following command hoping it would bring up a log of all messages on the server: exigrep domain.com/var/log/message But it seems to either be frozen or taking a very long time to come up with the log. Is there a more direct way to search for a particular URL within all messages? Thanks in advance! (Apologies if this is very obvious, I'm new to this)

• 

  cPanelMichael

  • July 11, 2017 17:03

  Hello, The /var/log/exim_mainlog log file will show you information about message deliveries, however it does not include the contents of the message body. If you want to filter all incoming messages that contain a specific URL, you'd need to setup a custom Exim system filter rule. The following document explains how to do this: How to Customize the Exim System Filter File - cPanel Knowledge Base - cPanel Documentation Thank you.

  0
• 

  forensis

  • July 11, 2017 17:07

  @cPanelMichael - Thank you! Is there any way to search through the body content of all messages for a particular email address (sent/received/junk/everything) or, even better, for all email addresses on the VPS server? It's helpful to know how to filter them for future reference, but what I really need to know is whether we have a received an email into any of our accounts containing a specific URL.

  0
• 

  cPanelMichael

  • July 11, 2017 17:23

  Hello, If the emails still exist on the server, then you could search for them using the following option: "WHM >> Mail Delivery Reports" Thank you.

  0
• 

  forensis

  • July 11, 2017 17:38

  Hi @cPanelMichael - Thanks for the suggestion, I tried that but it won't let me search within the body text of the email and even if it could, I need to search through all emails, not just the last 10 days. Is there some kind of grep command I can try?

  0
• 

  cPanelMichael

  • July 11, 2017 17:41

  Hello, Email body content is not stored by Exim, so you'll only be able to find it if an affected message exists on the server. You'd have to search through individual emails stored under accounts (assuming they keep copies of messages on the server). EX:
  grep $search-term /home/example/mail/domain.tld/email-account-1/cur/*
  Thank you.

  0

Please sign in to leave a comment.