Help - My server is being used as a spam relay right now

[romanus]

How can I find out which domain is responsible for the 3000 or so bounced emails that I got in the last 20 minutes?

[serversphere]

If you are running suexec you could check the suexec_log to see what scripts ran when, you can grep it to find the specific time that the spam occurred. If you still have mail in queue, check the headers to see if you can see where it came from.

:edit: bounced? might just be someone using your domain name as the reply to when they are sending out spam too....

[romanus]

noe these are in my mail que with my host name in the header

[romanus]

they are being sent from nobody@host.xxxx.com which is my host name - 35,000 so far

[mohit]

hi,
there are a lot of threads which can help you catch the culprit.
Try searching the forum as

http://forums.cpanel.net/search.php?searchid=1507222

or

http://forums.cpanel.net/search.php?searchid=1507239

PS: please correct the spelling of Mahatma Gandhi in your signature.