Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Spam Injection, generated on fake emails

Discussion in 'E-mail Discussion' started by tangowebs, Mar 30, 2010.

  1. tangowebs

    tangowebs Well-Known Member

    Oct 12, 2004
    Likes Received:
    Trophy Points:
    Hi, my server is being injected with spam, originated in fake emails that seem to be hosted into server, but ofc they are not.
    Ive been trying to look for the script that is injecting, enabled headers, monitored queue but im not able to determine where those emails are being injected from.

    In common, all the spam is being created like adress.
    How can i determine where is this being injected from?
    Apreciate ur help, im becoming crazy!
  2. m4rc3

    m4rc3 Active Member

    Mar 26, 2010
    Likes Received:
    Trophy Points:
    You need to enable extended logging on exim so you can check where those emails are coming from.

    Add this to exim.conf and restart it.
    log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn
    then you can use something like this to check where the emails are coming from.
    This will list the folder that sends mails and how many has sent.
    grep cwd= /var/log/exim_mainlog| awk '{print $3}' | cut -d= -f2 | sort | uniq -c | sort -n

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice