-1

hello i have a exim server , and have a lot of spam last 24 hours , i watch exim_mainlog and see this 

1SDcCZ-0005DX-JQ-H
mailnull 47 12
<contact@xxxxxxxx.com>
1333115355 0
-helo_name eicghqfebwyn
-host_address 186.106.221.159.3741
-host_name 186-106-221-159.fastnet.com
-host_auth courier_login
-interface_address 190.38.1.34
-received_protocol smtp
-body_linecount 3
-max_received_linelength 228
-auth_id contact@xxxxxxxx.com
-deliver_firsttime
XX
10
mcats21@gmail.com
bently.fistwird@hotmail.com
gunna10@yahoo.com
f-d.9@hotmail.com
anandajit26@yahoo.com
kolkata.enjoy@gmail.com
ajtoney14@yahoo.com
ben.storm@t-online.de
superman25_2005@yahoo.com
stagedawg@gmail.com

227P Received: from 186-106-221-159.fastnet.com([186.106.221.159] helo=eicghqfebwyn)
by srv.xxx.net with smtp (Exim 4.69)
(envelope-from <contact@xxxxxxxx.com>)
id 1SDcCZ-0005DX-JQ; Fri, 30 Mar 2012 10:49:16 -0300
015 Subject: jrtmh
229T To: mcats21@gmail.com, bently.fistwird@hotmail.com, gunna10@yahoo.com, f-d.9@hotmail.com, anandajit26@yahoo.com, kolkata.enjoy@gmail.com, ajtoney14@yahoo.com, ben.storm@t-online.de, superman25_2005@yahoo.com, stagedawg@gmail.com
041F From: “Sufssb” <contact@xxxxxxxx.com>
038 Date: Fri, 30 Mar 2012 16:48:13 +0200
018 Mime-Version: 1.0
043 Content-Type: text/plain; charset=us-ascii

1SDcCZ-0005DX-JQ-D

Este es un ejemplo del mensaje :
uwzi http://hxrLF.page.tl rfwy exois

But i cant track the spammer , any ideas to track this , a friend says me possible trojan send spam on server

thanks

mbarrerar
  • 3
  • 1
  • Are you masking you domain, and replacing it with contact@xxxxxxxx.com? If so, why is your mail server accepting emails to be sent to gemail.com and hotmail.com? – becomingwisest May 02 '12 at 04:02

1 Answers1

2

Well, you already have the IP address that the message was sent from (186.106.221.159). What more do you want? Honestly, "tracking" spammers (whatever you mean by that) is a losing battle. Your time would be much better spent setting up Exim to use a reasonable RBL and Spamassassin or the like.

EEAA
  • 108,414
  • 18
  • 172
  • 242
  • yes i have the ip, but block this and discover another and another and another, maybe its a script on server but i cant track – mbarrerar May 02 '12 at 04:01
  • What exactly do you mean by "track"? As I said in my answer, you're trying to fight a losing battle. – EEAA May 02 '12 at 04:02
  • trying find the spamscript on the server or how block the spammers of this – mbarrerar May 02 '12 at 04:07
  • track with: tcpdump -i eth0 -w and wireshark and the spammer auth with real password, in a nutshell 3 computers with worms. – mbarrerar May 02 '12 at 18:12