hello i have a exim server , and have a lot of spam last 24 hours , i watch exim_mainlog and see this
1SDcCZ-0005DX-JQ-H
mailnull 47 12
<contact@xxxxxxxx.com>
1333115355 0
-helo_name eicghqfebwyn
-host_address 186.106.221.159.3741
-host_name 186-106-221-159.fastnet.com
-host_auth courier_login
-interface_address 190.38.1.34
-received_protocol smtp
-body_linecount 3
-max_received_linelength 228
-auth_id contact@xxxxxxxx.com
-deliver_firsttime
XX
10
mcats21@gmail.com
bently.fistwird@hotmail.com
gunna10@yahoo.com
f-d.9@hotmail.com
anandajit26@yahoo.com
kolkata.enjoy@gmail.com
ajtoney14@yahoo.com
ben.storm@t-online.de
superman25_2005@yahoo.com
stagedawg@gmail.com
227P Received: from 186-106-221-159.fastnet.com([186.106.221.159] helo=eicghqfebwyn)
by srv.xxx.net with smtp (Exim 4.69)
(envelope-from <contact@xxxxxxxx.com>)
id 1SDcCZ-0005DX-JQ; Fri, 30 Mar 2012 10:49:16 -0300
015 Subject: jrtmh
229T To: mcats21@gmail.com, bently.fistwird@hotmail.com, gunna10@yahoo.com, f-d.9@hotmail.com, anandajit26@yahoo.com, kolkata.enjoy@gmail.com, ajtoney14@yahoo.com, ben.storm@t-online.de, superman25_2005@yahoo.com, stagedawg@gmail.com
041F From: “Sufssb” <contact@xxxxxxxx.com>
038 Date: Fri, 30 Mar 2012 16:48:13 +0200
018 Mime-Version: 1.0
043 Content-Type: text/plain; charset=us-ascii
1SDcCZ-0005DX-JQ-D
Este es un ejemplo del mensaje :
uwzi http://hxrLF.page.tl rfwy exois
But i cant track the spammer , any ideas to track this , a friend says me possible trojan send spam on server
thanks