| View previous topic :: View next topic |
| Author |
Message |
keopp
Senior Member
Joined: 08 Nov 2008
Posts: 166
Location: Romania
|
 Posted: Tue Jan 29, 2019 5:59 pm Post subject: Spam email sender unknown |
 |
|
Hi all,
I am in the situation my server sends SPAM and I cannot trace the source to eliminate.
In the maillog I see from time to time records like:
| Quote: |
Jan 29 17:17:44 MailServ postfix/pickup[1672]: 9E2785400302: uid=80 from=<apache>
Jan 29 17:17:44 MailServ postfix/cleanup[3272]: 9E2785400302: hold: header Received: by mail.xxxxxxx.yyy (Postfix, from userid 80)??id 9E2785400302; Tue, 29 Jan 2019 17:17:44 +0200 (EET) from local; from=<apache@xxxxxxx.yyy>
Jan 29 17:17:44 MailServ postfix/cleanup[3272]: 9E2785400302: message-id=<20190129151744.9E2785400302@mail.xxxxxxx.yyy>
Jan 29 17:17:50 MailServ MailScanner[1787]: New Batch: Scanning 1 messages, 25108 bytes
Jan 29 17:17:50 MailServ MailScanner[1787]: Virus and Content Scanning: Starting
Jan 29 17:17:50 MailServ MailScanner[1787]: Delivery of nonspam: message 9E2785400302.A9C74 from apache@xxxxxxx.yyy to lgdick@mymts.net with subject You have authorized a payment to Privacy Pop, LLC
Jan 29 17:17:50 MailServ MailScanner[1787]: Content Checks: Detected and have disarmed web bug tags in HTML message in 9E2785400302.A9C74 from apache@xxxxxxx.yyy
Jan 29 17:17:50 MailServ MailScanner[1787]: Requeue: 9E2785400302.A9C74 to 1C2AF54002FF
Jan 29 17:17:50 MailServ postfix/qmgr[1921]: 1C2AF54002FF: from=<apache@xxxxxxx.yyy>, size=24829, nrcpt=1 (queue active)
Jan 29 17:17:50 MailServ MailScanner[1787]: Uninfected: Delivered 1 messages
Jan 29 17:17:50 MailServ MailScanner[1787]: Deleted 1 messages from processing-database
Jan 29 17:17:52 MailServ postfix/smtp[3281]: 1C2AF54002FF: to=<lgdick@mymts.net>, relay=mx.mymts.net[69.168.103.61]:25, delay=7.5, delays=5.9/0/0.62/0.96, dsn=2.0.0, status=sent (250 2.0.0 OK D6/B0-03578-3EE605C5)
Jan 29 17:17:52 MailServ postfix/qmgr[1921]: 1C2AF54002FF: removed
|
It is not a php script because I set the trap in php.ini
| Code: |
mail.add_x_header = On
mail.log = /var/log/phpmail.log
|
And found nothing related to the excerpt above.
Any help please? |
|
| Back to top |
|
gerasimos_h
Site Admin
Joined: 09 Aug 2007
Posts: 1757
Location: Greece
|
| Posted: Wed Jan 30, 2019 11:18 pm Post subject: |
|
|
Indicate that message was send from a web form or a web script...
Do you have a joomla or any other CMS with an outdated contact form plugin or any other input fields that used to send emails?
gerasimos_h
_________________
Superb! Mini Server Project Manager
http://sms.it-ccs.com |
|
| Back to top |
|
keopp
Senior Member
Joined: 08 Nov 2008
Posts: 166
Location: Romania
|
| Posted: Thu Jan 31, 2019 12:23 pm Post subject: |
|
|
Thank you very much for your answer.
Yes, not a CMS but an old "handmade" php-html website. It's activity was caught by the php.ini trap and I disabled and renamed the script.
But again, as you can see below, the attempt repetead, this time without any record being made in phpmail.log and this is concerning me.
| Quote: |
Jan 30 16:54:33 MailServ postfix/pickup[24911]: 04C215400385: uid=80 from=<apache>
Jan 30 16:54:33 MailServ postfix/cleanup[30618]: 04C215400385: hold: header Received: by mail.xxxxxxx.yyy (Postfix, from userid 80)??id 04C215400385; Wed, 30 Jan 2019 16:54:32 +0200 (EET) from local; from=<apache@xxxxxxx.yyy>
Jan 30 16:54:33 MailServ postfix/cleanup[30618]: 04C215400385: message-id=<20190130145433.04C215400385@mail.xxxxxxx.yyy>
Jan 30 16:54:33 MailServ MailScanner[22539]: New Batch: Scanning 1 messages, 22917 bytes
Jan 30 16:54:33 MailServ MailScanner[22539]: Virus and Content Scanning: Starting
Jan 30 16:54:33 MailServ MailScanner[22539]: Delivery of nonspam: message 04C215400385.A8008 from apache@xxxxxxx.yyy to tcosad@xplornet.com with subject Receipt for Your Payment to Scrap of Paradise.
Jan 30 16:54:33 MailServ MailScanner[22539]: Content Checks: Detected and have disarmed web bug tags in HTML message in 04C215400385.A8008 from apache@xxxxxxx.yyy
Jan 30 16:54:33 MailServ MailScanner[22539]: Requeue: 04C215400385.A8008 to 900A45400384
Jan 30 16:54:33 MailServ MailScanner[22539]: Uninfected: Delivered 1 messages
Jan 30 16:54:33 MailServ postfix/qmgr[14932]: 900A45400384: from=<apache@xxxxxxx.yyy>, size=22629, nrcpt=1 (queue active)
Jan 30 16:54:33 MailServ MailScanner[22539]: Deleted 1 messages from processing-database
Jan 30 16:54:33 MailServ MailScanner[22539]: MailScanner child dying of old age
Jan 30 16:54:33 MailServ MailScanner[30912]: MailScanner E-Mail Virus Scanner version 4.84.6 starting...
Jan 30 16:54:33 MailServ MailScanner[30912]: Reading configuration file /opt/MailScanner/etc/MailScanner.conf
Jan 30 16:54:33 MailServ MailScanner[30912]: Reading configuration file /opt/MailScanner/etc/conf.d/README
Jan 30 16:54:33 MailServ MailScanner[30912]: Using SpamAssassin results cache
Jan 30 16:54:33 MailServ MailScanner[30912]: Connected to SpamAssassin cache database
Jan 30 16:54:33 MailServ MailScanner[30912]: Enabling SpamAssassin auto-whitelist functionality...
Jan 30 16:54:36 MailServ MailScanner[30912]: Connected to Processing Attempts Database
Jan 30 16:54:36 MailServ MailScanner[30912]: Found 0 messages in the Processing Attempts Database
Jan 30 16:54:36 MailServ MailScanner[30912]: Using locktype = flock
Jan 30 16:54:36 MailServ postfix/smtp[30911]: 900A45400384: to=<tcosad@xplornet.com>, relay=mx.xplornet.com.cust.a.hostedemail.com[216.40.42.4]:25, delay=3.7, delays=0.56/0.01/1.3/1.8, dsn=2.0.0, status=sent (250
Ok Queued as rock52_156def197c831)
Jan 30 16:54:36 MailServ postfix/qmgr[14932]: 900A45400384: removed
|
|
|
| Back to top |
|
gerasimos_h
Site Admin
Joined: 09 Aug 2007
Posts: 1757
Location: Greece
|
| Posted: Thu Jan 31, 2019 10:24 pm Post subject: |
|
|
check your mail queue with "mailq" and delete the spam messages not delivered with "postsuper -d {ID}" or "postsuper -d ALL" to delete all queue...
Also if your php-html website had a mysql database look also in database for stored spam messages...
I've seen that in joomla sites where I had to clean databases too.
gerasimos_h
_________________
Superb! Mini Server Project Manager
http://sms.it-ccs.com |
|
| Back to top |
|
keopp
Senior Member
Joined: 08 Nov 2008
Posts: 166
Location: Romania
|
| Posted: Fri Feb 01, 2019 1:28 am Post subject: |
|
|
OK, thanks
The mailq is empty.
I'll search about mysql database and post what found.
In the meantime, another email was sent from uid=80 apache without beeing recorded into phpmail.log ... strange...
| Quote: |
Jan 31 18:41:04 MailServ postfix/pickup[28047]: E1F635400404: uid=80 from=<apache>
Jan 31 18:41:07 MailServ MailScanner[31230]: Delivery of nonspam: message E1F635400404.AA192 from apache@xxxxxxx.yyy to buckb@sasktel.net with subject You submitted an order in the amount of .53 USD to Musictoday II
, LLC
....
|
|
|
| Back to top |
|
gerasimos_h
Site Admin
Joined: 09 Aug 2007
Posts: 1757
Location: Greece
|
| Posted: Fri Feb 01, 2019 2:43 pm Post subject: |
|
|
What your access log says...
It should give you the at list the page or link visited...
What SMS version are you running?
gerasimos_h
_________________
Superb! Mini Server Project Manager
http://sms.it-ccs.com |
|
| Back to top |
|
keopp
Senior Member
Joined: 08 Nov 2008
Posts: 166
Location: Romania
|
| Posted: Sat Feb 02, 2019 10:06 pm Post subject: |
|
|
There are several sotes hosted on the server. I've every access log file around the last attempt for a POST record. Nothing
SMS version is 2.0.9 clean install then migrated websites.
Spam attempts are rare like once a day but annoyingly without any trace... |
|
| Back to top |
|
gerasimos_h
Site Admin
Joined: 09 Aug 2007
Posts: 1757
Location: Greece
|
| Posted: Sat Feb 02, 2019 10:58 pm Post subject: |
|
|
Do you have webmin active, and if yes is it updated..?
I can take a look at your server if you like, 4 eyes are better than 2...
gerasimos_h
_________________
Superb! Mini Server Project Manager
http://sms.it-ccs.com |
|
| Back to top |
|
keopp
Senior Member
Joined: 08 Nov 2008
Posts: 166
Location: Romania
|
| Posted: Sun Feb 03, 2019 1:37 am Post subject: |
|
|
No, webmin disabled.
PM sent. |
|
| Back to top |
|
|
