spam bot

Discussion in 'Server Operation' started by ikrudolf, Nov 4, 2013.

  1. ikrudolf

    ikrudolf Member

    How can I block this spambot from sending mail? How to find the script causing this?

  2. Croydon

    Croydon ISPConfig Developer ISPConfig Developer

    First try to have a look in the mail queue:

    $> mailq
    There you get a list of all mails currently sent or deferred.
    In front of all entries you get a mail id like
    (the asterisk marks mails currently "active")

    You now can view the mail's source code with postcat

    $> postcat /var/spool/postfix/deferred/8/8110058180C
    or if it has an asterisk et the end
    $> postcat /var/spool/postfix/active/8110058180C
    Look at the parts of the email having "From" or "received from" and search vor something like "www-data" or "X-PHP-Script" or "authenticated sender" etc. in the lines before the mail contents.
  3. ikrudolf

    ikrudolf Member

    Tnx this will help me a lot!

Share This Page