Most of the time, there will not be any details of the smtp connections in the header if a valid account is compromised or hacked.
In my case one of the account was compromised, which might be different from your issue. You can check for an account (valid domain account) in your SMTP logs or SEND logs for repeated logins. Also use "netstat -an" command to check from which IP the mails are being fired and lookup the same in the SMTP/SEND mail logs. In the logs check for repeated events of this IP and it should also give you some clue of the account that is being used for sending emails. Either disable that login or block that IP. If the mails are sent from your web application, then make sure you use a SMTP authentication, so that you can identify the correct user. I had the same problem and it took a good amount of time for me to arrest this. I was getting 28-30K mails per hour which almost freezed my mail server. I hope the above solution helps. Regards, Atul Paralikar -----Original Message----- From: Rafael Andrade [mailto:[email protected]] Sent: Monday, June 28, 2010 6:18 PM To: [email protected] Subject: Re: [qmailtoaster] Attack? [r...@net ~]# cat /etc/passwd | grep -i 48 apache:x:48:48:Apache:/var/www:/sbin/nologin Natalio Gatti escreveu: > > > On Mon, Jun 28, 2010 at 7:52 AM, Rafael Andrade > <[email protected] <mailto:[email protected]>> wrote: > > Thank you for reply. > > My problems continues... take a look. > > *[r...@net ~]# qmailctl queue | head* > messages in queue: 6182 > messages in queue but not yet preprocessed: 0 > > *[r...@net ~]# qmHandle -m2465807 * > > -------------- > MESSAGE NUMBER 2465807 > -------------- > Received: (qmail 21700 invoked by uid 48); 28 Jun 2010 04:32:52 -0000 > Date: 28 Jun 2010 04:32:52 -0000 > Message-ID: <[email protected] > <mailto:[email protected]>> > To: [email protected] <mailto:[email protected]> > > Subject: Atualização do seu aparelho Itoken versão Final sem erros > MIME-Version: 1.0 > Content-type: text/html; charset=iso-8859-1 > > From: Itau Informa Todos erros corrigidos > <[email protected] > <mailto:[email protected]>> > > > mmm, It seems that a process is sending mails. In the headers there is > no information about an smtp connection. Maybe a php application with > bugs running int the same server? Can you check User ID 48 in your > /etc/passwd? ---------------------------------------------------------------------------- ----- Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! ---------------------------------------------------------------------------- ----- Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] --------------------------------------------------------------------------------- Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! --------------------------------------------------------------------------------- Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
