In this article, we explain different ways to locate spam sources. Spam usually originates from a website, via SMTP, or through a Perl script.
If there are queued emails, it is best to open one of them, as the headers can contain very valuable information.
If there are no queued emails, we can search our website logs or mail logs.
We assume that the sender can be spoofed, so we do not know which domain or email account the spam is being sent from.
If the spam is sent from a website, the key is to look for X-PHP-Script or userid, which tells us which URL or domain the spam is being sent from.
Received: by miservidor.com (Postfix, from userid 10039)
id C8D5E9793; Sun, 25 Jun 2017 09:43:34 +0200 (CEST)
From: "Remitente" <remitente@miservidor.com>
To: "Destinatario" <destinatario@otroservidor.com>
Subject: Asunto del Email
Date: Fecha email +0200
X-PHP-Script: midominio.com/xmlrpc.php for XXX.XXX.XXX.XXX (no está en todas las versiones de Plesk)
X-PHP-Originating-Script: 10039:class-phpmailer.php
X-Mailer: PHPMailer 5.2.22 (https://github.com/PHPMailer/PHPMailer)
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bitOlder versions of Plesk may not include the X-PHP-Script header. Running grep over SSH to search for the userid will tell us which domain the spam is being sent from:
# grep 10039 /etc/passwd
ftpUser:x:10039:10039::/var/www/vhosts/midominio.com:/bin/falseHeaders of emails sent from outside the server (SMTP access) do not include the X-PHP-Script header
Received: from ordenador (hostconexion [XXX.XXX.XXX.XXX]) esta cabecera no existe en los emails enviados vía web, nos indica de que IP proviene el mensaje.
by miservidor.com (Postfix) with ESMTPA id 1429F61E0461
for <destinatario@otroservidor.com>; Fecha email
From: "Remitente" <remitente@miservidor.com>
To: "Destinatario" <destinatario@otroservidor.com>
Subject: Asunto del Email
Date: Fecha email +0200
Message-ID: <001301d2ebfe$6576c9f0$30645dd0$@miservidor.com>
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----=_NextPart_000_0014_01D2EC0F.2901E3E0"
X-Mailer: Microsoft Outlook 14.0
Thread-Index: AdLr/mTQpC2POA4VQoOOlh/3sCjutA==
Content-Language: es
X-PPP-Message-ID: <20170623085505.25595.16770@miservidor.com>
X-PPP-Vhost: miservidor.comIn this case, the IP address is what matters. Searching the mail log for authentication entries for that IP address will show us which account the spam is being sent from.
Postfix:
# grep 'sasl_method=' /usr/local/psa/var/log/maillog | grep XXX.XXX.XXX.XXXQmail:
# grep smtp_auth /usr/local/psa/var/log/maillog |grep user | grep XXX.XXX.XXX.XXXSpam sent from websites is normally generated through POST requests. One approach is to search for these requests across all our domains:
# grep POST /var/www/vhosts/system/*/logs/access_log |grep -v '" 30' |grep -v '" 50' |grep -v '" 40'Older versions of Plesk use a different path:
# grep POST /var/www/vhosts/*/statistics/logs/access_log |grep -v '" 30'|grep -v '" 50' |grep -v '" 40'If we use WordPress or another CMS, we can exclude requests that we know are not spam submissions, such as requests to wp-login.php, wp-cron.php, xmlrpc.php
We can therefore append the following to the commands above: |grep -v wp-login.php |grep -v wp-cron.php |grep -v xmlrpc.php
Postfix: list sorted by number of authentications:
# grep 'sasl_username' /var/log/maillog | awk '{print $9}'| sort | uniq -c | sort -nr | headQmail: list sorted by number of authentications:
# grep smtp_auth /var/log/maillog |grep user |awk '{print $11}' |sort |uniq -c |sort -nr | headAnother way spam is sent is through a Perl process. Attackers often upload a file to one of our websites because it is out of date. An easy approach is to run top on the server and find the PID of the Perl process. Using that PID, we run:
cat /proc/PID/cwdAnother option is
lsof -p PIDOnce we have located the Perl process, we recommend removing it and killing all Perl processes:
killall -9 perl
Deleting queued emails via SSH
Qmail: delete emails containing specific text in the subject:
/usr/local/psa/admin/bin/mailq -STextoAsuntoQmail: delete all emails:
/usr/local/psa/admin/bin/mailq -DPostfix: delete emails containing specific text:
find /var/spool/postfix/ -type f -exec grep -l 'Texto-del-Email' '{}' \; | xargs -n1 basename | xargs -n1 postsuper -dPostfix: delete emails from a specific mailbox:
mailq | tail -n +2 | grep -v '^ *(' | awk 'BEGIN { RS = "" } { if ($7 == "usuario@ejemplo.com") print $1 }' | tr -d '*!' | postsuper -d -Postfix: delete all emails:
postsuper -d ALL