{"id":1117,"date":"2011-12-07T11:09:10","date_gmt":"2011-12-07T11:09:10","guid":{"rendered":"https:\/\/www.uk-cheapest.co.uk\/support\/?p=1117"},"modified":"2011-12-09T15:24:04","modified_gmt":"2011-12-09T15:24:04","slug":"how-do-i-find-the-spam-source-on-a-plesk-server-using-qmail","status":"publish","type":"post","link":"https:\/\/www.uk-cheapest.co.uk\/support\/how-do-i-find-the-spam-source-on-a-plesk-server-using-qmail\/","title":{"rendered":"How do I find the SPAM source on a Plesk server using qmail?"},"content":{"rendered":"

Re: Finding spammers in Plesk, find source of spam on Plesk server<\/strong><\/p>\n

If you are hosting a Plesk server wilth multiple sites then eventually you will find that spam will appear from one of those sites and it will be difficult to determine where the spam is coming from. This will put your server IP at risk of being suspended by your server provider.<\/p>\n

First things first, let’s check to see if the spam is being sent by a mailbox user, this would indicate deliberate spamming from a client or a compromised password on a mailbox account.<\/p>\n

Out of the ordinary authentications<\/strong><\/p>\n

A large number of authentications to a particular mailbox, ie. thousands, can indicate massive email activity, you can check this quickly as follows:<\/p>\n

# cat \/usr\/local\/psa\/var\/log\/maillog |grep -I \"LOGIN\"|awk {'print $12'}|sort|uniq -c|sort -n<\/pre>\n
If you cannot see anything out of the ordinary, the search continues.<\/p>\n
The Maillog is your friend<\/strong><\/p>\n
Let’s take a look at the plesk qmail maillog:<\/p>\n
# tail -500 \/usr\/local\/psa\/var\/log\/maillog<\/pre>\n
Entries like the following indicate the domain and mailbox that the email is being sent from:<\/p>\n
Dec  7 10:51:01 server qmail-local-handlers[29265]: from=info@spammerdomain.com<\/pre>\n
This leaves you no further work to do, possibly suspend the account and contact the client in question. You might want to clear the mail queue in the Plesk panel also.<\/p>\n
Difficult to locate spammers<\/strong><\/p>\n
A more difficult situation is where the email is being sent using the Apache user or as anonymous. This type of email spam cannot so easily be traced to a sender as it is not being sent from a mailbox.<\/p>\n
These entries look something like this:<\/p>\n
Dec \u00a07 10:50:17 server qmail-queue-handlers[29080]: from=anonymous@server.hostname.com<\/pre>\n
Or like this:<\/p>\n
Dec \u00a07 10:50:17 server qmail: 1323255017.404624 info msg 47220220: bytes 501 from <anonymous@server.hostname.com> qp 29081 uid 48<\/pre>\n
It is not possible to determine the spammer from the maillog in this situation. These emails are being sent using a form processor or other PHP mailer \/ PERL mailer script.<\/p>\n
Track, Trace and Remove<\/strong><\/p>\n
To solve this problem you need to<\/p>\n