troubleshooting Question

Spam from Exim mail server, possibly hacked.

Avatar of baysysadmin
baysysadmin asked on
LinuxEmail Servers
10 Comments1 Solution2215 ViewsLast Modified:
A client of ours  has been black listed for spamming. They run a Linux web server which has exim mail server used to send out notification to their customers when they sign up. They also have 3 inbox accounts that they connect to using SquirrelMail. The source of the spam is not them but rather a hacker how is using their mail server to send out thousands of emails per hour.

I have examined the exim.conf and relay is not enabled to all (just 4 IPS) which makes me think the server got hacked and there is code that's doing all this. We could not find any bad code in the website it self, but it could be anywhere on the server.

My next step is to enable deny sender ACL and block the sending email, but I am not sure how to find the source of the emails. I don't have experience administrating Linux mail server.
Thanks
 
The sender always seems to be the same. jeffpear@us.net

2014-11-23 04:02:15 1XpPS3-0002s3-4y SMTP error from remote mail server after MAIL FROM:<jeffpear@us.net> SIZE=5149: host mx3.hotmail.com [65.55.92.168]: 421 RP-001 (SNT004-MC3F3) Unfortunately, some messages from XXXXXXXXXX weren't s ent. Please try again. We have limits for how many messages can be sent per hour and per day. 

From jeffpear@us.net Fri Nov 14 17:43:32 2014 
Delivery-date: Fri, 14 Nov 2014 17:43:32 -0500 
Received: from [XXXXXXXXXXX] (helo=ns1.XXXXXXX) 
by mail.victim.example with esmtps (TLSv1:AES256-SHA:256) 
(Exim 4.63) 
(envelope-from <jeffpear@us.net>) 
id 1XpPaW-0003f0-5n 
for victim@smtp.example; Fri, 14 Nov 2014 17:43:32 -0500 
Received: from [146.71.110.19] (port=60231 helo=User) 
by ns1.XXXXXXXXwith esmtpa (Exim 4.82) 
(envelope-from <jeffpear@us.net>) 
id 1XpPaF-0004Qk-Tg; Fri, 14 Nov 2014 14:43:16 -0800 
Reply-To: <piusanyim90@yahoo.es> 
From: "Jeff Pear"<jeffpear@us.net> 
Subject: Your Abandoned Consignment 
Date: Fri, 14 Nov 2014 14:43:17 -0800 
MIME-Version: 1.0 
charset="Windows-1251" 

<HTML><HEAD><TITLE></TITLE> 
</HEAD> 
<BODY bgcolor=#FFFFFF leftmargin=5 topmargin=5 rightmargin=5 bottommargin=5> 
<FONT size=2 color=#000000 face="Arial"> 
<DIV> 
<B>Your Abandoned Consignment,</B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>I am Mr. Jeff Pear from the Office of Inspection Unit/United Nations Agency in John F. Kennedy International Airport (JFK) Terminal 4 New York USA. During my recent routine check at the Airport Storage/vault on withheld packages, I discovered an abandoned shipment that belongs to you from a Diplomat from Nigeria, when scanned it in our airport scanning machine it revealed an undisclosed sum of money in two Metal Trunk Boxes weighing approximately 25kg each and some people are coming after this consignment to clam it in your name.</B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>The consignment was abandoned because the Contents was not properly declared by the consignee as “MONEY” rather it was declared as personal effect to avoid interrogation and also the inability of the diplomat to pay for the IRREVOCABLE CONSIGNMENT MONEY MOVEMENT Charges Before bringing in the consignment into USA and we refused to return back the consignment where it came from since, we have already received it here in USA.</B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>On my assumption, each of the box contain not less than US$5 Million to US$5.5Million and the consignment is still left in our Storage House here at the John F. Kennedy International Airport till date. The details of the consignment including your name, your email address and the official document from the United Nations office in Geneva Switzerland are tagged on the Metal Trunk boxes in your favor.</B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>However, to enable me confirm if you are the actual recipient of this consignment, as the assistant director of the Inspection Unit, You are advice to contact; THE PRESIDENCY,&nbsp; Secretary to the Government of the Federation (SGF), Federal Republic of Nigeria in person of Senator&nbsp; Pius Anyim.</B></DIV> 
<DIV> 
<B> I will advise you to provide him your current Phone Number and Full Address, to enable him cross check if it corresponds with the address on the official documents including the Name of the nearest Airport around your city we have here in our data base report.</B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>Please note that this consignment is supposed to have been returned to the United States Treasury Department as unclaimed delivery due to the delay in concluding the clearance processes. </B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>Therefore you are advice to correspond with the above named office in Nigeria with the below Email address;---- piusanyim90@yahoo.es </B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>Once I receive response from Senator Pius Anyim in regards to your response to him regarding the release of the consignment in your name I will ask him to assign another diplomat from there Embassy here in New York to convey your consignment direct to you within the next 6-8 hours.</B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>Regards,</B></DIV> 
<DIV> 
<B> </B></DIV> 
<DIV> 
<B>Mr. Jeff Pear.</B></DIV> 
<DIV> 
<B>Office of the Inspection Unit</B></DIV> 
<DIV> 
<B>Address: Jamaica, New York, NY 11430, </B></DIV> 
<DIV> 
<B>United StatesJFK-John F. Kennedy International Airport New York USA.</B></DIV> 
<DIV> 
<B>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; O/C</B></DIV> 
<DIV> 
<B>piusanyim90@yahoo.es</B></DIV> 
<DIV> 
<B>&nbsp;</B></DIV> 
</FONT> 
</BODY></HTML>
ASKER CERTIFIED SOLUTION
Join our community to see this answer!
Unlock 1 Answer and 10 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 10 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros