sendmail sending mail to recipients I don’t know of; possible spam host

Posted by Quintin Par on Server Fault See other posts from Server Fault or by Quintin Par
Published on 2011-11-22T16:45:34Z Indexed on 2011/11/22 17:59 UTC
Read the original article Hit count: 562

Filed under:

sendmail

|

spam

|

audit

|

malware

Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday.

 STATISTICS
 ----------

 Messages To Recipients:  582
 Addressed Recipients:    582
 Bytes Transferred:       444985
 Messages No Valid Rcpts: 0

 SMTP SESSION, MESSAGE, OR RECIPIENT ERRORS
 ------------------------------------------

Next day

 STATISTICS
 ----------

 Messages To Recipients:  153
 Addressed Recipients:    279
 Bytes Transferred:       8613451
 Messages No Valid Rcpts: 0

 SMTP SESSION, MESSAGE, OR RECIPIENT ERRORS
 ------------------------------------------

How can I audit more to find out the email ids to where did is send, program which schedules this etc?

© Server Fault or respective owner

Related posts about sendmail

Sendmail Failing to Forward Locally Addressed Mail to Exchange Server

as seen on Server Fault - Search for 'Server Fault'
I've recently gained employment as a web developer with a small company. What they neglected to tell me upon hire was that I would be administrating the server along with my other daily duties. Now, truth be told, I'm not clueless when it comes to these things, but this is my first rodeo working with… >>> More
Output php mail calls to log file

as seen on Server Fault - Search for 'Server Fault'
This question relates to the question found here: Find the php script thats sending mails Trying to do the exact same thing but can't get the log to output what I need. Not too experienced with serverfault and ideally I'd post my followup on the original question, or PM adam to see if he ever found… >>> More
Sendmail background process sometimes processes queue, but sendmail -q always works

as seen on Server Fault - Search for 'Server Fault'
I'm using sendmail version 8.14.4 on Fedora 15 to send email. My Rails app uses delayed_job to queue up emails. Messages will queue up in /var/spool/mqueue as expected, but don't always get processed. I can see the messages and sendmail is definitely running in the background. Restarting the process… >>> More
sendmail: Error during delivery. Service not available, closing transmission channel

as seen on Server Fault - Search for 'Server Fault'
I have a module in my system that will trigger an email and send it to user. The email will be sent to user when the product in my system is going to expired soon. I test the whole module in localhost and there is no problem with it. Then, I finally moved the module in my server but it gives this… >>> More
sendmail.exe: Error during delivery. Service not available, closing transmission channel

as seen on Server Fault - Search for 'Server Fault'
I have a module in my system that will trigger an email and send it to user. The email will be sent to user when the product in my system is going to expired soon. I test the whole module in localhost and there is no problem with it. Then, I finally moved the module in my server but it gives this… >>> More

Related posts about spam

spam spam spam spam [closed]

as seen on Stack Overflow - Search for 'Stack Overflow'
spam removed spam removed spam removed spam removed >>> More
Stop Outgoing Spam Already Tagged as Spam

as seen on Server Fault - Search for 'Server Fault'
Hi, I run a Postfix server with Amavis and Spamassassin among other things. Postfix receives mail from the outside world and passes it on to Amavis. Amavis has Spamassassin rate the mail, and then tags it as spam if necessary. Then Postfix relies on each users' procmailrcs to deal with the mail as… >>> More
spam check, spam score how to?

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi. I am doing a app that is sending email and need to have a spam checker on the outgoing email. I have been looking for this a while now, I can not seem to find a good solution. I would like to use something like the spamassassin. Do you guys got any examples how to do the spamassassin with asp… >>> More
configure spam assassin to delete all spam above a score domain wide and override individual settin

as seen on Server Fault - Search for 'Server Fault'
Okay, so this is my scenario and what I want to try and do. I maintain a Red Hat email server running qmail and spamassassin. I have a domain that has well over 100 email account each with individual settings for spam scores and, whether or not to delete email incoming mail deemed spam. What I… >>> More
Make Thundirbird use and sync with Gmail Spam facility

as seen on Super User - Search for 'Super User'
I am using Thundirbird 3.1.7. I am using Gmail with it. When I mark a message as spam in Thunderbird, I want it to go to Gmail's spam folder. But it is not happening. The mail is only marked as spam and stays in Gmail's inbox. How can I setup Thunderbird so that when I mark a message as spam in… >>> More