Is someone sending emails through my sendmail server??

oscargim · 06-19-2012, 02:31 PM

Hi Im receiving some spam emails from my account info@levelagency.com on my hotmail inbox and when I check the email source code I guess that emails are being sended from my server, but Im not sure.

The worst of this is that the email passes the sender ID auth.

This is my server IP 190.120.238.235

This is my server hostname: levelagency.com

And here is the emails source code:

Code:

To: <info@levelagency.com>
Subject: Learn how people in your profession can earn a 30% increase!
From: <info@levelagency.com>
Content-Type: text/plain; charset="us-ascii"
Message-Id: <SU0BB6-688W5H-KY@qbsnsgdafdjsfkab.dilos.com>
Date: Tue, 19 Jun 2012 20:09:03 +0100

We invite you to work in the remote assistant position.

This work takes 2-3 hours per week and requires absolutely no investment.
The essence of this work for incoming client requests in your city.
The starting salary is about 2500 EUR per month + bonuses.

You get paid your salary every 2 weeks and your bonuses after fulfilling each task!

We guarantee work for everyone. But we accept applications this week only!
Therefore, you should write a request right now. And you will start earning money, starting from next week.

Please indicate in the request:
Your name:
Your email address:
City of residence:

Please send the request to my email Mel@workineurop.com,and I will answer you personally as soon as possible

Sincerely,
Mel Tyler

Any help please, thanks!

Kustom42 · 06-19-2012, 03:20 PM

All of the email headers with the x- prefix are cpanel/exim config specific and in all honesty I never paid any attention to them. The real gritty stuff is the recieved by headers. These look to indicate the email IS being generated from the server itself and looks to be coming from Apache.

The first thing you should do is disable any contact or mail forms on your website to see if that resolves the issue. If it does you know where your problem lies and can start looking at sanitizing the form inputs to prevent people from compromising the site.

You can compare the timestamp of Tue, 19 Jun 2012 20:09:03 +0100 with your apache access logs, /var/log/httpd/access.log.

Once you find the IP of the guy who is abusing the form add an IPtable drop rule to drop his IPs connection.

Kustom42 · 06-19-2012, 03:22 PM

After looking at your site, its wordpress... Very notorious for compromise of this fashion. Take a look at wordpress.org/extend/plugins/email-spam-protection/, customers of mine at the web host company I worked for have used it and have reported alot of success in protecting their contact forms.