SPAMMING 1

1) pidof exim
2) Below command will show you the no of emails sent by particular domain:
exim -bp | exiqsumm | more
3)
exim -bpr | grep “<*@*>” | awk “{print $4}”|grep -v “<>” | sort | uniq -c | sort -n | less
This will show you the maximum no of email currently in the mail queue have from or to the email address in the mail queue with exact figure.
4)
exim -bpr | grep “<*@*>” | awk “{print $4}”|grep -v “<>” |awk -F “@” “{ print $2}” | sort | uniq -c | sort -n | less
That will show you the maximum no of email currently in the mail queue have for the domain or from the domain with number.
5)
Find the script which is sending the mass mails :-
cd /var/spool/exim/input
egrep “X-PHP-Script” * -R
You can see the script there, if not seeing there just read the mail id file with your favorite test editor
exim -bpr | grep “<*@*>” | awk ‘{print $4}’|grep -v “<>” |awk -F “@” ‘{ print $2}’ | sort | uniq -c | sort -n
These list the current working directory of exim when processing a message :-
grep “cwd=” /var/log/exim_mainlog|awk ‘{for(i=1;i<=10;i++){print $i}}’|sort|uniq -c|grep cwd|sort -n
grep “<= ” /var/log/exim_mainlog|grep -v “<= <>”|awk ‘{print $5,$7}’|cut -d”:” -f1|sort|uniq -c|sort -n
grep -rl xxxx /var/spool/exim/input |xargs rm -f

========================================================================

Locate spam activity by subject with Exim

awk -F"T=\"" '/<=/ {print $2}' /var/log/exim_mainlog | cut -d\" -f1 | sort | uniq -c | sort -n

You should get back something that looks like this:

285 Out of Office
303 [Forum reply] Please moderate
578 New Account
1764 Melt Fat Naturally

Now we can search to see what user has been sending out this possible spam message with the following command:

grep "Melt Fat Naturally" /var/log/exim_mainlog | awk '{print $5}' | sort | uniq -c | sort -n

You should end up with some results like this:

1 test@example.com
1762 user01@example.com

You can now locate all of the IP addresses

grep "<= user01@example.com" /var/log/exim_mainlog | grep "Melt Fat Naturally" | grep -o "\[[0-9.]*\]" | sort -n | uniq -c | sort -n

Now deny the IP using your firewall rules.

========================================================================

Find spam script location with Exim

Run the following command to pull the most used mailing script's location from the Exim mail log:

grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

You should get back something like this:

15 /home/userna5/public_html/about-us
25 /home/userna5/public_html
7866 /home/userna5/public_html/data