hello,
I own 2 dedcated servers to sell webhosting .. i use WHM and CPanel.

since a week one of my customers start sending spam messages everywhere and in the header of message i found the domain in:

X-AntiAbuse: Original Domain - island.com

chnaged to any other domain and sometime changed to be the same domain of Receiver .. like if the spam send to x@123.com the antiabuse will be

X-AntiAbuse: Original Domain - 123.com


i there anyway to track the spammer ? please help

you'd better post this question to support.cpanel.net

Thanks for replying ... but is there any faster way to know this spammer ?

any hints ?

can i search on HDD by keywords so i can find some keywords in the spamer folder ?

or search the logs files by keywords ? , ... ?

Lots of things you could do, but the easiest is probably to check for other headers in those spammed emails. There should be an X-AntiAbuse header which gives UID/GID; that will tell you at least which user account the email came from.

After that, take a look at /var/log/maillog (if it is there, it might be somewhere else). The mail log should give you lots of useful information.

hello,

thank you "cperciva" ...
the logs was good idea ..
the logmail didnt contain any thing about mails sent using CGIs.

but the spammer used a CGI because he can change the x-abuse line ..

i found file /var/log/sendmail.log
this was contain 1000s of lines come from certain account .. ofcourse he was the spammer ..

I **** him :angry: