{"id":814,"date":"2013-01-22T18:46:01","date_gmt":"2013-01-22T23:46:01","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2013\/01\/22\/locate-spam-activity-by-subject-with-exim\/"},"modified":"2021-08-16T23:23:49","modified_gmt":"2021-08-17T03:23:49","slug":"locate-spam-activity-by-subject-with-exim","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/","title":{"rendered":"Locate spam activity by subject with Exim"},"content":{"rendered":"

In this article I’m going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.<\/p>\n

If you’ve read my previous article on how to find email accounts being used to spam<\/a>, you should already know how to track down spam activity by looking for email accounts that send out mail from multiple IP addresses. Now we’re going to cover finding spam activity by looking at duplicate subjects that are happening on your server.<\/p>\n

To be able to follow along with this guide you’ll need to already have root access<\/a> to your VPS or dedicated server so that you have access to the Exim mail log.<\/p>\n

Locate duplicate subjects in Exim mail log<\/h2>\n

Using the steps below<\/p>\n

    \n
  1. Login to your server via SSH<\/a> as the root user.<\/li>\n
  2. Run the following command to locate duplicate subjects from your Exim mail log:\n

    awk -F\"T=\"\" '\/<=\/ {print $2}' \/var\/log\/exim_mainlog | cut -d\" -f1 | sort | uniq -c | sort -n <\/code>
    \nCode breakdown:<\/strong><\/p>\n\n\n\n\n\n
    awk -F”T=”” ‘\/<=\/ {print $2}’ \/var\/log\/exim_mainlog<\/th>\nUse the awk<\/strong> command with the -F<\/strong>ield seperator set to T=”<\/strong> and looking for deliveries leaving the server noted by <=<\/strong>, then print out the $2<\/strong>nd set of data which is the subject of the message.<\/td>\n<\/tr>\n
    cut -d” -f1<\/th>\nUse the cut<\/strong> command with the -d<\/strong>elimiter set to double quotes “<\/strong> and return the -f<\/strong>ield of data before the 1st<\/strong> ocurrence. This makes it so we only get back the subjects and nothing else.<\/td>\n<\/tr>\n
    sort | uniq -c | sort -n<\/th>\nSort the subjects by name, then uniquely count them up, and finally sort them again numerically from lowest to highest.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should get back something that looks like this:<\/p>\n

    285 Out of Office
    \n303 [Forum reply] Please moderate
    \n578 New Account
    \n1764 Melt Fat Naturally <\/code>
    \nSo in this case we can see that by far the subject Melt Fat Naturally<\/strong> is the most duplicated subject currently in the Exim mail log.<\/li>\n

  3. Now we can search to see what user has been sending out this possible spam message with the following command:\n

    grep \"Melt Fat Naturally\" \/var\/log\/exim_mainlog | awk '{print $6}' | sort | uniq -c | sort -n<\/code>
    \nCode breakdown:<\/strong><\/p>\n\n\n\n\n\n
    grep “Melt Fat Naturally” \/var\/log\/exim_mainlog<\/th>\nUse the grep<\/strong> command to search for our subject in the Exim mail log.<\/td>\n<\/tr>\n
    awk ‘{print $6}’<\/th>\nUse the awk<\/strong> command to print out the $6<\/strong>th column of data which is the sending email account.<\/td>\n<\/tr>\n
    sort | uniq -c | sort -n<\/th>\nSort the email accounts by name, then uniquely count them, and finally sort them again numerically from lowest to highest.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should end up with some results like this:<\/p>\n

    1 test@example.com
    \n1762 user01@example.com <\/code>
    \nSo in this case we can see that it looks like the user01@example.com<\/strong> account was used to relay this spam message.<\/li>\n

  4. You can now locate all of the IP addresses the user01@example.com<\/strong> account has been sending mail from, and possibly block them at your server’s firewall if the activity looks malicious to you.Use the following command to find all the IP addresses the account has been relaying mail with:\n

    grep \"<= user01@example.com\" \/var\/log\/exim_mainlog | grep \"Melt Fat Naturally\" |
    \ngrep -o \"[[0-9.]*]\" | sort -n | uniq -c | sort -n<\/code><\/p>\n

    Note:<\/b> The two lines above should be written as a single line.<\/p>\n

    Code breakdown:<\/strong><\/p>\n\n\n\n\n\n\n
    grep “<= user01@example.com” \/var\/log\/exim_mainlog<\/th>\nUse the grep<\/strong> command to find outgoing messages from the user01@example.com<\/strong> account.<\/td>\n<\/tr>\n
    grep “Melt Fat Naturally”<\/th>\nUse grep<\/strong> again to only show messages with the subject we’re looking for.<\/td>\n<\/tr>\n
    grep -o “[[0-9.]*]”<\/th>\nUse grep<\/strong> one last time with the -o<\/strong>nly matching flag, to only pull the IP address from the Exim mail log.<\/td>\n<\/tr>\n
    sort -n | uniq -c | sort -n<\/th>\nSort all of the IP addresses numerically, then uniquely count them up, and finally sort them numerically again from lowest to highest duplicates.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    You should get back something related to this:<\/p>\n

    1762 [123.123.123.123]<\/code>
    \nSo we can see that all 1,763<\/strong> messages the user01@example.com<\/strong> user sent out, all came from the same 123.123.123.123<\/strong> IP address.<\/li>\n

  5. Now we can go ahead and block this IP address from our server at the server’s firewall by running the following command:\n

    apf -d 123.123.123.123 \"Sending weight loss spam from user01@example.com\"<\/code><\/li>\n

  6. It would also be recommended to change the email password in cPanel<\/a> for the email account being used to send this spam. As otherwise the spammer could possibly come back from another computer with a different IP address and still attempt to relay spam out through your account.<\/li>\n<\/ol>\n

    You should now have learned how to use the Exim mail log on your VPS or dedicated server to track down duplicate subjects being sent out from your server. Then using that knowledge how to track down the responsible user and IP address sending those messages in case they were spamming and needed to be stopped.<\/p>\n","protected":false},"excerpt":{"rendered":"

    In this article I’m going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log. If you’ve read my previous article on how to find email accounts being used to spam, you should already know how to track down spam Read More ><\/a><\/p>\n","protected":false},"author":57014,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-814","post","type-post","status-publish","format-standard","hentry","category-email"],"acf":[],"yoast_head":"\nLocate spam activity by subject with Exim | InMotion Hosting<\/title>\n<meta name=\"description\" content=\"In this article I'm going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Locate spam activity by subject with Exim | InMotion Hosting\" \/>\n<meta property=\"og:description\" content=\"In this article I'm going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/\" \/>\n<meta property=\"og:site_name\" content=\"InMotion Hosting Support Center\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inmotionhosting\/\" \/>\n<meta property=\"article:published_time\" content=\"2013-01-22T23:46:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-17T03:23:49+00:00\" \/>\n<meta name=\"author\" content=\"InMotion Hosting Contributor\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/InMotionHosting\" \/>\n<meta name=\"twitter:site\" content=\"@InMotionHosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"InMotion Hosting Contributor\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/\"},\"author\":{\"name\":\"InMotion Hosting Contributor\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\"},\"headline\":\"Locate spam activity by subject with Exim\",\"datePublished\":\"2013-01-22T23:46:01+00:00\",\"dateModified\":\"2021-08-17T03:23:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/\"},\"wordCount\":746,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"articleSection\":[\"Email\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/\",\"name\":\"Locate spam activity by subject with Exim | InMotion Hosting\",\"isPartOf\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\"},\"datePublished\":\"2013-01-22T23:46:01+00:00\",\"dateModified\":\"2021-08-17T03:23:49+00:00\",\"description\":\"In this article I'm going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.inmotionhosting.com\/support\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Locate spam activity by subject with Exim\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#website\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"name\":\"InMotion Hosting Support Center\",\"description\":\"Web Hosting Support & Tutorials\",\"publisher\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#organization\",\"name\":\"InMotion Hosting\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"contentUrl\":\"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg\",\"width\":696,\"height\":696,\"caption\":\"InMotion Hosting\"},\"image\":{\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/inmotionhosting\/\",\"https:\/\/x.com\/InMotionHosting\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644\",\"name\":\"InMotion Hosting Contributor\",\"description\":\"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/inmotion-hosting\/\",\"https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting\"],\"url\":\"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Locate spam activity by subject with Exim | InMotion Hosting","description":"In this article I'm going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/","og_locale":"en_US","og_type":"article","og_title":"Locate spam activity by subject with Exim | InMotion Hosting","og_description":"In this article I'm going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.","og_url":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/","og_site_name":"InMotion Hosting Support Center","article_publisher":"https:\/\/www.facebook.com\/inmotionhosting\/","article_published_time":"2013-01-22T23:46:01+00:00","article_modified_time":"2021-08-17T03:23:49+00:00","author":"InMotion Hosting Contributor","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/InMotionHosting","twitter_site":"@InMotionHosting","twitter_misc":{"Written by":"InMotion Hosting Contributor","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#article","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/"},"author":{"name":"InMotion Hosting Contributor","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644"},"headline":"Locate spam activity by subject with Exim","datePublished":"2013-01-22T23:46:01+00:00","dateModified":"2021-08-17T03:23:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/"},"wordCount":746,"commentCount":0,"publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"articleSection":["Email"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/","url":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/","name":"Locate spam activity by subject with Exim | InMotion Hosting","isPartOf":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#website"},"datePublished":"2013-01-22T23:46:01+00:00","dateModified":"2021-08-17T03:23:49+00:00","description":"In this article I'm going to review how you can locate possible spam activity by subject on your VPS (Virtual Private Server) or dedicated server using the Exim mail log.","breadcrumb":{"@id":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.inmotionhosting.com\/support\/email\/locate-spam-activity-by-subject-with-exim\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inmotionhosting.com\/support\/"},{"@type":"ListItem","position":2,"name":"Locate spam activity by subject with Exim"}]},{"@type":"WebSite","@id":"https:\/\/www.inmotionhosting.com\/support\/#website","url":"https:\/\/www.inmotionhosting.com\/support\/","name":"InMotion Hosting Support Center","description":"Web Hosting Support & Tutorials","publisher":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inmotionhosting.com\/support\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.inmotionhosting.com\/support\/#organization","name":"InMotion Hosting","url":"https:\/\/www.inmotionhosting.com\/support\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/","url":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","contentUrl":"https:\/\/www.inmotionhosting.com\/support\/wp-content\/uploads\/2023\/02\/inmotion-hosting-logo-yoast.jpg","width":696,"height":696,"caption":"InMotion Hosting"},"image":{"@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inmotionhosting\/","https:\/\/x.com\/InMotionHosting"]},{"@type":"Person","@id":"https:\/\/www.inmotionhosting.com\/support\/#\/schema\/person\/f9a4fc454cd1df128ee8e898d30d4644","name":"InMotion Hosting Contributor","description":"InMotion Hosting contributors are highly knowledgeable individuals who create relevant content on new trends and troubleshooting techniques to help you achieve your online goals!","sameAs":["https:\/\/www.linkedin.com\/company\/inmotion-hosting\/","https:\/\/x.com\/https:\/\/twitter.com\/InMotionHosting"],"url":"https:\/\/www.inmotionhosting.com\/support\/author\/inmotion-hosting-contributor\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"primary_category":null,"_links":{"self":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/users\/57014"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/comments?post=814"}],"version-history":[{"count":3,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/814\/revisions"}],"predecessor-version":[{"id":85041,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/posts\/814\/revisions\/85041"}],"wp:attachment":[{"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/media?parent=814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/categories?post=814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inmotionhosting.com\/support\/wp-json\/wp\/v2\/tags?post=814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}