Linux for the Real World

Had an issue with a customers server and it being reported of sending out spam.

Went and had a look at the mail queue and there were a couple of hundred rejected emails sitting in the queue unable to be delivered due to invalid addresses. So how many had been sent to successful addresses?

/var/log/maillog

cat /var/log/maillog|grep "from=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >"

Feb 26 23:51:48 xxx sendmail[24483]: o1QApmA3024483: from=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, size=2517,, nrcpts=100, msgid=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, proto=ESMTP, daemon=Daemon0, relay=localhost [127.0.0.1]

Feb 26 23:52:45 xxx sendmail[24573]: o1QAqj3q024573: from=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, size=2517,, nrcpts=100, msgid=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, proto=ESMTP, daemon=Daemon0, relay=localhost [127.0.0.1]

Feb 27 00:01:55 xxx sendmail[25544]: o1QB1tZ0025544: from=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, size=2513,, nrcpts=100, msgid=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, proto=ESMTP, daemon=Daemon0, relay=localhost [127.0.0.1]

Feb 27 00:03:49 xxx sendmail[25898]: o1QB3nvL025898: from=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, size=2513,, nrcpts=100, msgid=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >, proto=ESMTP, daemon=Daemon0, relay=localhost [127.0.0.1]

then

cat /var/log/maillog|grep -c "from=<
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
 >"
70

70 emails sent with 60 to 100 recipients in each.

var/log/http/access.log

cat /var/log/httpd/access_log|grep "26/Feb/2010:23:52"
cat /var/log/httpd/access_log|grep "26/Feb/2010:23:52"
cat /var/log/httpd/access_log|grep "27/Feb/2010:00:01"
cat /var/log/httpd/access_log|grep "27/Feb/2010:00:03"

Each one has a compose statment from Horde

41.217.65.3 - - [26/Feb/2010:23:52:18 +1300] "POST /horde/imp/compose.php?uniq=62pyjpm6iua1 HTTP/1.1" 200 73 "http://xxx.xxxxxx.net.nz/horde/imp/compose.php?thismailbox=INBOX&uniq=1267181512410" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;SV1; InfoPath.2)"

/tmp/horde.log

Therefore lets have a look at the Horde log file.

cat /tmp/horde.log |grep "Feb 26 23:"

Feb 26 23:49:39 HORDE [notice] [imp] Login success for 
  This e-mail address is being protected from spambots. You need JavaScript enabled to view it
  [41.217.65.3] to {xxx.xxxxxx.net.nz:143} [on line 154 of "/var/www/html/horde/imp/redirect.php"]

Notice the IP address 41.217.65.3

cat /var/log/httpd/access_log|grep "41.217.65.3"|grep -c  /horde/imp/compose.php

2024

That is 2024 accesses to compose emails from this IP Address.

This is not a program but a person who has cracked the user This e-mail address is being protected from spambots. You need JavaScript enabled to view it password and is using this account to send spam.

cat /tmp/horde.log |grep "41.217.65.3"

Shows this started on the 19th, but did not take off till the 25th.

41.217.65.3

whois 41.217.65.3

[Querying whois.afrinic.net]

[whois.afrinic.net]

% This is the AfriNIC Whois server.

% Note: this output has been filtered.

% Information related to '41.217.0.0 - 41.217.127.255'

inetnum: 41.217.0.0 - 41.217.127.255

netname: ZOOMNIGERIA

descr: ZOOM Mobile Nigeria Ltd

country: NG

admin-c: AI22-AFRINIC

tech-c: EK8-AFRINIC

org: ORG-ZMNL1-AFRINIC

status: ALLOCATED PA

mnt-by: AFRINIC-HM-MNT

mnt-lower: ZOOMNIGERIA-MNT

mnt-domains: ZOOMNIGERIA-MNT

source: AFRINIC # Filtered

parent: 41.0.0.0 - 41.255.255.255

organisation: ORG-ZMNL1-AFRINIC

org-name: ZOOM Mobile Nigeria Ltd

org-type: LIR

country: NG

address: 8A, Adeola Odeku Street

address: City: Victoria Island, Lagos

address: Postal Code: 999999*

address: Lagos

e-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it

e-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it

e-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it

phone: +234-1-4312811

admin-c: AI22-AFRINIC

admin-c: TI3-AFRINIC

tech-c: EK8-AFRINIC

mnt-ref: AFRINIC-HM-MNT

mnt-ref: ZOOMNIGERIA-MNT

mnt-by: AFRINIC-HM-MNT

source: AFRINIC # Filtered

person: Andy Ibekaku

remarks: Chief Technical Officer (CTO)

remarks: ZOOM Mobile Nigeria Ltd

address: 8A, Adeola Odeku Street,

address: Victoria Island,

address: Lagos, Nigeria

phone: +23414807505

e-mail: This e-mail address is being protected from spambots. You need JavaScript enabled to view it

org: ORG-ZMNL1-AFRINIC

nic-hdl: AI22-AFRINIC

mnt-by: ZOOMNIGERIA-MNT

source: AFRINIC # Filtered

person: Emi Kennedy

remarks: IP/VSAT Transmission

remarks: ZOOM Mobile Nigeria Ltd

address: 8A, Adeola Odeku Street,

address: Victoria Island,

address: Lagos, Nigeria

phone: +23414312811

</code>

Not much luck going there.