How can I find the source of spam mail

Question

I have a server running ISPConfig 3.1.2 which hosts roughly 8 sites (some Wordpress some custom).

Over the last month I have been receiving spam email the server host name. So for example I have a server called server3.myserver.co.uk. I have never set any email accounts up with this domain but I email's are coming through from Samuel@server3.myserver.co.uk and Justin@server3.myserver.co.uk.

These emails are typically trying to sell Male Pills. An example subject would be 'Male Pills Review & Advice'.

I have tried to see if my server has an open relay which it doesn't. I have also searched through logs and emails using the grep and the spam email address and cannot find the source of the problem.

Can anybody help me with a next step to try?

I have added an example email header if this helps.

Subject: Effective male enhancement
From: Justin@ks3.myhosting.co.uk
To: jason@mywebsite.co.uk
Message-Id: <853057187136552.WF62685@lfvl.heijmans.nl>
Content-Type: text/html;;
Content-Transfer-Encoding: 7Bit
Date: Sun, 15 Jan 2017 12:58:58 +0000 (GMT)

I'm voting to close this question as off-topic because it does not appear to be about programming within the scope defined in the help center. — jmoerdyk, Mar 03 '17 at 22:09

score 0 · Answer 1 · answered Mar 03 '17 at 21:52

You can spoof the sender's id of an email.
There is a possibility that a scammer just spoofs the sender id of your server while he is not even connected to it.
Face it - scamming can be a real pain.

Of course don't take this answer as granted, better digg deeper into the server and control every possible entrance.

score 0 · Answer 2 · answered Mar 03 '17 at 22:08

Spamming and faking someones Email, is often easier than what you think. I just don't think it's good to point out how to do this here. You can see senders IP address. So if the IP doesn't match your IP, you can be sure that you aren't hacked or something. to see sender's IP, visit here

How can I find the source of spam mail

2 Answers2