spam Mail going out, where and how to find it?

[vikozo]

Spam or missconfigured somthing with mail


Hello
since a couple of day, i belive (but not sure) since the Proxmox to 4.0-48 upgrade, the Swisscom is closing my Internetport because of to much "to many invalid email user rebonce " they are not able to tell where it comes from nor where it goes, just it is levaing my connection.

at this time i have

Fritzbox 7390 newest SW

HostServer (with Proxmox 4, with apt-get update und apt-get upgrade)
- Web/Mail/Bind Server (Ispconfig newest SW, apt-get update und apt-get upgrade)
the Server is also exposed to the the Internet Configuration on the Fritzbox
- Intern Munin Server
- Intern OpenMediaVault Server as Backup for MacAir

so where to find how is doing this Rebound Requests?

Thanks for further Information wher to dig which log file to read...

have a nice day
vinc

 

[sigxcpu]

Most likely your hosting server is hacked.

 

[mmenaz]

In proxmox maybe having a look at tcpudmp on the tcp port 25 of the bridge and you should see traffic and see the originating IP, or tcpdumo in eth0 of each of your vm, still port 25 (smtp). Or your Fritzbox has some vulnerability.

 

[vikozo]

Most likely your hosting server is hacked.

yes i think so, but this was not the question - but to solve to stop it!

 

[sigxcpu]

I don't know. Search Google for ispConfig support?