Tracking down more spam :(

[dljordaneku]

We got a call from our ISP that we were spamming again. It appears that an account password was hacked and being used to send out spam. One question I have is were they using the webclient to send it out. Here is something from the header of one of the spam messages that went out.

X-Mailer: Zimbra 5.0.8_GA_2462.F7 (zclient/5.0.8_GA_2462.F7)

Thanks.

dj

[y@w]

Check out /opt/zimbra/audit.log for the break-in (then successful login) attempts.

[dljordaneku]

Well I know they were hacked. I have over 60 spam messages caught in our ISP's spam filter saying it was hacked. I am asking does that header information show they used the webclient to do it.

dj

[y@w]

Right, the audit logs will tell you what IP and access method they used.

[dljordaneku]

Ok. cool. thanks.

dj