What are the tips for finding email spam sending scripts? I ask because usually I hit a wall in shared hosting environments, so I ask this question as a way to get some insight from others.
What I do:
- Check RBL's for the IP and possibly get the time the IP was listed.
- Go through transfer.logs and FTP logs looking for any malicious activity.
- Will watch transfer.logs in "live" mode (
tail -fn0) watching for malicious activity.
- grep for most recently modified script files (py,cgi,pl,php).
clamav; rarely finds any spam scripts though ;(
stracemail process if I have to.
- Check if the
UIDof the sent script goes back to a user.
- Check for
- Utilize the findbot.pl script: http://cbl.abuseat.org/findbot.pl