This morning, I was experimenting with some keyloggers and noticed that they have a feature to send e-mails to the attacker.

How can these e-mails be intercepted? Let us say that I have a packet sniffer running, which port should I listen to?

Note: The keyloggers I was using allowed the user to specify a gmail account (username and password) to send the email. Now, let us assume a real-life scenario where the keylogger was installed from the internet without the user's consent. What is the mechanism used to send the email? On what port does the email go through?

  • Hi Matthew, welcome to IT Security. There's no need to ask another question for the same matter. This question is closely related (if not the same) as your previous question. Please edit it and include the points you want to know more about, then leave a comment under the answers asking for more information. – Adi Mar 27 '13 at 16:53

The port will be undefined since it's not a service that's listening on a certain port. It will be assigned a random high port when trying to connect to the remote service. Therefore you cannot just look at the source port. The logger will probably connect to a remote server where the SMTP is running on port 25, but this might also be another port.

An approach to detect unusual streams would be to look at the email streams. Normally all clients in your network should connect to your own mail servers, so when programs start sending email by using another IP than your email server, it might be something fishy. It can of course also be legitimate. Also consider that the keylogger might just log in to your email server with valid credentials and email from there.

Also in your example you say that it requires a username and password, which means it will probably log on to the gmail mail server and send an email from there. This is completely encrypted. This means you need to look at the flows towards google mail servers and ask your employees if they were using gmail or not.

There really isn't a simple way to detect these attacks. The best way would be to use an anti-virus that can detect keyloggers on the machines. Regardless to say that this may be to avail as the machine was probably already compromised and an attacker might have added more than just a keylogger.

| improve this answer | |

E-mail is sent to (destination port) TCP port 25 (SMTP), port 587 (Submission), 465 (SSMTP)

Some servers will listen to other ports as well. Take a look at


| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.