ConfigServer Community Forum

I haven't been near our Mail Scanner software in a little over a year, an admin who just left had been handling it.

But as I remember sending scripts would be tagged in message headers, that way it is easy to identify malicious scripts.

We've recently had a run-in with a script sending spam, it was sending from localhost at 127.0.0.1 and random ports, so I assume it's a script but as such there was no information that would allow us to such it down, the old sending script line in the header is no longer there.

Is there any solution to this? Has this changed or am I imagining things?

I'm not aware that MailScanner adds the sending script to the headers. Any information about the sending script would be best searched for in your exim logs, assuming you have extended logging configured.

I.e., this line in the first box of your WHM Advanced Exim Configuration Editor:

log_selector = +arguments +subject +received_recipients