Following script to view the authenticated user, Filename and script location of exim mail queue. We can use to find the spamming activities in exim.
echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n
For Example:
root@host [/home/usanunch/public_html]# echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n
Choose from the following options:
1. auth_id
2. X-PHP-Filename
3. X-PHP-Script
:1
84 -auth_id usanunch
root@host [/home/usanunch/public_html]# echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n
Choose from the following options:
1. auth_id
2. X-PHP-Filename
3. X-PHP-Script
:2
root@host [/home/usanunch/public_html]# echo -en "\nChoose from the following options:\n\n 1. auth_id\n 2. X-PHP-Filename\n 3. X-PHP-Script\n\n:"; read a; if [[ a -eq 1 ]]; then x=auth_id; elif [[ a -eq 2 ]]; then x=X-PHP-Filename; elif [[ a -eq 3 ]]; then x=X-PHP-Script; else echo "Ivalid option"; fi; exim -bp | grep "<" | awk '{print $3}' | xargs -n1 exim -Mvh | grep "$x" | sort -n | uniq -c | sort -n
Choose from the following options:
1. auth_id
2. X-PHP-Filename
3. X-PHP-Script
:3
84 149 X-PHP-Script: test.com/wp-content/plugins/ups-woocommerce-shipping-method/ups-woocommerce-shipping-method/func/oracle.php for 192.x.x.186