DE

↑ ↓ select, Enter open, Esc close

Find a hacked mail account by its SMTP logins

harmless rootMaildebian, ubuntu
Adjust the values, the command updates live
root@server
grep -o "sasl_username=[^ ,]*" /var/log/maillog | sort | uniq -c | sort -rn | head -20

Counts how often each account authenticated via SMTP and submitted a message. An account with hundreds or thousands of entries, often from changing IPs, points to a compromised password. Afterwards, change the password and clean up the queue.

Also searched as

  • which mailbox is sending spam
  • find out if email account is hacked
  • server blacklisted because of spam

Related one-liners

All in Mail

Trace local PHP mail sending to a system user

#grep "postfix/pickup" /var/log/maillog | grep -o "uid=[0-9]*" | sort | uniq -c | sort -rn | head -10
harmlessMail

Delete all deferred mail from the Postfix queue

#postsuper -d ALL deferred
destructiveMail

Delete all mail from one sender in the Postfix queue

#postqueue -p | awk -v s="info@example.com" '/^[0-9A-Za-z]/ && $7 == s {print $1}' | tr -d '*!' | postsuper -d -
destructiveMail

Find permanently rejected emails in the mail log

#grep "status=bounced" /var/log/maillog | tail -n 20
harmlessMail

Find the top senders in the Postfix queue

$postqueue -p | awk '/^[0-9A-Za-z]/ {print $7}' | sort | uniq -c | sort -rn | head -20
harmlessMail

Trace delivery for an email address in the mail log

#grep -i "info@example.com" /var/log/maillog | tail -n 50
harmlessMail

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.