DE

↑ ↓ select, Enter open, Esc close

Trace local PHP mail sending to a system user

harmless rootMaildebian, ubuntu
Adjust the values, the command updates live
root@server
grep "postfix/pickup" /var/log/maillog | grep -o "uid=[0-9]*" | sort | uniq -c | sort -rn | head -10

Mail that PHP scripts send via sendmail appears in the log with the UID of the submitting user. The list shows which UID sends the most. Using id -nu with the UID gives you the system user and thus the webspace.

Note: With PHP-FPM running as the domain user, the mapping is unambiguous. If PHP runs as an Apache module, only the UID of www-data appears.

Also searched as

  • website sending spam
  • which script is sending emails
  • find spam sent via contact form

Related one-liners

All in Mail

Find a hacked mail account by its SMTP logins

#grep -o "sasl_username=[^ ,]*" /var/log/maillog | sort | uniq -c | sort -rn | head -20
harmlessMail

Delete all deferred mail from the Postfix queue

#postsuper -d ALL deferred
destructiveMail

Delete all mail from one sender in the Postfix queue

#postqueue -p | awk -v s="info@example.com" '/^[0-9A-Za-z]/ && $7 == s {print $1}' | tr -d '*!' | postsuper -d -
destructiveMail

Find permanently rejected emails in the mail log

#grep "status=bounced" /var/log/maillog | tail -n 20
harmlessMail

Find the top senders in the Postfix queue

$postqueue -p | awk '/^[0-9A-Za-z]/ {print $7}' | sort | uniq -c | sort -rn | head -20
harmlessMail

Trace delivery for an email address in the mail log

#grep -i "info@example.com" /var/log/maillog | tail -n 50
harmlessMail

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.