Thread: How do you track a spammer that is sending using nobody

I have a spammer on one of my servers but I cannot find the user that owns the account. They are using a script that runs as nobody and then sends out bulk email with no identity. Any ideas of how to track this down?

I have scanned the logs over and over and nothing stands out or referencing a user on the server.

Can you provide a little more information about mail server, web server, control panel etc?

Originally Posted by nixcraft

Can you provide a little more information about mail server, web server, control panel etc?

Sure it's centos 5, exim (exim-4.69-23.1_cpanel_maildir)

Cpanel, Apache 2.2, php5, mysql 5

Thanks,