[SURBL-Discuss] How to figure out the virtual host, containing malware

Hello,

we are operating email servers and approx 100 virtual web servers on the same machine.

Some email receivers do block our emails, because our server seems to distribute malware on a virtual webserver and is now listed on surbl.org.

Ok, now I have to figure out, which of our 100 customers is hosting a malware on his virtual webserver, most like without knowledge and being victime of a spyware or an unsecure CMS. (The latter should be of course removed asap from our server.)

I wonder, how can I get a hint, which customer's web space is affected? Is there any mean to get more details from surbl.org, about the malware source? Domainname or addidional even a filename would be very helpful.

Thanks for any hints! Roger.