Automatic generation of "View Sent Summary" reports. a.k.a Spam Bot woes.

[james wilmington]

Hello,

We have a number of managed WHM/cPanel servers hosted by a UK web host.

We are having issues where certain websites/domains/accounts on server-X have been compromised and are sending out hundreds of thousands of spam messages.

The only time we ever hear about this is AFTER the even has occurred, and the the IP address of the server has been blacklisted on real-time blacklists, and the UK Web Host has terminated the accounts. We are able to disinfect the websites using ClamAV but this is very REactive.

We are searching for a method to monitor email sending/receving on our WHM/cPanel servers, ideally with the ability to email us when a domain/website sends out more than 5000 mails per hour/day etc.

Please can anyone advise me on how to proceed? Perhaps someone knows of a WHM plugin that can be installed, that would do this. Or if there are things that can be done natively to help (perhaps automatically generating "sent summary" reports for the last 24 hours etc)

Thanks

 

[Infopro]

WHM » Server Configuration » Tweak Settings, Mail tab has settings that can help.

ConfigServer Firewall, can also be a huge help.

 

[james wilmington]

Thank you for your help. This "Tweak Settings" option isn;t available on our server, so i will have to speak to the host about enabling it.

WHM » Server Configuration » Tweak Settings, Mail tab has settings that can help.

ConfigServer Firewall, can also be a huge help.

 

[Infopro]

As a Reseller, many options in WHM might not be available to you, ConfigServer Firewall included. And if they're not, then who ever is managing the server for you needs to take better care of things.
Your job would be making sure those "certain accounts" you mention, are staying up to date and are secure.

GL!

 

[james wilmington]

Yes, I will ask them to enable this option for us.

Thank you for your advice.

As a Reseller, many options in WHM might not be available to you, ConfigServer Firewall included. And if they're not, then who ever is managing the server for you needs to take better care of things.
Your job would be making sure those "certain accounts" you mention, are staying up to date and are secure.

GL!