Check which script or file sending spam mail

[sahil3x1]

how i can check which script or file sending spam mail

i made ticket 2-3 times that one of my account sending spam mails n they told that php
file sending that remove that file can you tell me that command so i can check myself every time and how i can stop them

 

[Eminds]

It needs a course of commands to find the script that is spamming , the logs and the outputs needs to be monitored.

still.... use the below command to see from where the spams are initiating.

head -1 /var/log/exim_mainlog | awk '{print $1}' ; awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr | head --lines 15 | egrep -v ' cwd=(/$|/etc/csf|/var/spool/exim)' ; tail -1 /var/log/exim_mainlog | awk '{print From $1}'

 

[SysSachin]

Hi,
You have to find out spamming php script using below command also.

tail -n 1000 /var/log/exim_mainlog | grep /home

The above command will display the spam script path.

 

[cPanelMichael]

Hello,

You may also find these documents helpful:

How to Prevent Email Abuse - cPanel Knowledge Base - cPanel Documentation
How to Keep your Email out of the Spam Folder - cPanel Knowledge Base - cPanel Documentation

Thank you.

 

[samuelmf]

I have used the comands

head -1 /var/log/exim_mainlog | awk '{print $1}' ; awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr | head --lines 15 | egrep -v ' cwd=(/$|/etc/csf|/var/spool/exim)' ; tail -1 /var/log/exim_mainlog | awk '{print From $1}'
Output:

[email protected] [/]# head -1 /var/log/exim_mainlog | awk '{print $1}' ; awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr| head --lines 15 | egrep -v ' cwd=(/$|/etc/csf|/var/spool/exim)' ; tail -1 /var/log/exim_mainlog | awk '{print From $1}'
2022-01-16
1128 cwd=/usr/local/cpanel/whostmgr/docroot
92 cwd=/home/wwwcep
11 cwd=/home/peihap/public_html
4 cwd=/tmp
4 cwd=/home/oronegro/public_html
3 cwd=/home/wwwcep/public_html
3 cwd=/home/nortepalmeras/public_html
2 cwd=/home/pelccom/public_html
2 cwd=/home/cafepassmar/public_html
2 cwd=/home/bruckenenergyser/public_html
1 cwd=/root
1 cwd=/home/peihap/public_html/wp.peihap/wp-admin
2022-01-16

[email protected] [/]# tail -n 1000 /var/log/exim_mainlog | grep /home
[email protected] [/]#
Empty

My exim queue is still recieving email from peihap to send to gmail and other providers
I couldn't find the cause

 

[quietFinn]

You can prevent the cPanel account from sending emails, look here for info:

As a host, I want to be able to disable outbound email for an account when it has been compromised

As this is merged with other feature request (https://features.cpanel.net/topic/disable-email-accounts) I am starting new feature request. Please impleme

features.cpanel.net