How to find which PHP file is currently running?

Hi @elisom

The best thing to do is find the PHP file sending the spam. We have a script we run internally that might be helpful for you:

Code:

perl <(curl -s https://raw.githubusercontent.com/cPanelTechs/SSE/master/sse.pl) -s

The portion "Directories mail is originating from:"specifically.

There are of course other methods that can be used such as those noted in the threads as follows:
Cant find script sending spam
Check which script or file sending spam mail
Identify account sending spam?

 

Hi @elisom


When you're running this or any of the suggestions I've provided are you logged in as the root user? I can confirm any one of the three commands I provided does work, I've used them all myself.