Spam

[wafaa]

Hello,

I have several customers on a shared server and I found that the server address ip is blocked at spamhaus. Is there any way to know the account that sent spam and causing the blocking the IP address ?

 

[cPanelPeter]

Hello,

You need to review the /var/log/exim_mainlog file. Also running the following command may help to identify the spammer or compromised account.

awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr

This command will list all accounts and number of messages sent.