wafaa

Well-Known Member
May 14, 2013
83
1
8
cPanel Access Level
Reseller Owner
Hello,

I have several customers on a shared server and I found that the server address ip is blocked at spamhaus. Is there any way to know the account that sent spam and causing the blocking the IP address ?
 

cPanelPeter

Technical Analyst III
Staff member
Sep 23, 2013
574
17
143
cPanel Access Level
Root Administrator
Twitter
Hello,

You need to review the /var/log/exim_mainlog file. Also running the following command may help to identify the spammer or compromised account.

Code:
awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr
This command will list all accounts and number of messages sent.