Catching spammer on cpanel server

If mass mailing or spamming is going on cPanel server then you can trace the spammer with follwoing commands:

1 ) pidof exim

2) Belwo command will show you the no of emails sent by perticular domain:

exim -bp | exiqsumm | more

3)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have from or to the email address in the mail queue with exact figure.

4)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" |awk -F "@" '{ print $2}' | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have for the domain or from the domain with number.

5)

Check if any php script is causing the mass mailing with

cd /var/spool/exim/input

egrep "X-PHP-Script" * -R

Just cat the ID that you get and you will be able to check which script is here causing problem for you.

Exim Server Commands

How to check emails in mail queue?

exim -bpc

How to check full status of exim server?

eximstats -nr -ne /var/log/exim_mainlog

How to check exim pids running?

pidof exim

 

How to check frozen emails?

 exim -bpr | grep frozen | wc -l

How to delete frozen emails?

exiqgrep -z -i | xargs exim -Mrm

How to check mails sent per domain?

exim -bp | exiqsumm | more

   

Exim Logs

Message Reception and Delivery:

Location : /var/log/exim_mainlog or /var/log/exim/mainlog

Description : Receives an entry every time a message is received or delivered.


Exim ACLs/Policies based RejectLog :

Location : /var/log/exim_rejectlog

Description : An entry is written to this log every time a message is rejected based on either ACLs or other policies eg: aliases configured to :fail


Unexpected or Fatal Errors:

Location : /var/log/exim_paniclog

Description : Logs any entries exim doesn’t know how to handle. It's generally a really bad thing when log entries are being written here, and they should be properly investigated..


IMAP/POP/SpamAssassin General Logging and Errors:

Location : /var/log/maillog & /var/log/messages

Description : The IMAP, POP, and SpamAssassin services all log here. This includes all general logging information (login attempts, transactions, spam scoring), along with fatal errors.

How to check mass mailing with php script

With the help of below command you can check if anybody is doing mass mailing with php script on the exim mail server :

cd /var/spool/exim/input

egrep "X-PHP-Script" * -R