Catching spammer on cpanel server

If mass mailing or spamming is going on cPanel server then you can trace the spammer with follwoing commands:

1 ) pidof exim

2) Belwo command will show you the no of emails sent by perticular domain:

exim -bp | exiqsumm | more

3)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have from or to the email address in the mail queue with exact figure.

4)

exim -bpr | grep "<*@*>" | awk '{print $4}'|grep -v "<>" |awk -F "@" '{ print $2}' | sort | uniq -c | sort -n

That will show you the maximum no of email currently in the mail queue have for the domain or from the domain with number.

5)

Check if any php script is causing the mass mailing with

cd /var/spool/exim/input

egrep "X-PHP-Script" * -R

Just cat the ID that you get and you will be able to check which script is here causing problem for you.