SPAM Email getting sent through default email ( I think )

[mlong2001]

I have a site where I am fighting some SPAM emails from being sent through our server. These are clearly SPAM emails you can see that in the attached image. I need to get them stopped but what I have tried so far has not worked completely. They have however slowed down slightly but not completely.

There are no emails on the cPanel account other than the default email that I cannot turn off.

This is what I have done ...
Changed Password on the cPanel Account which then in turn changes the password on the default email account.
Made sure nobody sending emails is turned on
Made sure SMTP restriction is turned on

What else is there to do? Or what should I add to my list?

 

[cPRex]

Hey there! Your best option would be to look through the Exim logs as outlined here:

How to find the source of spam emails

Introduction In this article, we will be exploring means to determine how spam emails were sent from your server. This is meant to guide you in the right direction in which a further, more in-dep...

support.cpanel.net

Since your issue has already happened, you can likely just skip down to the large command of

awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr

to parse the Exim log and see where messages are coming from. Here is an example from my personal server, although I don't have much mail activity:

# awk '$3 ~ /^cwd/{print $3}' /var/log/exim_mainlog | sort | uniq -c | sed "s|^ *||g" | sort -nr
508 cwd=/etc/csf
81 cwd=/var/spool/exim

That would at least tell you the directories that are sending email.

 

[mlong2001]

I know what account it is coming from. I just dont know how to make it stop.

 

[cPRex]

Knowing the account is only half the battle. Those logs would show the exact directory the mail is being sent from, which should help you find the location of the script that is sending the message, if it is an automated script.

 

[mlong2001]

So when I run that it gives me just the directory of the account ... not a subdirectory to go look in a folder for files / code that is sending an email. Is there another command to drill down into that?

 

[cPRex]

No, that would indicate the email is coming from that directory. That means you'd want to check /home/username (or whatever specific directory it says) for files that could be sending the email.

 

[ebizindia]

what can I infer from this?
47692 cwd=/var/spool/exim

 

[cPRex]

That would be how many total messages have been sent from your server since the last time the Exim log was rotated.