Fix Email Spamming Issues on cPanel Exim Servers

 

 

Note: All the commands below need to be run via SSH as the root user.

 

exim -bpc

This command shows the total number of emails in the queue. If there are a large number of mails in exim queue proceed with the following commands.
 

exim -bp | exiqsumm

 

exim -bp

This command will give you a close look at the emails in the queue. It will give details like message ID, sender, recipient, size and, age of mail. By using the ID we can analyze the header, body, and log information of emails in the queue.
 

exim -Mvh ID

This command displays the message header. From its output, we can check a lot of details about the email like; from address, to address, subject, date, script etc.

 

exim -Mvb ID

Displays the message body.

 

exim -Mvl ID

To get sorted list of mail sender using exim mail queue

 

exim -bpr | grep "<" | awk {'print $4'} | cut -d "<" -f 2 | cut -d ">" -f 1 | sort -n | uniq -c | sort -n

Note: temporarily suspend the account which is sending a large number of emails.

 

grep "cwd=/home" /var/log/exim_mainlog | awk '{for(i=1;i<=10;i++){print $i}}' | sort | uniq -c | grep cwd | sort -n

or

awk '{ if ($0 ~ "cwd" && $0 ~ "home") {print $3} }' /var/log/exim_mainlog | sort | uniq -c | sort -nk 1

or

grep 'cwd=/home' /var/log/exim_mainlog | awk '{print $3}' | cut -d / -f 3 | sort -bg | uniq -c | sort -bg

If we need to find out the exact spamming script. The following script will show the current spamming script running currently:

ps auxwwwe | grep <user> | grep --color=always "<location of script>" | head

The usage of the above script is as shown below.

 

ps auxwwwe | grep test8 | grep --color=always "/home/test8/public_html/wp/wp-content/themes/twentyeleven" | head

Once you find the exact script, the following script will help you to find the IP address which is responsible for spamming

grep "<script_name>" /home/user/access-logs/testdomain.com | awk '{print $1}' | sort -n | uniq -c | sort -n

This command will show the IPs which are connected to the server through port number 25.
 

If one particular IP is using more than 10 connections you can block it in the server firewall.

netstat -plan |grep :25 |awk {'print $5'} |cut -d: -f 1 |sort |uniq -c |sort -nk 1

The following script will give the summary of mails in the mail queue.

exim -bpr | exiqsumm -c | head

 

The exim command to remove emails from queue is;

exim -Mrm

 

To delete all emails from queue for a particular sender.

exim -bpr | grep sendername | awk '{print $3}' |xargs exim -Mrm

Removing frozen emails

exim -bp |grep frozen |awk {'print $3'} |xargs exim -Mrm