How to Identify and Mitigate Email Spamming from Your Server

If you suspect that your server is being used to send spam emails, it’s crucial to identify the source and take appropriate action. Follow the steps outlined below to track and mitigate the spamming activity.

Step 1: Log in via SSH

Start by logging into your server using SSH. Open your terminal and use the following command:

ssh your_username@your_server_ip

Step 2: Identify the Source of Spamming

Run the following command to check the directories from where emails are being sent:

grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n

This command will give you an output similar to the following:

1 /home/cpanelusername/public_html/wp-admin
1 /root
7147 /etc/csf
14086 /home/cpanelusername/public_html/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib

Identify the directory with the highest count, as it is likely the source of the spamming. For instance, in the output above, the problematic directory is /home/cpanelusername/public_html/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib.

Step 3: Navigate to the Identified Directory

Change your directory to the suspected location:

cd /home/cpanelusername/public_html/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib

Step 4: Check the Files in the Directory

List the files present in the directory:

ls

Step 5: Monitor Sent Emails

If multiple files are present, you need to identify which file is sending the emails. Use the following command to monitor the email logs:

tail  -f /var/log/exim_mainlog

You will see an output similar to this:

2022-10-24 03:56:18 1omlLh-0005Ep-1A ==user@email.com routing defer (-52): retry time not reached
2022-10-24 03:56:18 1omsJl-0004KG-GY Sender identification U=cpanelusername D=domain.com S=user@email.com
2022-10-24 03:56:18 1omsJl-0004KG-GY SMTP connection outbound 1666598178 1omsJl-0004KG-GY domain.com user@email.com

Step 6: Examine the Email Header

Select one of the message IDs from the log (e.g., 1omsJl-0004KG-GY) and view its header information:

exim -Mvh 1omsJl-0004KG-GY

You will get details like:

Subject: Herbal Pills
X-PHP-Script: domainmediotostorage.com/wp-content/plugins/wordfence/vendor/wordfence/wf-waf/src/lib/lib.php for IP address
X-PHP-Originating-Script: 1002:lib.php(141) : eval()'d code
From: Email <user@email.com>
Reply-To: user@email.com

Here, the file name (lib.php) and IP address will be displayed, helping you pinpoint the offending script.

Step 7: Secure the Malicious File

Change the file permissions to prevent further execution:

chmod 0000 filename.php

Apply a chattr to the file to make it immutable:

chattr +ai filename.php

If you need to remove the immutable attribute later, use - instead of +.

Rename the malicious file to prevent it from being executed:

mv lib.php lib_old.php

Step 8: Blacklist the Malicious IP

Block the offending IP address using CSF (ConfigServer Security & Firewall):

csf -d IP_ADDRESS

Step 9: Verify the Changes

Check the email logs again to ensure no further spam emails are being sent:

tail -f /var/log/exim_mainlog

Additional Commands

To count the total number of emails in the Exim mail queue:

exim -bpc

To count the number of emails sent by a specific user on a particular day:

cat /var/log/exim_mainlog | grep cpanelusername | grep 2022-10-24 | wc -l

By following these steps, you can effectively identify and stop spamming activities from your server, ensuring the security and reputation of your email system.