How to Find a Spammer on a cPanel Server

Aug 14

11 min read

Spam originating from a cPanel server can quickly become a serious problem. A compromised email account, hacked WordPress website, malicious PHP script, stolen SMTP credentials, or poorly secured application can send thousands of unwanted emails without the server administrator immediately knowing the source.

The consequences can include mail queues filling up, server IP blacklisting, email delivery failures, increased resource consumption, and damage to the reputation of hosted domains.

Fortunately, cPanel & WHM provides several tools that can help administrators identify the account responsible for suspicious outbound email.

In this guide, we will explain how to find a spammer on a cPanel server, how to inspect the Exim mail queue, analyze mail logs, identify the affected cPanel account, and take corrective action.

Important: The commands in this article require root-level access. Test commands carefully on production servers and avoid deleting the entire mail queue unless you are certain that it contains unwanted messages.

What Is a Spammer on a cPanel Server?

In a hosting environment, the term “spammer” usually refers to an email account, website, script, or compromised user account that is generating unusually large amounts of outbound email.

The source may be:

A compromised email account
A stolen email password
A hacked WordPress installation
A vulnerable PHP application
A malicious PHP mail script
A compromised cPanel account
A cron job running a spam script
An infected website file
An incorrectly configured contact form
A compromised SMTP account
A legitimate account being abused to send bulk mail

Therefore, finding the spammer is not simply a matter of looking for an email address. You need to determine which account or process is actually generating the messages.

Signs That a cPanel Server May Be Sending Spam

Before investigating individual accounts, look for warning signs.

Common indicators include:

A rapidly growing Exim mail queue
Large numbers of bounced emails
Complaints from customers about outgoing spam
Your server IP appearing on email blocklists
Gmail, Microsoft, Yahoo, or other providers rejecting mail
Unusually high CPU or server load
Unexpected increases in outbound SMTP traffic
Multiple domains experiencing delivery problems
Large numbers of messages from one email account
Unknown PHP scripts generating mail

cPanel’s Mail Statistics Summary can also help administrators understand overall mail activity on the server.

Step 1: Check the Exim Mail Queue

cPanel & WHM uses Exim as its mail transfer agent. The first place to investigate when you suspect outbound spam is the mail queue.

exim -bpc

This displays the total number of messages currently waiting in the Exim queue.

For example:

A large queue does not automatically mean that your server is compromised. Messages can remain queued because of temporary delivery problems.

However, a rapidly increasing queue combined with large numbers of unfamiliar recipients is a strong reason to investigate.

cPanel’s documentation confirms that exim -bpc can be used to determine the number of messages currently in the queue.

Step 2: Examine the Exim Queue

You can list messages currently waiting in the queue with:

exim -bp

For a more compact summary, administrators commonly use:

exiqsumm

Look for patterns such as:

Hundreds of messages to unrelated domains
Repeated recipients
Large numbers of messages from one sender
Similar subject lines
Suspicious sender addresses
Messages generated at unusually high frequency

The Mail Queue Manager in WHM provides a graphical alternative for viewing queued messages and includes fields such as sender, recipient, message ID, and received time.

Step 3: Identify the Sender

Once you notice suspicious messages, determine which sender is responsible.

You can inspect queue entries and look for the sender address.

For example:

exim -bp | less

Depending on the situation, you may see something resembling:

user@example.com

Do not assume that the visible From address is necessarily the compromised account.

A malicious script can sometimes spoof the From address.

This is why Exim logs and authentication information are important.

Step 4: Search the Exim Main Log

One of the most useful files for investigating outbound spam is:

/var/log/exim_mainlog

cPanel documents /var/log/exim_mainlog as an important Exim log and recommends examining it when troubleshooting queued mail.

You can inspect recent entries with:

tail -100 /var/log/exim_mainlog

For continuous monitoring:

tail -f /var/log/exim_mainlog

You can also search for a specific email address:

grep -i 'user@example.com' /var/log/exim_mainlog

Or search for a domain:

grep -i 'example.com' /var/log/exim_mainlog

When investigating spam, look for patterns involving:

Sender address
Recipient address
Message ID
Authentication
Local user
Remote IP
Delivery status
Repeated connections

Step 5: Use cPanel Mail Delivery Reports

WHM includes a Mail Delivery Reports interface that allows administrators with appropriate privileges to search email sent and received by accounts on the system.

Go to:

WHM → Email → Mail Delivery Reports

You can search by different parameters and specify a date and time range.

This is particularly useful when you already know:

Approximate time spam started
Sender address
Recipient domain
Delivery status
Message ID

The report can provide information including sender, authentication, recipient, message ID, delivery host, delivery IP address, and delivery result.

Step 6: Use cPanel Track Delivery

Individual cPanel users can also use:

cPanel → Email → Track Delivery

This interface allows users to trace email delivery and investigate delivery problems.

Track Delivery can be useful for identifying whether a message was:

Delivered
Deferred
Rejected
Filtered
Failed

The report also provides information about authentication and the message ID.

Step 7: Check SMTP Authentication

A very common cause of outbound spam is a compromised email password.

An attacker may obtain an email account password and use the account’s SMTP credentials to send spam.

Look for authentication-related information in the mail logs.

You should investigate:

Unexpected login locations
Unusual sending times
Large numbers of messages
Unknown IP addresses
Multiple simultaneous SMTP sessions
Recently compromised accounts

If you find evidence that an email password has been compromised, immediately change the password and review the account’s sending activity.

Do not simply delete the queued messages and assume the problem is fixed. The attacker may still have valid credentials.

Step 8: Check Dovecot Authentication Logs

Email authentication activity may also be visible in the system mail logs.

On many cPanel systems, useful logs include:

/var/log/maillog

or, depending on the operating system:

/var/log/mail.log

cPanel documents these files as containing Dovecot IMAP/POP3 login information and local mail delivery activity.

You can search for login-related activity with commands such as:

grep -i 'login' /var/log/maillog

You can then correlate suspicious authentication activity with the timestamps found in Exim logs.

Step 9: Determine Whether the Spam Comes From PHP

Not all spam originates from an email account.

A hacked website may send messages directly through PHP.

This is particularly common with:

WordPress
Joomla
Drupal
Custom PHP applications
Old contact forms
Outdated plugins
Vulnerable themes
Uploaded malicious scripts

If a website is generating spam, you need to identify the cPanel account running the application.

cPanel notes that PHP processes configured to run under the appropriate cPanel account user can make it easier to determine which account generated email.

Step 10: Search Website Files for Suspicious Scripts

If you suspect a compromised website, inspect the affected account’s files.

Common locations include:

public_html/

and application-specific directories.

Look for:

Recently modified PHP files
Unknown PHP files
Files with random names
Obfuscated PHP code
Suspicious upload files
Unexpected files outside the normal application structure
Modified WordPress core files
Unknown plugins or themes

Useful commands can include:

find /home/USERNAME/public_html -type f -mtime -2

This can show files modified recently.

You can also inspect PHP files:

find /home/USERNAME/public_html -type f -name "*.php"

Be careful when searching for strings such as mail() or base64_decode(). These functions are not automatically malicious; legitimate applications may use them.

The goal is to identify unusual combinations and recently changed files, not to delete files simply because they contain a particular PHP function.

Step 11: Check Cron Jobs

A compromised account may contain a malicious cron job that repeatedly launches a spam script.

Check the user’s cron configuration:

crontab -u USERNAME -l

Also review system-wide cron locations where appropriate:

/etc/cron.d/
/etc/cron.daily/
/etc/cron.hourly/
/etc/cron.weekly/
/etc/cron.monthly/

Look for unfamiliar scripts or commands.

If you discover a suspicious cron job, investigate the script it launches before removing it so that you preserve useful evidence.

Step 12: Check for a Compromised cPanel Account

Sometimes the actual problem is not an individual mailbox but an entire cPanel account.

Warning signs include:

Multiple suspicious email accounts
Unknown FTP users
Modified website files
Suspicious cron jobs
Unknown WordPress administrators
High PHP activity
Large numbers of outbound messages
Unexpected SSH activity

If the evidence points to the cPanel account itself, consider temporarily suspending the affected service while investigating.

Step 13: Suspend or Hold the Suspected Email Account

If you have identified a compromised mailbox, cPanel allows administrators to control its outgoing mail.

cPanel’s email account management features include options to Allow, Hold, or Suspend sending activity. When outgoing mail is placed on hold, messages remain in the queue rather than being immediately delivered.

This can be useful when you need time to investigate without allowing additional spam to leave the server.

A practical response is:

Identify the suspicious account.
Hold or suspend outgoing mail.
Change the password.
Check authentication logs.
Investigate the associated website if necessary.
Remove the underlying vulnerability.
Review queued messages.
Resume sending only after the account is secured.

Step 14: Inspect the Message Headers

Individual queued messages can provide valuable information.

First obtain the message ID:

exim -bp

Then inspect the headers:

exim -Mvh MESSAGE-ID

You can inspect the message body with:

exim -Mvb MESSAGE-ID

This can help determine:

Original sender
Recipient
Subject
Authentication information
Message routing
Potential source information

Do not expose complete message contents publicly because email messages can contain private information.

Step 15: Check the Exim Log for the Message ID

Once you have a suspicious message ID, search the Exim log:

grep 'MESSAGE-ID' /var/log/exim_mainlog

This can reveal additional information about how the message was generated and processed.

Correlating the message ID, timestamp, sender, authentication details, and account activity is often more reliable than relying on the From address alone.

Step 16: Check cPanel’s Spammer Detection Settings

cPanel & WHM includes settings that can monitor the number of unique recipients an email account sends to within an hour.

In:

WHM → Server Configuration → Tweak Settings → Mail

administrators can configure a threshold for potential spammer detection.

cPanel documents an option to monitor the number of unique recipients per hour and specify an action when an account is detected as a potential spammer. Available actions include taking no action, holding outgoing mail, or rejecting outgoing mail.

This is useful as a preventive control, rather than relying entirely on manual investigation.

Step 17: Enable Sender Rate Logging

cPanel’s Exim Configuration Manager includes an option to log sender rates in the Exim main log.

This can be helpful when tracking excessive email activity and potential spammers.

Navigate to:

WHM → Service Configuration → Exim Configuration Manager → Basic Editor

Review the available mail-related options and enable sender-rate logging where appropriate for your environment.

Because cPanel configuration options can change between versions, verify the available settings on your installed version before applying changes.

Step 18: Enable SMTP Restrictions

Another useful security measure is SMTP Restrictions.

In WHM, go to:

WHM → Security Center → SMTP Restrictions

cPanel explains that this feature can prevent users and services from bypassing the server’s mail transport agent and connecting directly to remote SMTP servers.

This can help prevent applications or compromised accounts from circumventing normal mail controls.

This is particularly useful on shared hosting servers where multiple websites and users are hosted on the same machine.

Step 19: Scan for Malware

If the evidence points to a website rather than an email account, perform a malware investigation.

Depending on your hosting environment, you may use:

ImunifyAV or another malware scanner
ClamAV
WordPress security scanners
Manual file inspection
File modification analysis
Server-side malware detection tools

Do not rely exclusively on a malware scanner.

A compromised website can sometimes contain malicious code that appears similar to legitimate application code.

Step 20: Check WordPress and Other CMS Applications

If the affected account runs WordPress, check:

WordPress core version
Plugins
Themes
Administrator accounts
Recently modified files
Unknown plugins
Unknown themes
Upload directories
Scheduled tasks
Database users
API credentials

Immediately update vulnerable software after preserving the evidence you need for investigation.

Also remove abandoned plugins and themes that are no longer required.

Step 21: Check Whether the Server Is Being Used as an Open Relay

A properly configured Exim installation should not operate as an unrestricted open relay.

If you suspect relay abuse, review the Exim configuration and SMTP settings.

Do not modify Exim configuration files blindly.

Use:

WHM → Service Configuration → Exim Configuration Manager

for supported configuration changes. cPanel provides the Exim Configuration Manager for managing Exim settings.

Step 22: What to Do After Finding the Spammer

Finding the account is only the first part of the process.

Once you identify the source:

If it is a compromised email account

Change the email password.
Review login activity.
Check for suspicious forwarding rules.
Hold or suspend outgoing mail temporarily.
Remove unwanted queued messages.
Re-enable sending after verification.

If it is a hacked website

Take a backup for investigation.
Scan the website.
Remove malicious files.
Update the CMS.
Update plugins and themes.
Reset administrator passwords.
Review FTP/SFTP credentials.
Review cron jobs.

If it is a compromised cPanel account

Secure the account.
Reset relevant credentials.
Investigate websites and email accounts.
Review FTP and SSH access.
Search for malware and persistence mechanisms.

If it is a server-level compromise

Treat the incident as a security event.

Review:

SSH access
Root login activity
Recently installed software
Cron jobs
Running processes
System accounts
Web server logs
Malware indicators
Firewall activity

In serious cases, rebuilding the affected server from a known-clean image may be safer than attempting to clean a deeply compromised system.

Step 23: Clean the Exim Mail Queue Carefully

After confirming that messages are malicious, you may remove them from the queue.

For example, cPanel documents:

exiqgrep -f user@example.com -i | xargs exim -Mrm

for removing queued messages associated with a particular sender.

Be extremely careful with queue deletion.

Do not run a command that deletes the entire Exim queue simply because spam is present.

The queue may also contain legitimate customer email.

cPanel specifically warns that deleting the entire queue removes all queued messages and that deleted messages cannot be recovered.

Step 24: Check Your Server’s Email Reputation

After stopping the spam, check whether your server IP has been listed by major blocklists.

Also examine:

SPF
DKIM
DMARC
Reverse DNS/PTR
HELO/EHLO hostname
SMTP configuration
Sending IP reputation

Correct email authentication can help receiving systems determine whether messages are legitimately authorized.

cPanel recommends using SPF and DKIM to improve email authentication and reduce spoofing-related problems.

A Practical cPanel Spam Investigation Workflow

When you receive a spam complaint, follow this sequence:

Spam Complaint

↓

Check Exim Queue

↓

Identify Message IDs

↓

Inspect Exim Main Log

↓

Identify Sender / Authentication

↓

Determine Account or Website

↓

Check Email Login Activity

↓

Check Website Files

↓

Check Cron Jobs

↓

Secure Compromised Account

↓

Remove Malicious Queue Messages

↓

Check IP Reputation

↓

Monitor Outgoing Mail

This approach helps avoid guessing and gives you a repeatable incident-response process.

Useful Commands for cPanel Spam Investigation

Here is a quick reference:

Count messages in Exim queue

exim -bpc

Display Exim queue

exim -bp

Summarize queue

exiqsumm

Follow Exim main log

tail -f /var/log/exim_mainlog

Search Exim log for an email address

grep -i 'user@example.com' /var/log/exim_mainlog

Search for a domain

grep -i 'example.com' /var/log/exim_mainlog

Inspect message headers

exim -Mvh MESSAGE-ID

Inspect message body

exim -Mvb MESSAGE-ID

Remove one message

exim -Mrm MESSAGE-ID

Display a user's cron jobs

crontab -u USERNAME -l

Find recently modified website files

find /home/USERNAME/public_html -type f -mtime -2

Always verify commands against your cPanel/WHM and operating-system version before using them on a production server.

How to Prevent Spammers on a cPanel Server

Finding a spammer after the server has already been abused is reactive. A better strategy is to combine detection with prevention.

1. Use Strong Email Passwords

Require strong, unique passwords for email accounts.

Avoid passwords that are:

Short
Common
Reused
Based on domain names
Based on company names

2. Secure WordPress and CMS Applications

Keep:

CMS software
Plugins
Themes
PHP
Server software

up to date.

Remove unused software.

3. Monitor Outbound Email

Regularly monitor:

Queue size
Sender rates
Delivery failures
SMTP authentication
Suspended accounts
Unusual recipient patterns

4. Configure Spam Detection

Use cPanel’s available outbound mail controls and potential-spammer detection features where appropriate.

5. Enable SMTP Restrictions

SMTP Restrictions can help prevent websites and users from bypassing the server’s normal mail transport controls.

6. Use SPF, DKIM and DMARC

Correct email authentication helps protect domain reputation and reduces spoofing-related problems.

7. Keep Backups

Maintain reliable backups of:

Websites
Databases
Email configuration
Server configuration

Backups are especially important when dealing with compromised websites.

Final Thoughts

Finding a spammer on a cPanel server requires more than checking the email queue. The visible sender address may not identify the real source of the abuse.

The most effective investigation combines Exim queue analysis, Exim log analysis, Mail Delivery Reports, SMTP authentication records, website inspection, cron-job analysis, and cPanel account monitoring.

Start with:

exim -bpc

Then inspect:

exim -bp

and:

/var/log/exim_mainlog

From there, correlate the sender, message ID, timestamps, authentication information, cPanel account and website activity.

Most importantly, do not stop after deleting spam from the queue. If the underlying compromised email account, password, website, plugin, script, or cron job remains active, the spam will usually return.

A good cPanel server security strategy therefore combines detection, containment, cleanup and prevention.