Email spam originating from compromised websites, vulnerable scripts, or unauthorized users can negatively impact your server’s reputation and lead to IP blacklisting. On cPanel servers, Exim MTA provides detailed logging that can help administrators identify the source of spam emails. This guide explains how to enable advanced Exim logging and trace spam emails back to the responsible script, user account, or website.<\/p>\n\n\n\n
Before proceeding, ensure the following:<\/p>\n\n\n\n
vi \/etc\/exim.conf\n<\/pre>\n\n\n\n\n
- Locate the line:<\/li>\n<\/ol>\n\n\n\n
hostlist auth_relay_hosts = *\n<\/pre>\n\n\n\n\n
- Add the following line immediately after it (ensure it remains on a single line):<\/li>\n<\/ol>\n\n\n\n
log_selector = +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_sender +received_recipients +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdn\n<\/pre>\n\n\n\n\n
- Save the file and exit.<\/li>\n\n\n\n
- Restart Exim:<\/li>\n<\/ol>\n\n\n\n
service exim restart\n<\/pre>\n\n\n\n\n
- Monitor the Exim log file:<\/li>\n<\/ol>\n\n\n\n
tail -f \/var\/log\/exim_mainlog\n<\/pre>\n\n\n\n
\n\n\n\nStep 2: Identify the Spam Message ID<\/h3>\n\n\n\n
Obtain the Message-ID from the email header. Example:<\/p>\n\n\n\n
1DWJj4-00042i-74\n<\/pre>\n\n\n\nThis Message-ID is critical for tracing the source of the spam email.<\/p>\n\n\n\n
\n\n\n\nStep 3: Search Exim Logs<\/h3>\n\n\n\n
Search for the Message-ID in Exim logs:<\/p>\n\n\n\n
grep \"1DWJj4-00042i-74\" \/var\/log\/exim_mainlog\n<\/pre>\n\n\n\nReview:<\/p>\n\n\n\n
\n
- Sender address<\/li>\n\n\n\n
- Recipient address<\/li>\n\n\n\n
- Delivery path<\/li>\n\n\n\n
- Script location<\/li>\n\n\n\n
- Username<\/li>\n\n\n\n
- Timestamp<\/li>\n<\/ul>\n\n\n\n
\n\n\n\nStep 4: Identify the Responsible User or Script<\/h3>\n\n\n\n
If the log output reveals:<\/p>\n\n\n\n
\n
- Domain name<\/li>\n\n\n\n
- cPanel username<\/li>\n\n\n\n
- PHP script path<\/li>\n<\/ul>\n\n\n\n
You can immediately investigate or suspend the offending account.<\/p>\n\n\n\n
Example indicators:<\/p>\n\n\n\n
cwd=\/home\/user\/public_html\/\n<\/pre>\n\n\n\nor<\/p>\n\n\n\n
A=dovecot_login:user@example.com\n<\/pre>\n\n\n\n
\n\n\n\nStep 5: Inspect Exim Spool Files<\/h3>\n\n\n\n
If the logs do not clearly identify the sender:<\/p>\n\n\n\n
Locate the message files:<\/p>\n\n\n\n
find \/var\/spool\/exim\/input -name \"*1DWJj4-00042i-74*\"\n<\/pre>\n\n\n\nYou should find:<\/p>\n\n\n\n
1DWJj4-00042i-74-H\n1DWJj4-00042i-74-D\n<\/pre>\n\n\n\nWhere:<\/p>\n\n\n\n
\n
-H<\/code> = Envelope\/Header information<\/li>\n\n\n\n-D<\/code> = Message body\/data<\/li>\n<\/ul>\n\n\n\nInspect them:<\/p>\n\n\n\n
cat 1DWJj4-00042i-74-H\ncat 1DWJj4-00042i-74-D\n<\/pre>\n\n\n\nLook for:<\/p>\n\n\n\n
auth_sender\nreceived_from\ncwd\n<\/pre>\n\n\n\nThese fields often reveal the originating account.<\/p>\n\n\n\n
\n\n\n\nStep 6: Investigate “Nobody” Emails<\/h3>\n\n\n\n
If emails are sent as:<\/p>\n\n\n\n
nobody@nobody\n<\/pre>\n\n\n\nthe spam is likely being sent through a PHP script.<\/p>\n\n\n\n
Check the Exim logs for script paths:<\/p>\n\n\n\n
grep nobody \/var\/log\/exim_mainlog\n<\/pre>\n\n\n\nIf the spam originates from
\/tmp<\/code>, inspect the files:<\/p>\n\n\n\nls -lah \/tmp\n<\/pre>\n\n\n\nCheck:<\/p>\n\n\n\n
stat suspicious_file.php\n<\/pre>\n\n\n\nRecord the file creation time and correlate it with:<\/p>\n\n\n\n
\/usr\/local\/apache\/logs\/error_log\n<\/pre>\n\n\n\nand<\/p>\n\n\n\n
\/usr\/local\/apache\/domlogs\/*\n<\/pre>\n\n\n\nto identify the account that uploaded the script.<\/p>\n\n\n\n
\n\n\n\nStep 7: Search Apache Domain Logs<\/h3>\n\n\n\n
Search all domain logs for suspicious activity:<\/p>\n\n\n\n
for file in \/usr\/local\/apache\/domlogs\/*; do\n grep \"example\" \"$file\"\ndone\n<\/pre>\n\n\n\nReplace
\"example\"<\/code> with:<\/p>\n\n\n\n\n
- Suspicious filename<\/li>\n\n\n\n
- Upload script name<\/li>\n\n\n\n
- Known exploit pattern<\/li>\n<\/ul>\n\n\n\n
\n\n\n\nStep 8: Check for Recently Terminated Accounts<\/h3>\n\n\n\n
Sometimes the spammer account may already be removed.<\/p>\n\n\n\n
Search the cPanel accounting log:<\/p>\n\n\n\n
grep \"ebayspammer.com\" \/var\/cpanel\/accounting.log\n<\/pre>\n\n\n\nThis helps determine whether the offending account was terminated previously.<\/p>\n\n\n\n
\n\n\n\nImportant Log Locations<\/h3>\n\n\n\n
Log\/File<\/th> Purpose<\/th><\/tr><\/thead> \/var\/log\/exim_mainlog<\/code><\/td>Main Exim activity log<\/td><\/tr> \/var\/log\/formmail.log<\/code><\/td>FormMail activity<\/td><\/tr> \/usr\/local\/apache\/logs\/error_log<\/code><\/td>Apache errors<\/td><\/tr> \/usr\/local\/apache\/domlogs\/*<\/code><\/td>Domain access logs<\/td><\/tr> \/var\/spool\/exim\/input\/*\/*<\/code><\/td>Message headers and bodies<\/td><\/tr> \/var\/spool\/exim\/msglog\/*\/*<\/code><\/td>Per-message logs<\/td><\/tr> \/tmp<\/code><\/td>Temporary uploaded scripts<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\nUseful Commands<\/h3>\n\n\n\n
Search recursively for a Message-ID:<\/p>\n\n\n\n
find \/var\/spool\/exim -type f | xargs grep \"1DWJj4-00042i-74\"\n<\/pre>\n\n\n\nSearch recent Exim activity:<\/p>\n\n\n\n
grep \"$(date '+%Y-%m-%d')\" \/var\/log\/exim_mainlog\n<\/pre>\n\n\n\nMonitor live mail activity:<\/p>\n\n\n\n
tail -f \/var\/log\/exim_mainlog\n<\/pre>\n\n\n\nCheck Exim queue:<\/p>\n\n\n\n
exim -bp\n<\/pre>\n\n\n\n
\n\n\n\nConclusion<\/h4>\n\n\n\n