server is sending spam mails

Yogesh Ardhan

• March 09, 2024 19:51

Hello,

Server is sending spam mails from some of the email accounts.

I have changed the password of those users, changed password of cpanel, changed password of root user but none of them are of any use.

I checked, spf and dkim are configured perfectly too.

"scan for outgoing spam" is also enabled.

"Filters already created for keywords like : S3X" etc.

cPhulk also enabled 

but I am not able to prevent outgoing spam mails this time.

No clue

 

• 

  cPRex Jurassic Moderator

  • March 11, 2024 13:44

  Hey there!  The first thing I would check in this situation would be the Exim log.  That would confirm how the user is sending the message - for example, a message sent from Webmail would show a loal connection like this:

  2024-03-11 09:42:36 SMTP connection from (host.hostname.com) [::1]:54898 closed by QUIT

  If that is the case, you would then be able to confirm that your password changes aren't enough to secure the accounts as something is changing the cPanel or Webmail password for the user again, allowing the spammer to log in.

  I'd start there and see if that gives you any helpful clues.

  0

Please sign in to leave a comment.