Partner with experts to accelerate your digital transformation journey
Bobcares

Trace email spamming in Plesk using php scripts – How to do it

PDF Header PDF Footer

Wondering how to trace email spamming in Plesk? We can help you.

Recently we had a customer who couldn’t trace the mail spamming in his Plesk Linux server. A thousand email was being sent along with bounce-back messages. However, there is no such email server.

As part of our Server Management Services, we assist our customers with several Plesk queries.

Today, let us see how to trace email spamming in Plesk using PHP scripts.

 

Find the source of spam.

Before we proceed with the steps to find mail spamming from PHP scripts, let us see the steps in order to find mail spamming in qmail (Plesk).

This includes the steps to find spamming from PHP scripts in the Plesk server also.

Initially, we check the mail count in the qmail queue:

# /var/qmail/bin/qmail-qstat
messages in queue: 27303
messages in queue but not yet preprocessed: 100

In addition, to see the inbox of mails:

/var/qmail/mailnames/

Then to find the user that sends most of the mails (if the emails are sent without using PHP scripts):

# cat /var/log/maillog |grep -I smtp_auth |grep -I user |awk ‘{print $11}’ |sort |uniq -c |sort -n

In order to read message headers

# /var/qmail/bin/qmail-qread
22 Sep 2012 15:03:07 CDT #2996948 9073 bouncing

done remote user1@domain1.com

done remote user2@domain2.com

done remote user3@domain3.com

From the above result, we can see the sender and recipients of messages. If the message has too many recipients, then it is mostly SPAM.

To view this message using its ID #2996948:

# find /var/qmail/queue/mess/ -name 2996948

Finally, we check the result, starting after ‘Received’ to see its origin :

a) Received: (qmail 19514 invoked by uid 1009); 21 Oct 2007 17:48:22 +0700

This means that mail was sent via some CGI script by user UID 1009.

Then, find a corresponding domain for this UID

# grep 1009 /etc/passwd

Now we can find the cgi script and deny it’s working.

b) Received: (qmail 19622 invoked from network); 21 Oct 2007 17:52:36 +0700

Received: from external_domain.com (10.0.0.1)

If we get the above header, then the message was accepted for delivery via SMTP and the sender is an authorized mail user.

c) Received: (qmail 19514 invoked by uid 48); 21 Oct 2007 17:48:22 +0700

If the uid is 48, then spam is sent using some PHP scripts. (48 – UID of apache user)

 

Trace email spamming in Plesk using PHP scripts

The script below shows currently running php scripts in the server.

# lsof +r 1 -p `ps axww | grep httpd | grep -v grep | awk ‘ { if(!str) { str=$1 } else

str=str”,”$1}END{print str}’` | grep vhosts | grep php

To find the exact location of php script, follow the below method:

1) Create /var/qmail/bin/sendmail-wrapper script.

#!/bin/sh

(echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|

/var/qmail/bin/sendmail-qmail “$@”

2) Then we run:

# touch /var/tmp/mail.send

# chmod a+rw /var/tmp/mail.send

# chmod a+x /var/qmail/bin/sendmail-wrapper

# mv /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail

# ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail

3) Eventually, revert it

# rm -f /var/qmail/bin/sendmail

# ln -s /var/qmail/bin/sendmail-qmail /var/qmail/bin/sendmail

/var/tmp/mail.send will contain lines starting with ‘X-Additional’

# grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep

HTTPD_VHOSTS_D | sed -e ‘s/HTTPD_VHOSTS_D//’

These will give the directories from where the mail script is running.

If the queue is high and corrupt, we can recreate the qmail queue in Plesk

/etc/init.d/qmail stop

/etc/init.d/xinetd stop
mv /var/qmail/queue /var/qmail/queue_old
rpm -Uvh –force psa-qmail-1.03-rh7.3.build030207.16

This will recreate the Qmail queue structure.

/etc/init.d/qmail start

/etc/init.d/xinetd start

[Need help to trace spamming? We’d be happy to assist]

 

Conclusion

To conclude, locating the mail spammer in a Plesk server is a bit difficult when compared to Cpanel servers. Today, we saw how our Support Techs perform the same.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

GET STARTED

var google_conversion_label = "owonCMyG5nEQ0aD71QM";
0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Get featured on the Bobcares blog and share your expertise with a global tech audience.

WRITE FOR US
server management

Spend time on your business, not on your servers.

TALK TO US

Or click here to learn more.

GET UP TO 25% OFF

cPanel Support

Spend time on your business, not on your servers.

Managing a server is time consuming. Whether you are an expert or a newbie, that is time you could use to focus on your product or service. Leave your server management & end-user tech support to us, and use that time to focus on the growth and success of your business.

TALK TO US Or click here to learn more.

GET UP TO 25% OFF

Plesk Support

Spend time on your business, not on your servers.

Managing a server is time consuming. Whether you are an expert or a newbie, that is time you could use to focus on your product or service. Leave your server management & end-user tech support to us, and use that time to focus on the growth and success of your business.

TALK TO USOr click here to learn more.

Speed issues driving customers away?
We’ve got your back!

Privacy Preference Center

Necessary

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]
PHPSESSID
WHMCSpKDlPzh2chML

Statistics

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid
smartlookCookie
_clck, _clsk, CLID, ANONCHK, MR, MUID, SM

Marketing

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

_reb2bgeo - The visitor's geographical location

_reb2bloaded - Whether or not the script loaded for the visitor

_reb2bref - The referring URL for the visit

_reb2bsessionID - The visitor's RB2B session ID

_reb2buid - The visitor's RB2B user ID

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie
1P_JAR, NID, DV
NID
hblid
_reb2bgeo, _reb2bloaded, _reb2bref, _reb2bsessionID, _reb2buid

Security

These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.

SID, APISID, HSID, NID, PREF
SID, APISID, HSID, NID, PREF