Identifying Spam and Malware Sources on Your Server

Introduction

When a server appears on a blacklist, the listing is usually a symptom. The real problem is often a compromised mailbox, hacked website, vulnerable script, abused contact form, malware, bad mailing list or misconfigured mail service sending unwanted messages.

Before requesting delisting, you need to identify the source and stop it. If the spam source remains active, the server or IP can be listed again quickly, even after a successful removal request.

Quick answer

Why servers send spam

Servers usually send spam because something on the account or system is abused.

• Compromised email account
• Weak mailbox password
• Hacked WordPress website
• Infected plugin or theme
• Abused contact form
• PHP mail script
• Malicious cron job
• Uploaded malware
• Open relay or SMTP misconfiguration
• Bad bulk mailing campaign
• Stolen SMTP credentials

First signs

Check mail logs

Mail logs are usually the best starting point.

• Sender address
• Authenticated username
• Source IP address
• Script path
• Message ID
• Recipient count
• Repeated failed logins
• Unusual sending time
• Remote SMTP connections
• Bounce or rejection messages

Compromised mailboxes

A stolen mailbox password is one of the most common spam sources.

• Unusual login IPs
• Many SMTP authentications
• Sent mail volume
• Failed login attempts
• Password age
• Weak passwords
• Forwarding rules
• Filters created by attacker
• Webmail access logs
• Mailbox used from many countries

• Reset password
• Revoke active sessions
• Remove suspicious forwards and filters
• Enable stronger authentication if available
• Review all devices using the mailbox
• Limit outbound sending temporarily

Website scripts

Hacked websites often send spam through PHP scripts or vulnerable forms.

• Recently modified PHP files
• Unknown files in uploads directories
• Suspicious filenames
• Base64, eval or obfuscated code
• mail() function usage
• Contact form abuse
• Abandoned test scripts
• Old CMS installations
• Writable directories
• Suspicious cron jobs

WordPress malware

WordPress spam sources often come from outdated plugins, nulled themes, weak admin passwords or uploaded backdoors.

• wp-content/uploads for PHP files
• Unknown admin users
• Recently modified plugin files
• Nulled themes or plugins
• Suspicious wp-config.php changes
• Hidden files
• Cron events
• Form plugins
• SMTP plugins
• Abandoned staging copies
• Old backup archives exposed publicly

Why this matters

Root-cause cleanup protects email delivery, server reputation, customer trust and hosting account stability.

How to investigate

Use Blacklist Checker to confirm the reputation issue, then investigate the server source.

1. Sending IP — confirm which IP is listed or rejected.
2. Mail queue — look for large numbers of queued messages.
3. Mail logs — identify sender, username, script path or source process.
4. Authenticated users — check whether a mailbox is sending abnormally.
5. Local scripts — check whether PHP or website files generated messages.
6. Website files — look for malware, backdoors or suspicious file changes.
7. Cron jobs — check scheduled tasks that send mail or run unknown scripts.
8. DNS and authentication — review SPF, DKIM, DMARC and rDNS after abuse is stopped.

Common problems

How to stop spam

1. Step 1: Pause outbound abuse

   Temporarily limit or stop suspicious sending while investigating.

2. Step 2: Identify the sending path

   Use mail logs to determine whether mail came from SMTP auth, local script, cron or system process.

3. Step 3: Secure compromised accounts

   Reset passwords, remove suspicious forwards and review login activity.

4. Step 4: Clean infected websites

   Remove malware, patch CMS, plugins and themes and delete backdoors.

5. Step 5: Check cron jobs

   Remove unknown or suspicious scheduled tasks.

6. Step 6: Review mail queue

   Inspect queued messages and clear spam only after the source is stopped.

7. Step 7: Fix authentication and identity

   Review SPF, DKIM, DMARC, rDNS and HELO/EHLO.

8. Step 8: Request delisting after cleanup

   Only request removal after abuse has stopped and logs look normal.

9. Step 9: Monitor for recurrence

   Watch outbound volume, queue size, login attempts and blacklist status.

Investigation commands

Check Exim queue:
exim -bp

Count queue:
exim -bpc

Search Exim logs for a sender:
grep "user@example.com" /var/log/exim_mainlog

Find mail sent by local scripts:
grep "cwd=" /var/log/exim_mainlog | tail -50

Check recent PHP files:
find /home/USERNAME/public_html -type f -name "*.php" -mtime -7

Find suspicious PHP mail usage:
grep -R "mail(" /home/USERNAME/public_html --include="*.php"

Check user cron jobs:
crontab -u USERNAME -l

Check suspicious files in uploads:
find /home/USERNAME/public_html/wp-content/uploads -type f -name "*.php"

Cleanup checklist

After cleanup, reduce the chance of repeat abuse.

• Enforce strong mailbox passwords
• Update CMS, plugins and themes
• Remove abandoned websites
• Limit PHP mail where possible
• Use authenticated SMTP for forms
• Add CAPTCHA and rate limiting
• Monitor outbound volume
• Enable malware scanning
• Restrict cron jobs
• Review new admin users
• Keep backups
• Monitor blacklist status

Frequently asked questions