hostdoc — offline cPanel/WHM/WHMCS support brain

← all runbooks

---
title: Account is sending spam
panel: WHM / cPanel
symptoms:
  - bounce reports mentioning the account
  - receiving servers blocking the domain
  - customer says their site sends junk
  - rejected for spam policy
  - sending junk email
  - my account is on a blocklist
  - other mail servers are blocking my mail
  - the server says the ip is blacklisted
  - my site is sending spam emails
  - bounce back says spam was detected
---

# Account is sending spam

## 1. Stop it before you investigate

**Why:** suspend the account first. It stops the sending immediately and
it stops the account's reputation damaging the server's IP and with it
every other customer on the same server. Investigating while it is still
sending means the volume keeps climbing and the list you are chasing
keeps growing.

**In WHM:** Account Functions > Manage Account Suspension.

**In the terminal:** `/usr/local/cpanel/scripts/suspendacct <user>`

**Care:** the customer's legitimate mail stops as well, because a
suspended account still receives but the sending stops. Tell them what
you are doing and how long for.

- https://docs.cpanel.net/whm/scripts/the-suspendacct-script/
- https://docs.cpanel.net/knowledge-base/accounts/what-happens-when-you-suspend-an-account/

## 2. Establish whether it is the account or the site

**Why:** a compromised website with a mail function that sends to a
scraped list is the usual cause, and it needs the customer to fix it. A
customer with a mail script they built themselves is a different
conversation. Knowing which one you are dealing with tells you who has
to do the work.

**In the terminal:** `ls -la --time-style=long-iso /home/<user>/public_html`
shows what changed recently, and
`grep -ri "mail(" /home/<user>/public_html --include=*.php -l` finds
the scripts that send mail.

**Care:** this only reads.

## 3. Check for a form that has been hijacked

**Why:** a POST handler that mails whatever it is given is being used as
a spam relay, and it is the most common way a shared hosting account
ends up sending spam without the owner knowing. The fix is in the
site's code, so the customer has to make it, and you have to be able to
explain why.

**In the terminal:** `grep -rn "mail(" /home/<user>/public_html --include=*.php`
and read the handlers. Look for one that takes a recipient or a message
from the request.

**Care:** this only reads. Do not edit the customer's code to "fix" it
without them, because you will not know what it was meant to do.

## 4. Check the queue and the sending history

**Why:** the queue shows what is waiting to go and the history shows
what has already gone. The volume tells you whether this is one runaway
script or an account being used deliberately, and the destination
addresses tell you which. That is the evidence you need for an abuse
complaint.

**In WHM:** Email > Mail Queue Manager for what is waiting, Email > Mail
Delivery Reports for what went out.

**In the terminal:** `grep -i <domain> /var/log/exim_mainlog`

**Care:** this only reads.

- https://docs.cpanel.net/whm/email/mail-queue-manager/
- https://docs.cpanel.net/whm/email/mail-delivery-reports/

## 5. Check what the account should have had in place

**Why:** mail limiting and abuse prevention settings are what stop this
happening again, and a shared host that leaves them off is the reason
the account could do it in the first place. It is worth checking the
account's settings before you lift the suspension.

**In cPanel:** Email > Email Accounts, and the mail limit for the
account.

**In WHM:** Email > Mail Delivery Reports for the account's activity,
and the server's mail limits in Tweak Settings.

**In the terminal:** `cat /var/cpanel/userdata/<user>/main` and look
for the mail limit and the second-server policy.

**Care:** this only reads.

- https://docs.cpanel.net/knowledge-base/email/how-to-prevent-email-abuse/
- https://docs.cpanel.net/knowledge-base/email/how-to-prevent-spam-with-mail-limiting-features/