How do I find spam senders in WHM?
This article will show you how to find email accounts sending spam within WHM.
If you want to identify any email accounts that are sending excessive amounts of emails within WHM, simply follow the instructions outlined below.
Please note: the following article was originally created for our current generation of Virtual Private Servers. As such, these instructions may not be relevant to our previous generation of Virtual Private Servers.
Start by logging in to WHM.
From there, enter email into the search bar and select Mail Delivery Reports within the left-hand menu.
Alternatively, you can select Mail Queue Manager instead if your emails are NOT being sent.
On the next page, enter a date range into the provided field and click Run Report.
After a few minutes, you will be given a list of results. From here, you can sort these results by sender by clicking From Address within the header.
If one of your email accounts is sending a large volume of emails, your account may have been compromised. For details on what to do next, please read the following article: Find and fix spam abuse on your server
If one of your email forwarders is receiving a large volume of emails, you may wish to remove this account from your server.
If you’re receiving a large volume of emails from ‘[cpanelusername]@[server.host.name]’, this could be due to a malicious file or because your CMS has been misconfigured.
If you’re receiving a large volume of emails from ‘root@[server.host.name]’, you may wish to check the mail settings of any applications you’ve recently installed.