Trace email spamming in Plesk using php scripts

Are you trying to trace email spamming in Plesk?

This guide will help you.

Just recently, one of our Customer contacted us regarding mail spamming attacks on his Plesk hosted Server. He could not figure out and trace the spam issue.

Thousands of email was sent with bounce-back messages. 

However, there is no such email server.

Generally, If your hosting offerings include mail services, keep in mind that your mail server can be used for malicious purposes, such as sending spam. 

Outgoing spam can cause an increased load on the server and complaints from recipients. 

What's more important, your server IP addresses might be added to public black lists, such as Spamhaus or OpenBL lists.

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to perform Plesk related tasks.

In this context, we shall look into how to trace email spamming in Plesk using PHP scripts.

How to find the source of spam in Plesk ?

Before we proceed with the steps to find mail spamming from PHP scripts, let us see the steps in order to find mail spamming in qmail (Plesk).

This includes the steps to find spamming from PHP scripts in the Plesk server also.

1. Initially, we check the mail count in the qmail queue:

# /var/qmail/bin/qmail-qstat
messages in queue: 27303
messages in queue but not yet preprocessed: 100

2. In addition, to see the inbox of mails:


3.Then to find the user that sends most of the mails (if the emails are sent without using PHP scripts):

# cat /var/log/maillog |grep -I smtp_auth |grep -I user |awk ‘{print $11}’ |sort |uniq -c |sort -n

4. In order to read message headers:

# /var/qmail/bin/qmail-qread
22 Sep 2012 15:03:07 CDT #2996948 9073 bouncing
done remote user1@domain1.com
done remote user2@domain2.com
done remote user3@domain3.com

From the above result, we can see the sender and recipients of messages. 

If the message has too many recipients, then it is mostly SPAM.

5. To view this message using its ID #2996948:

# find /var/qmail/queue/mess/ -name 2996948

6. Finally, we check the result, starting after 'Received' to see its origin :

a) Received: (qmail 19514 invoked by uid 1009); 21 Oct 2007 17:48:22 +0700

This means that mail was sent via some CGI script by user UID 1009.

Then, find a corresponding domain for this UID:

# grep 1009 /etc/passwd

Now we can find the cgi script and deny it’s working.

b) Received: (qmail 19622 invoked from network); 21 Oct 2007 17:52:36 +0700

Received: from external_domain.com (

If we get the above header, then the message was accepted for delivery via SMTP and the sender is an authorized mail user.

c) Received: (qmail 19514 invoked by uid 48); 21 Oct 2007 17:48:22 +0700

If the uid is 48, then spam is sent using some PHP scripts. (48 – UID of apache user).

How to Trace email spamming in Plesk using PHP scripts ?

The script below shows currently running php scripts in the server:

# lsof +r 1 -p `ps axww | grep httpd | grep -v grep | awk ‘ { if(!str) { str=$1 } else
str=str”,”$1}END{print str}’` | grep vhosts | grep php

To find the exact location of php script, follow the below method:

1) Create /var/qmail/bin/sendmail-wrapper script:

(echo X-Additional-Header: $PWD ;cat) | tee -a /var/tmp/mail.send|
/var/qmail/bin/sendmail-qmail “$@”

2) Then we run:

# touch /var/tmp/mail.send
# chmod a+rw /var/tmp/mail.send
# chmod a+x /var/qmail/bin/sendmail-wrapper
# mv /var/qmail/bin/sendmail /var/qmail/bin/sendmail-qmail
# ln -s /var/qmail/bin/sendmail-wrapper /var/qmail/bin/sendmail

3) Eventually, revert it:

# rm -f /var/qmail/bin/sendmail
# ln -s /var/qmail/bin/sendmail-qmail /var/qmail/bin/sendmail
/var/tmp/mail.send will contain lines starting with ‘X-Additional’
# grep X-Additional /var/tmp/mail.send | grep `cat /etc/psa/psa.conf | grep

These will give the directories from where the mail script is running.

If the queue is high and corrupt, we can recreate the qmail queue in Plesk:

/etc/init.d/qmail stop
/etc/init.d/xinetd stop
mv /var/qmail/queue /var/qmail/queue_old
rpm -Uvh –force psa-qmail-1.03-rh7.3.build030207.16

This will recreate the Qmail queue structure:

/etc/init.d/qmail start
/etc/init.d/xinetd start

[Need urgent help to trace spamming? We'd be happy to assist. ]


This article covers how to locate the mail spammer in a Plesk server which is a bit difficult when compared to #Cpanel servers.

To prevent spam being sent from your server, Plesk offers a tool that controls the sending of email messages. 

This tool gathers statistics about outgoing messages and prevents mail being sent when specified limits are exceeded. 

You can specify limits on outgoing mail at the following levels: mail server, service plan, subscription, domain, and mailbox.

Administrators can prevent outgoing spam by using limits on the number of outgoing email messages per hour. 

In addition, the administrator can easily determine the exact source of possible spam with the help of reports and notifications.

Types of Threats in Plesk:

Plesk introduces different limits for prevention of the following different types of threats:

1. Stolen mail accounts.

SMTP user account credentials can be stolen by malicious users when they hack a mail server by using a system vulnerability (for example, PHP vulnerability) or an application exploit (for example, exploit for an outdated WordPress version). Also, if customers use very weak passwords, their passwords can be obtained by using brute force tools.

You can prevent this type of threat by limiting the number of outgoing email messages from a mailbox.

2. Web scripts for malicious mass mailing.

A malicious user can use a Plesk customer account in order to create a website with a script that will distribute spam emails. Also, a malicious user can steal the FTP credentials of a customer account and upload a website with a mass mailing script via FTP.

You can prevent this type of threat by limiting the number of outgoing email messages from a domain.

3. Hacked system accounts on #Linux.

Malicious users can gain access to Linux system user accounts by using system or application exploits. After that, they can plant scheduled background tasks in crontab. Such scheduled tasks can run mass mailing scripts that spread spam mail.

You can prevent this type of threat by limiting the number of outgoing email messages from a subscription.

Best practices for sending outgoing mail from a #Plesk server:

1. Configure the #hostname for a Plesk server

Go to Tools & Settings > Server Settings and type in your server's hostname.

2. Enable SPF/DKIM/DMARC features

By default, a SPF DNS record is added to the domain's DNS zone during a domain creation, if this DNS record exists in the Plesk DNS Template.

Make sure there is a TXT record for SPF in domain's DNS settings at Domains > example.com > DNS Settings

3. Make sure that DKIM support is enabled server-wide in Plesk at Tools & Settings > Mail Server Settings.

4. A reverse DNS (rDNS) lookup returns the hostname of an IP address. Many mailbox providers, including Gmail and Yahoo!, will block email coming from a mail server that does not have rDNS in place.

To configure rDNS, a PTR DNS record should be created by the owner of the IP address. 

Contact your hosting service provider or Internet Service Provider (ISP) to get more details.