I'm trying to identify the cause of spam emails being spent out from one of my clients wordpress websites. while I can identify the folder i can't identify the file.I've added the following to the log_selector of my exim settings +address_rewrite +all_parents +arguments +connection_reject +delay_delivery +delivery_size +dnslist_defer +incoming_interface +incoming_port +lost_incoming_connection +queue_run +received_recipients +received_sender +retry_defer +sender_on_delivery +size_reject +skip_delivery +smtp_confirmation +smtp_connection +smtp_protocol_error +smtp_syntax_error +subject +tls_cipher +tls_peerdnAnd then run grep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -Fcwd= '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -nThanks to this I know what folders are sending out the spam. One of which was a deactivated Yoast plugin which I have updated which has solved one issue. However a custom plugin for the website is also identified as sending out spam, a few 100,000 a day.I tried running grep file-name.php /home/account-name/access-logs/domain.co.uk | awk '{print $1}' | sort -n | uniq -c | sort -n on each of the files in the directory but only one returned results and this only showed a handful of single access by differing IP's, nothing like the expected 74,000 that the exim_mainlog displayed.The plugin should be using mandrill to send email and was written by a 3'rd party before we took it over so debugging the scripts would take an extremely long time and is currently blacklisting the server on multiple blacklists.For now I;m going to swap the site to its own IP address so I can at least clear out the other sites on the shared IP but I really do need to find the file in question causing the issue.The server in question is a centos 5.x i think running WHM and Cpanel
Identifying the file sending out spam email
wordpress;email;spam;cpanel;whm
I eventually found the hack by running a malicious code scanner from https://github.com/mikestowe/Malicious-Code-Scanner to detect the main causes of the hack. This detected 90% of all the flies that has been modified to allow a post request to send a string that the hacked file would then run as php.Then I ran cat example.co.uk | cut -d\ -f2 | awk '{print $1   $2}' | cut -d? -f1 | sort | uniq -c | sort -n on my raw access logs to find what files had post requests sent heavily to them to track down the files that were not detected correctly.