As you might gather from my recent posts, I’ve been battling some spam attacks on WordPress. I’ve found a few things quite helpful:

1. Maldet is a commandline tool for linux that you can use to scan directories for malicious scripts. It doesn’t catch everything, but it’s good for a quick look. Google it for more info.

2. WordFence’s free WordPress plugin is invaluable in protecting and finding hacked files.

3. Exim (WHM’s mail service) can get overloaded with spam emails being sent out. It can actually eat up your disk space – so, if it seems like you’re suddenly running out of room on your server, ti could be that someone’s WordPress account was hacked and is sending out thousands upon thousands of emails. Aside from deleting the hacked files, etc, you’ll have to clear out the Exim message queue. There are posts online that tell you how to interact directly with exim to clear out the queue, but interacting with exim to delete a message takes a long time when you’re processing thousands of messages.

The fastest solution I found was to simply stop Exim and delete the logs and queue and start it again. Here’s the commands that worked for me:

cd /var/spool
mv exim exim.old
mkdir -p exim/input
mkdir -p exim/msglog
mkdir -p exim/db
chown -R mail:mail exim
/sbin/service exim restart

Reference: http://www.cyberciti.biz/faq/exim-remove-all-messages-from-the-mail-queue/

If you have a WHM server and need to disable mail for a particular CPanel account (for instance, if got hacked and it’s sending out hordes of spam email).

First, in root SSH, run these commands:

Code:
touch /etc/blockeddomains
echo "domain.com" >> /etc/blockeddomains

Please replace domain.com with the domain name. Do not replace the “” part as that’s required, only the domain.com part with the right domain name.

In WHM > Exim Configuration Editor > Advanced Editor, put the following in the topmost box:

Code:
domainlist blocked_domains = lsearch;/etc/blockeddomains
Locate the “ROUTERS CONFIGURATION” section, and right below these lines:
democheck:
driver = redirect
require_files = "+/etc/demouids"
condition = "${if eq {${lookup {$originator_uid} lsearch {/etc/demouids} {$value}}}{}{false}{true}}"
allow_fail
data = :fail: demo accounts are not permitted to relay email

Put the following lines:

Code:
reject_domains:

driver = redirect
# RBL Blacklist incoming hosts
domains = blocked_domains
allow_fail
data = :fail: Connection rejected: SPAM source $domain is manually blacklisted.
https://forums.cpanel.net/threads/how-do-i-block-one-domain-from-sending-email-from-my-server.223731/