What are the tips for finding email spam sending scripts? I ask because usually I hit a wall in shared hosting environments, so I ask this question as a way to get some insight from others.

What I do:

  • Check RBL's for the IP and possibly get the time the IP was listed.
  • Go through transfer.logs and FTP logs looking for any malicious activity.
  • Will watch transfer.logs in "live" mode (tail -fn0) watching for malicious activity.
  • grep for most recently modified script files (py,cgi,pl,php).
  • Run maldet / clamav; rarely finds any spam scripts though ;(
  • strace mail process if I have to.
  • Check if the UID of the sent script goes back to a user.
  • Check for X-PHP-Origin and X-Mailer email headers.
  • Utilize the findbot.pl script: http://cbl.abuseat.org/findbot.pl
  • 3
    What are you trying to accomplish? Why are you ending up with spam scripts a lot? Why are they able to get installed in the first place? Is there a reason you can't simply block outgoing ports to prevent the scripts from being able to run? Apr 11, 2013 at 4:06
  • If the scripts are called from apache, then grepping those logs might be useful.
    – Jenny D
    Apr 12, 2013 at 7:31
  • 1
    You need to clarify what the risk is our attempting to mitigate. It is not clear what you mean by 'spam scripts' or why your worried about spam scripts and not other security threats. While what you are doing are reasonable things to do, they are not scalable, rely too much on human intervention and will likely consume too much time, resulting in things ending up on the wrong side of a cost benefit ratio. Try to articulate exactly what your risk concern is and we may be able to advise better.
    – Tim X
    Apr 14, 2013 at 22:07
  • 1
    Are you afraid that you have 'email spam sending scripts' on your server? If your server is compromised you're wasting time. Reformat and reinstall from backup. That's the only sensible solution, you'll never be able to track down and erase the malware to a point where you can guarantee that your server is clean again.
    – user13695
    May 17, 2013 at 12:47

3 Answers 3


Things we do on shared hosting platforms is limit/block outbound connections (especially UDP) and check for scripts trying to bind to ports (listeners). We force all SMTP traffic through our mailserver where we ratelimit SMTP traffic and store logs containing the customer's username. We assign unique user ID's per customer so we can track incidents to specific useres. We use FTP servers are checked on suspicious IP-addresses (from other continents mostly) and filenames being uploaded (known bad files for Joomla, Magento, etc). We have scripts detecting files being downloaded and uploaded with only a very limited time (seconds) between those actions, which turned out to be another good way of detecting compromised FTP accounts.

I haven't used it myself, but you might want to try HoneySpider (http://www.honeyspider.net/), which scans websites for malicious files, scripts, etc.


Don't allow unauthorized scripts to send emails, alert administrators if a script is sending emails at high rates. Most of your users probably won't need email functionality, don't give it to them unless they ask for it and specify a reason for why they need it.


You should keep a copy of all your site's files somewhere other than your shared hosting (for example on your computer). When you want to check for a rogue script on the shared hosting, you can download a zip of all the files in the hosting and diff it against your local copy of the files. I use Meld for this diff because it recursively compares directories.

Another option is to use Nikto2 (http://www.cirt.net/nikto2) which scans your site for a large and frequently updated list of known malware often seen on web servers.

You must log in to answer this question.