- Plesk for Windows
Many email messages are being sent using PHP scripts from a Plesk server. How to find spamming subscriptions?
Note: For Linux, see this KB article.
Connect to the Plesk server via RDP.
Download Process Monitor utility.
Configure filter to show only TCP packets which are sent on port 25 of a local server: Download this Process Monitor configuration file and import it to Process Monitor at File > Import Configuration....
Make sure only network activity is enabled in the settings bar (enabled by default).
Wait for the entries to start being logged as on the following screenshot:
Identify the spamming subscription by analyzing the output of the User table. In the example above, 'testtld' user represents the subscription 'test.tld'