The problem
Outgoing mail jumps from a few hundred to tens of thousands per day. Within hours your server IP lands on blacklists, and every customer’s legitimate mail starts bouncing. The cause is almost always one of three things: a compromised mailbox, a hacked PHP script that spams via mail(), or an exploited contact form — and each needs a different fix.
The solution
VpsMonitor.Pro’s Mail view tracks sent-mail volume per day and per account, compares today against yesterday and the weekly average, and alerts when any single account crosses your daily threshold. So you see the explosion the day it starts — not when the blacklist notice arrives.
The sent-mail breakdown then answers “who exactly?”: it separates authenticated SMTP sends from PHP mail() sends, lists the sending scripts when PHP mail logging is on, and even attributes web-triggered mail to the URL that fired it by correlating mail timestamps with the access logs. A form-spammer scan spots IPs hammering your contact forms with POST floods and can auto-block them via CSF — with admin and webmail paths excluded so real users are never blocked.
The RBL check watches whether your IP is already on common blacklists, so you also know when the cleanup worked.
Frequently asked questions
How quickly does a spamming server get blacklisted?
Often within hours. Catching the volume spike the same day — with a per-account alert — is the difference between deleting a queue and a week of delisting requests.
Can I tell whether spam comes from a mailbox or a PHP script?
Yes — the breakdown separates authenticated SMTP (a mailbox/password problem) from PHP mail() sends (a hacked script), and points at the script or URL for the latter.
Does blocking the spammer IP stop a compromised script?
No — blocking stops form abuse from outside. A compromised script or mailbox must be cleaned and its password changed; the app shows you which of the two you are dealing with.
Get a license · Download free — 7-day trial