cPanel/WHM Plugins
WHM-MailForensics
Know who sent every outbound email — from which account, script and IP.
- WHM & cPanel
- Encrypted code
- Signed packages
- English & Arabic
Price
$30 / year
One server, one year of updates and support. Renew whenever you like.
- Protected, signed package — verified before install
- Move the license to a new server yourself
- Full uninstall from the plugin or the command line
One command, as root
The installer checks your server, asks for your license key, verifies the signed package and installs it. The same command upgrades later.
# wget -O install.sh https://www.infinityinstaller.com/plugins/WHM-MailForensics/install.sh && bash install.sh
# bash install.sh --uninstall
WHM-MailForensics in action
What WHM-MailForensics does
ailForensics turns your server's outbound mail into clear, searchable intelligence. Every message that leaves cPanel is captured with its sender, recipients, originating script and client IP — so a spam incident takes minutes to trace, not hours.
It clusters messages into campaigns, scores them for spam and phishing, correlates them with Exim delivery and SMTP-AUTH logins, and opens incidents automatically when an account starts behaving badly. Optional enforcement can throttle or suspend a compromised account before your IPs land on a blocklist.
It runs entirely on your own server, privacy-first: a tiny mail wrapper never delays delivery, and a root-only worker does the analysis. Works per-reseller, with alerts, a daily executive digest, and CSV export.
Requirements
- cPanel & WHM server with root access
- PHP 8.4 with the ionCube Loader 15+ (the installer sets it up automatically)
- Exim mail server (standard on cPanel)
- CloudLinux CageFS supported (optional)
Features
- Live outbound feed: sender, recipients, script path, client IP and X-Mailer for every message
- Campaign clustering with spam and phishing scoring
- Automatic incidents for volume spikes, temp-script senders and bulk campaigns
- Exim delivery correlation and SMTP-AUTH abuse detection (logins from many countries/IPs)
- Deliverability watch (bounce rate), DNSBL blocklist checks and SPF/DKIM/DMARC status
- Optional enforcement: throttle or suspend a compromised account automatically
- Alerts by email and webhook (Slack/Telegram), a daily digest, and CSV export
- Fail-safe sendmail wrapper that never delays mail, CageFS-aware, with per-reseller scope
You may also like
Churn & Client Intelligence
Predict churn, understand every client, and act — risk scoring, Client 360, sentiment AI, retention playbooks and executive analytics for WHMCS.
Enterprise Email Template Testing PRO
Test, preview and score every WHMCS email before it reaches a client — deliverability analyzer, quality gates, A/B subjects and batch suites.
Email Verification Pro
Verify every client email before they use your services — client-area lock, reminders, deliverability intelligence, fraud signals and analytics for WHMCS.
