Spam detect/fix/terminate.

We have receiving something like that on server.
Its on WHM, and same on different accounts in same server.
Need to find the reason, and fix.

Time: Tue Aug 2 09:17:27 2022 +0100
PID: 26355 (Parent PID:24019)
Account: eds
Uptime: 26542 seconds


Executable:

/usr/local/cpanel/3rdparty/perl/532/bin/perl


Command Line (often faked in exploits):

spamd child


Network connections by the process (if any):

tcp: 127.0.0.1:783 -> 127.0.0.1:50490
udp: 51.68.206.97:47285 -> 5.9.124.53:24441
udp: 51.68.206.97:63822 -> 1.1.1.1:53
tcp: 51.68.206.97:59254 -> 208.83.137.117:2703


Files open by the process (if any):

/dev/null
/usr/local/cpanel/logs/spamd_error_log
/usr/local/cpanel/logs/spamd_error_log
/usr/local/cpanel/3rdparty/perl/532/bin/spamd
/home/eds/.razor/razor-agent.log
/var/cpanel/locale/en.cdb
/usr/local/cpanel/3rdparty/perl/532/lib/perl5/cpanel_lib/Net/DNS/Resolver/Base.pm


Memory maps by the process (if any):

00400000-00402000 r-xp 00000000 09:02 1349599744 /usr/local/cpanel/3rdparty/perl/532/bin/perl
00601000-00602000 r--p 00001000 09:02 1349599744 /usr/local/cpanel/3rdparty/perl/532/bin/perl
00602000-00603000 rw-p 00002000 09:02 1349599744 /usr/local/cpanel/3rdparty/perl/532/bin/perl
00603000-07728000 rw-p 00000000 00:00 0 [heap]
07728000-09855000 rw-p 00000000 00:00 0 [heap]
1535dda72000-1535ddaab000 r-xp 00000000 09:02 1612095914 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/cpanel_lib/x86_64-linux-64int/auto/Encode/Byte/Byte.so
1535ddaab000-1535ddcaa000 ---p 00039000 09:02 1612095914 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/cpanel_lib/x86_64-linux-64int/auto/Encode/Byte/Byte.so
1535ddcaa000-1535ddcc9000 r--p 00038000 09:02 1612095914 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/cpanel_lib/x86_64-linux-64int/auto/Encode/Byte/Byte.so
1535ddcc9000-1535ddcca000 rw-p 00057000 09:02 1612095914 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/cpanel_lib/x86_64-linux-64int/auto/Encode/Byte/Byte.so
1535ddcca000-1535ddcce000 r-xp 00000000 09:02 1611767430 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/532/x86_64-linux-64int/auto/mro/mro.so
1535ddcce000-1535ddecd000 ---p 00004000 09:02 1611767430 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/532/x86_64-linux-64int/auto/mro/mro.so
1535ddecd000-1535ddece000 r--p 00003000 09:02 1611767430 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/532/x86_64-linux-64int/auto/mro/mro.so
1535ddece000-1535ddecf000 rw-p 00004000 09:02 1611767430 /usr/local/cpanel/3rdparty/perl/532/lib/perl5/532/x86_64-linux-64int/auto/mro/mro.so
1535ddecf000-1535de092000 r-xp 00000000 09:02 1349599617