Recent content by Walkum

Hi, there is a issue when try to send a mail with attached image throught Roundcube Webmail. I think that is caused by a recent update of 18.0.5x, because this happens since two months ago aprox. I attach a screen with the console error. I don't see anything on roundcube file logs. Thanks.

RESOLVED. I will explain how I have solved it to help future people who may have this problem. First, using the "htop" command (install with "sudo apt-get install htop" if you don't have it), I filtered processes by "cron" name, there were numerous processes like ./cron.php -p0.0.0.0 -e18924...

RESOLVED. I will explain how I have solved it to help future people who may have this problem. First, using the "htop" command (install with "sudo apt-get install htop" if you don't have it), I filtered processes by "cron" name, there were numerous processes like ./cron.php -p0.0.0.0 -e18924...

Hi. I've recently observed quite a large amount of outgoing connections from port 25 to numerous (malicious?) IP's through postfix, in turn creating several rather strange smtpd processes. I think they are bad bots. I'm mass banning them via fail2ban in the plesk-postfix part every time they do...

The reason for the lists again is because of an e-mail sent with HELO outlook.com: 51.15.185.237 2023-07-24 17:10:00 outlook.com I found some lines like this on maillog: Jul 24 12:38:11 amberserver postfix/smtp[3674547]: B2757337B1A9: to=<[email protected]>...

Again listed on Spamhaus, 24 hours later, appears to be a joke. This is a darkness. I don't know how this can happens. There aren't any malware on any site. PHPMailer updated and secured with all the passwords. This is very weird.

Ok, thank you. Apparently there are not any malicious file on the system, so I think that I can be quiet for now. Thanks Maarten. and Peter for your help :D

This is the unique apparently strange file, I dare not delete it in case it is something from the system. The last modification is from May 18. You sound familiar? Are you part of Plesk? It's es83G3KK file. Attached image.

I changed the fail2ban configuration making it more strength (especially for postfix), I have manually banned the suspicious IP's that I have seen in the logs, and I have deleted the plugins that had vulnerabilities related to emails that did not have an update in the official WordPress...

Both the guys from Abusix and Spamhaus tell me to block outgoing port 25 on the server, but I've read on the forum that this prevents me from sending e-mails to hosts like Gmail or similar. How can I make this recommendation without negatively affecting it? Thank you

Hi again, thanks for the response. Indeed it is confirmed that there are mail sends from the server with port 25 (supposedly) and with that incorrect HELO value, they have put us on new blacklists (Abusix) confirming this in more detail than the Spamhaus guys. I have been told to use the...

Hi again, thanks for the rapid answer. There are two cases: First case: E-mail is sended but after a second I receive a MAIL DELIVERY SYSTEM ERROR mail telling me that the mail was not delivered caused by the Spamhaus blacklist. The log of one e-mail rejected sent by Spamhaus: Jul 22 22:08:32...

Hello everyone. Since a week ago we got into the XBL and CSS lists of Spamhaus.org, due to a problem with a mysterious e-mail sending whose HELO value is "outlook.com". This is obviously impossible because on this server we have HELO well configured with the server name, more than 400 email...

Ok, appear to be a "SEO Toolkit" extension issue. Fixed updating these extension, recently 2 days ago Plesk released an update for it. Your can see in the changelog: Change Log for Plesk Obsidian Hope it helps.

My specs: Version Plesk Obsidian v18.0.39 update 1 OS Debian 10