• The ImunifyAV extension is now deprecated and no longer available for installation.
    Existing ImunifyAV installations will continue operating for three months, and after that will automatically be replaced with the new Imunify extension. We recommend that you manually replace any existing ImunifyAV installations with Imunify at your earliest convenience.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Question get spam sent out

Detlef D.

New Pleskian
Server operating system version
Ubuntu 22.04.5 LTS
Plesk version and microupdate number
18.0.64
Hello,
SPAM is always being sent via a certain domain that is hosted on my server,
I can't figure out what or whether it's coming from outside. All I get is the messages that XXX emails have reached the limit.
To be on the safe side, I reduced it to 5 emails per hour. But then I continue to receive information that the limits have been reached.
How can I find out over which IP, I think externally via my mail server, the emails are sent?
I tried to find something in the log, unfortunately without success.

Maybe you can help me with that.

Thank you Detlef

Hallo, über eine bestimmte Domain, die auf meinen Server gehostet ist, wird immer SPAM versand, ich kann nicht herausbekommen, was oder ob von extern es kommt. Ich bekomme, nur die Nachrichten immer, das XXX Mails die Grenze erreicht haben. Ich hab erst mal aus sicherheit es auf 5 Mails pro Stunde runtergesetzt. Bekomme aber dann weiter die Infos, das die Grenzen erreicht sind. Wie kann ich herausfinden, über welche IP, ich denke von extern über meinen Mailserver die Mails versendet werden? Ich habe versucht im Log was herauszubeommen, leider ohne erfolg. Vielleicht könnt Ihr mir da Helfen. Danke Du Detlef
Symbol „Von der Community überprüft“
 
Hi Detlef,

That sounds like one or more email addresses are configured to forward received emails to a different email address that is not hosted on your server.

Check the Track Email Delivery option in the Mail tab (provided by the Log Browser extension):
1731171680319.png
In Outgoing Mail Control, an email address or a domain or a subscription is reaching the limits (https://server-address:8443/admin/outgoing-mail/general)?
 
I have a few email addresses that are there virtually, but are only redirected to an email address on the same server. But not on an external mail server.
 
If you have access to the actual maillog, you can use this to see how many emails were added to the mail queue by authenticating with a valid username and password.
Code:
grep "sasl_method" /var/log/maillog | grep sasl_username

This should give you the number of forwarded emails:
Code:
grep postfix/pickup /var/log/maillog | grep uid=30
 
domain.de is on the server as a dummy for the original domain
root@linux1:~# grep postfix/pickup /var/log/maillog | grep uid=30
Nov 9 09:02:18 linux1 postfix/pickup[3796248]: D46FF7FAB7: uid=30 from=<SRS0=qEV4=SE=bounce.gr-mail1.com=[email protected]>
Nov 9 10:01:59 linux1 postfix/pickup[3796248]: 2B26B7FAEA: uid=30 from=<SRS0=Xu3o=SE=bounce.getresponse-mail.com=[email protected]>
Nov 9 10:06:27 linux1 postfix/pickup[3796248]: 2DF077FC10: uid=30 from=<SRS0=zRKf=SE=ds1.caresend.de=[email protected]>
Nov 9 11:02:34 linux1 postfix/pickup[3798924]: 4FD9C7F93C: uid=30 from=<SRS0=qEV4=SE=bounce.gr-mail1.com=[email protected]>
Nov 9 11:03:27 linux1 postfix/pickup[3798924]: D199C7F93C: uid=30 from=<SRS0=zRKf=SE=ds1.caresend.de=[email protected]>
Nov 9 11:44:03 linux1 postfix/pickup[3798924]: 97AA17F932: uid=30 from=<SRS0=Gy0I=SE=mail.maydespion.us=35519-49179-152329-8535-deta=[email protected]>
Nov 9 11:45:21 linux1 postfix/pickup[3798924]: 9135C7F932: uid=30 from=<SRS0=S8+K=SE=miupqssp.com=[email protected]>
Nov 9 14:11:38 linux1 postfix/pickup[3802574]: 019B67E217: uid=30 from=<SRS0=8f9I=SE=mail.topsharestore.today=35526-49179-152329-8538-deta=[email protected]>
Nov 9 14:56:39 linux1 postfix/pickup[3802574]: 653347FBF4: uid=30 from=<SRS0=lGG4=SE=jok.zorotv.net.in=[email protected]>
Nov 9 15:00:12 linux1 postfix/pickup[3802574]: B94717FBF5: uid=30 from=<SRS0=EY83=SE=jok.zorotv.net.in=[email protected]>
Nov 9 15:03:34 linux1 postfix/pickup[3802574]: 945567FC43: uid=30 from=<SRS0=qYda=SE=jok.zorotv.net.in=[email protected]>
Nov 9 17:02:03 linux1 postfix/pickup[3804700]: 144CE7FB4D: uid=30 from=<SRS0=qEV4=SE=bounce.gr-mail1.com=[email protected]>
 
Code:
grep "D46FF7FAB7"/var/log/maillog
Find the recipient, it should be the same for all the forwarded emails.

Code:
grep "email address from the previous point" /var/qmail/mailnames/*/*/.qmail
It will tell you which email address forwards to the email address from the previous point. disable the forwarding or decrease the spam score for which the emails are deleted or delivered to the local spam folder.
 
Ich habe ein paar Weiterleitungen drinnen, habe die jetzt mal umgestellt auf Alias Adressen.
Mal sehen ob das nun vorbei ist. Werde berichten.
 
Back
Top