Question get spam sent out

[Detlef D.]

Server operating system version

Ubuntu 22.04.5 LTS

Plesk version and microupdate number

18.0.64

Hello,
SPAM is always being sent via a certain domain that is hosted on my server,
I can't figure out what or whether it's coming from outside. All I get is the messages that XXX emails have reached the limit.
To be on the safe side, I reduced it to 5 emails per hour. But then I continue to receive information that the limits have been reached.
How can I find out over which IP, I think externally via my mail server, the emails are sent?
I tried to find something in the log, unfortunately without success.

Maybe you can help me with that.

Thank you Detlef

Hallo, über eine bestimmte Domain, die auf meinen Server gehostet ist, wird immer SPAM versand, ich kann nicht herausbekommen, was oder ob von extern es kommt. Ich bekomme, nur die Nachrichten immer, das XXX Mails die Grenze erreicht haben. Ich hab erst mal aus sicherheit es auf 5 Mails pro Stunde runtergesetzt. Bekomme aber dann weiter die Infos, das die Grenzen erreicht sind. Wie kann ich herausfinden, über welche IP, ich denke von extern über meinen Mailserver die Mails versendet werden? Ich habe versucht im Log was herauszubeommen, leider ohne erfolg. Vielleicht könnt Ihr mir da Helfen. Danke Du Detlef

 

[Raul A.]

Hi Detlef,

That sounds like one or more email addresses are configured to forward received emails to a different email address that is not hosted on your server.

Check the Track Email Delivery option in the Mail tab (provided by the Log Browser extension):

In Outgoing Mail Control, an email address or a domain or a subscription is reaching the limits (https://server-address:8443/admin/outgoing-mail/general)?

 

[Detlef D.]

I have a few email addresses that are there virtually, but are only redirected to an email address on the same server. But not on an external mail server.

 

[Detlef D.]

What I have seen
email addresses No attempts to push the boundaries
domains 1 domain(s) above the limit

 

[Raul A.]

If you have access to the actual maillog, you can use this to see how many emails were added to the mail queue by authenticating with a valid username and password.

grep "sasl_method" /var/log/maillog | grep sasl_username

This should give you the number of forwarded emails:

grep postfix/pickup /var/log/maillog | grep uid=30

 

[Detlef D.]

domain.de is on the server as a dummy for the original domain

root@linux1:~# grep postfix/pickup /var/log/maillog | grep uid=30
Nov 9 09:02:18 linux1 postfix/pickup[3796248]: D46FF7FAB7: uid=30 from=<SRS0=qEV4=SE=bounce.gr-mail1.com=[email protected]>
Nov 9 10:01:59 linux1 postfix/pickup[3796248]: 2B26B7FAEA: uid=30 from=<SRS0=Xu3o=SE=bounce.getresponse-mail.com=[email protected]>
Nov 9 10:06:27 linux1 postfix/pickup[3796248]: 2DF077FC10: uid=30 from=<SRS0=zRKf=SE=ds1.caresend.de=[email protected]>
Nov 9 11:02:34 linux1 postfix/pickup[3798924]: 4FD9C7F93C: uid=30 from=<SRS0=qEV4=SE=bounce.gr-mail1.com=[email protected]>
Nov 9 11:03:27 linux1 postfix/pickup[3798924]: D199C7F93C: uid=30 from=<SRS0=zRKf=SE=ds1.caresend.de=[email protected]>
Nov 9 11:44:03 linux1 postfix/pickup[3798924]: 97AA17F932: uid=30 from=<SRS0=Gy0I=SE=mail.maydespion.us=35519-49179-152329-8535-deta=[email protected]>
Nov 9 11:45:21 linux1 postfix/pickup[3798924]: 9135C7F932: uid=30 from=<SRS0=S8+K=SE=miupqssp.com=[email protected]>
Nov 9 14:11:38 linux1 postfix/pickup[3802574]: 019B67E217: uid=30 from=<SRS0=8f9I=SE=mail.topsharestore.today=35526-49179-152329-8538-deta=[email protected]>
Nov 9 14:56:39 linux1 postfix/pickup[3802574]: 653347FBF4: uid=30 from=<SRS0=lGG4=SE=jok.zorotv.net.in=[email protected]>
Nov 9 15:00:12 linux1 postfix/pickup[3802574]: B94717FBF5: uid=30 from=<SRS0=EY83=SE=jok.zorotv.net.in=[email protected]>
Nov 9 15:03:34 linux1 postfix/pickup[3802574]: 945567FC43: uid=30 from=<SRS0=qYda=SE=jok.zorotv.net.in=[email protected]>
Nov 9 17:02:03 linux1 postfix/pickup[3804700]: 144CE7FB4D: uid=30 from=<SRS0=qEV4=SE=bounce.gr-mail1.com=[email protected]>

 

[Raul A.]

grep "D46FF7FAB7"/var/log/maillog

Find the recipient, it should be the same for all the forwarded emails.

grep "email address from the previous point" /var/qmail/mailnames/*/*/.qmail

It will tell you which email address forwards to the email address from the previous point. disable the forwarding or decrease the spam score for which the emails are deleted or delivered to the local spam folder.

 

[Detlef D.]

Ich habe ein paar Weiterleitungen drinnen, habe die jetzt mal umgestellt auf Alias Adressen.
Mal sehen ob das nun vorbei ist. Werde berichten.