Many postfix email attemps in maillog

[José María Antón]

Good afternoon,

I have a lot of problems with my postfix. My log are showing:

May 31 16:11:35 plesk sendmail[12243]: REJECT during call 'limit-out' handler
May 31 16:11:35 plesk sendmail[12248]: handlers_stderr: DATA REPLY:554:5.7.0 The message could not be sent. You are not allowed to use sendmail utility.#012REJECT
May 31 16:11:35 plesk sendmail[12248]: REJECT during call 'limit-out' handler
May 31 16:11:37 plesk sendmail[12252]: handlers_stderr: DATA REPLY:554:5.7.0 The message could not be sent. You are not allowed to use sendmail utility.#012REJECT
May 31 16:11:37 plesk sendmail[12252]: REJECT during call 'limit-out' handler
May 31 16:11:38 plesk sendmail[12256]: handlers_stderr: DATA REPLY:554:5.7.0 The message could not be sent. You are not allowed to use sendmail utility.#012REJECT
May 31 16:11:38 plesk sendmail[12256]: REJECT during call 'limit-out' handler
May 31 16:11:38 plesk sendmail[12260]: handlers_stderr: DATA REPLY:554:5.7.0 The message could not be sent. You are not allowed to use sendmail utility.#012REJECT
May 31 16:11:38 plesk sendmail[12260]: REJECT during call 'limit-out' handler

How can i stop this? https://kb.plesk.com/es/114845 does not showing anything.

Thanks.

 

[Lloyd_mcse]

Does this help...

https://kb.plesk.com/en/122888

Regards

Lloyd

 

[José María Antón]

Thanks,

but... i dont want to send emails, i want to stop this. Also, i see:

May 31 16:46:25 spamd[2774]: spamd: connection from localhost [127.0.0.1]:46305 to port 783, fd 5
May 31 16:46:25 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<8RQYHSY02gB/AAAB>
May 31 16:46:25 dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<cSAYHSY0LgB/AAAB>
May 31 16:46:25 dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, TLS, session=<xNAYHSY0eAB/AAAB>
May 31 16:46:25 dovecot: imap-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<PtwYHSY0EwB/AAAB>

I think some scripts are running and trying to send spam but i cannot identify this.

Thanks.

 

[UFHH01]

Hi José María Antón,

to investigate possible spam, you may follow:

For Postfix:
Many email messages are sent from PHP scripts on a server. How to find domains on which these scripts are running if Postfix is used? ( KB - article 114845 )

For Qmail:
Many email messages are sent from PHP scripts on the server. How to find the domains on which these scripts are running? ( KB - article 1711 )
​