Facebook
Twitter
Maximilian Füsslin
New Pleskian
Hello,
I recently got an abuse mail by my hosting provider, stating that my server is sending spam.
The following excerpt was attached to the abuse mail:
My IP: 94.130.34.42 (does the port 34284 indicate, that mail was sent through this port?)
I searched in the logs /var/log/mail.log for indicators... I found at around 19:23:36 the following logs:
Especially is interesting as it does indicate the attempt to send a mail via postfix on my server:
Feb 18 19:23:08 zeus postfix/smtpd[18283]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.lotsearch.de>
If I interpret it correctly the attempt to send an unautorized mail via my server was declined (relay access denied). I found similar lines from the same from-address ([email protected]) in the log file more than 25 times.
What I did so far:
We are sending out around 50 emails per day to our users as we are hosting a notification service (The users are registered at our website and created the notifications themselves; we also used double-opt-in to make sure that users want to receive our emails). It is like ebay where you get notified if an alert for a specific search term matches a new result in ebay's auctions.
How can I identify sources of spam on my server? How can I configure PLESK to prevent spammers using my server for their spam mails? Was the attached mail in the abuse email really sent by my server or would it be possible that the headers are spoofed?
Another thing: I have an catchall mailbox where all mails to non-existent users are sent to "[email protected]". Is it possible that the receiving mail server "otherserver.com" filed an abuse against my current server because I forward (suspicious / spam) mails to it (see attached screenshot)?
I am glad for any help. Thank you in advance.
Sincerely
Maximilian Füsslin
I recently got an abuse mail by my hosting provider, stating that my server is sending spam.
The following excerpt was attached to the abuse mail:
Code:
[ SpamCop V4.8.7 ]
This message is brief for your comfort. Please use links below for details.
Email from 94.130.34.42 / Sun, 18 Feb 2018 19:23:36 +0000
#spamcop link
[ Offending message ]
Received: from mail.microdream.co.uk
by mail.microdream.co.uk with LMTP id 0KD1B7jSiVo9XQAADkLJhQ
for <x>; Sun, 18 Feb 2018 19:23:36 +0000
Received: from mail.lotsearch.de ([94.130.34.42]:34284)
by mail.microdream.co.uk with esmtp (Exim 4.89_1)
(envelope-from <[email protected]>)
id 1enUYU-0006CH-32
for x; Sun, 18 Feb 2018 19:23:36 +0000
From: "eBay" <[email protected]>
To: "x" <x>
Subject: ***SPAM*** Ihre eBay-Rechnung für Februar ist ab jetzt online verfügbar
Date: Mon, 19 Feb 2018 05:23:15 -0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0AFC_01D3A961.70959750"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AdOo7fjf7U04suYiTgKyysKAiejimQ==
This is a multipart message in MIME format.
------=_NextPart_000_0AFC_01D3A961.70959750
Content-Type: text/plain;
charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
...
------=_NextPart_000_0AFC_01D3A961.70959750--My IP: 94.130.34.42 (does the port 34284 indicate, that mail was sent through this port?)
I searched in the logs /var/log/mail.log for indicators... I found at around 19:23:36 the following logs:
Code:
Feb 18 19:22:39 zeus postfix/smtpd[18283]: connect from unknown[91.200.12.82]
Feb 18 19:22:39 zeus plesk_saslauthd[18324]: listen=6, status=5, dbpath='/plesk/passwd.db', keypath='/plesk/passwd_db_key', chroot=1, unprivileged=1
Feb 18 19:22:39 zeus plesk_saslauthd[18324]: privileges set to (111:116) (effective 111:116)
Feb 18 19:22:39 zeus plesk_saslauthd[18324]: failed mail authenticatication attempt for user 'Office' (password len=7)
Feb 18 19:22:39 zeus postfix/smtpd[18283]: warning: unknown[91.200.12.82]: SASL LOGIN authentication failed: authentication failure
Feb 18 19:22:39 zeus postfix/smtpd[18283]: lost connection after AUTH from unknown[91.200.12.82]
Feb 18 19:22:39 zeus postfix/smtpd[18283]: disconnect from unknown[91.200.12.82] ehlo=1 auth=0/1 commands=1/2
Feb 18 19:23:05 zeus postfix/smtpd[18283]: connect from localhost.localdomain[127.0.0.1]
Feb 18 19:23:08 zeus postfix/smtpd[18283]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.lotsearch.de>
Feb 18 19:23:09 zeus plesk_saslauthd[18324]: select timeout, exiting
Feb 18 19:23:10 zeus postfix/smtpd[18283]: lost connection after RSET from localhost.localdomain[127.0.0.1]
Feb 18 19:23:10 zeus postfix/smtpd[18283]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 mail=1 rcpt=0/1 rset=1 commands=3/4
Feb 18 19:23:10 zeus /usr/lib/plesk-9.0/psa-pc-remote[1388]: Message aborted.
Feb 18 19:23:10 zeus /usr/lib/plesk-9.0/psa-pc-remote[1388]: Message aborted.
Feb 18 19:23:24 zeus postfix/smtpd[18283]: warning: hostname walkerj235.example.com does not resolve to address 91.200.12.226: Name or service not known
Feb 18 19:23:24 zeus postfix/smtpd[18283]: connect from unknown[91.200.12.226]
Feb 18 19:23:24 zeus plesk_saslauthd[18355]: listen=6, status=5, dbpath='/plesk/passwd.db', keypath='/plesk/passwd_db_key', chroot=1, unprivileged=1
Feb 18 19:23:24 zeus plesk_saslauthd[18355]: privileges set to (111:116) (effective 111:116)
Feb 18 19:23:24 zeus plesk_saslauthd[18355]: failed mail authenticatication attempt for user 'setup' (password len=9)
Feb 18 19:23:24 zeus postfix/smtpd[18283]: warning: unknown[91.200.12.226]: SASL LOGIN authentication failed: authentication failure
Feb 18 19:23:24 zeus postfix/smtpd[18283]: lost connection after AUTH from unknown[91.200.12.226]
Feb 18 19:23:24 zeus postfix/smtpd[18283]: disconnect from unknown[91.200.12.226] ehlo=1 auth=0/1 commands=1/2
Feb 18 19:23:49 zeus dovecot: pop3-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<oneill>, method=PLAIN, rip=50.227.181.106, lip=94.130.34.42, session=<+IqxrYBlkmoy47Vq>
Feb 18 19:23:54 zeus plesk_saslauthd[18355]: select timeout, exitingEspecially is interesting as it does indicate the attempt to send a mail via postfix on my server:
Feb 18 19:23:08 zeus postfix/smtpd[18283]: NOQUEUE: reject: RCPT from localhost.localdomain[127.0.0.1]: 454 4.7.1 <[email protected]>: Relay access denied; from=<[email protected]> to=<[email protected]> proto=ESMTP helo=<mail.lotsearch.de>
If I interpret it correctly the attempt to send an unautorized mail via my server was declined (relay access denied). I found similar lines from the same from-address ([email protected]) in the log file more than 25 times.
What I did so far:
- changed passwords of all mail accounts
- added iptables rule
to only allow postfix using port 25 outgoingCode:iptables -I OUTPUT -m owner ! --uid-owner postfix -m tcp -p tcp --dport 25 -j REJECT - enabled dkim / dmarc / spf (I did this 8 months ago already)
We are sending out around 50 emails per day to our users as we are hosting a notification service (The users are registered at our website and created the notifications themselves; we also used double-opt-in to make sure that users want to receive our emails). It is like ebay where you get notified if an alert for a specific search term matches a new result in ebay's auctions.
How can I identify sources of spam on my server? How can I configure PLESK to prevent spammers using my server for their spam mails? Was the attached mail in the abuse email really sent by my server or would it be possible that the headers are spoofed?
Another thing: I have an catchall mailbox where all mails to non-existent users are sent to "[email protected]". Is it possible that the receiving mail server "otherserver.com" filed an abuse against my current server because I forward (suspicious / spam) mails to it (see attached screenshot)?
I am glad for any help. Thank you in advance.
Sincerely
Maximilian Füsslin
