Emails received from no sender <>

samjsharples

• April 10, 2015 11:34

Hi all On one of my accounts I am receiveing a large number of spam emails and the sender shows up as: <> 27941 27951 Could somebody please explain whats going on and how I can prevent this? Many thanks

• 

  cPanelMichael

  • April 13, 2015 18:19

  Hello, Could you search for that message ID in /var/log/exim_mainlog to see if you can find more information? EX:
  exigrep MSGID /var/log/exim_mainlog
  Thank you.

  0
• 

  keat63

  • April 15, 2015 14:31

  I have also been getting a few of these, and would be interested to learn what's going on.
  15:30:37 SMTP connection from [209.85.192.103]:34610 (TCP/IP connection count = 2) 15:30:38 H=mail-qg0-f103.google.com [209.85.192.103]:34610 Warning: Sender rate 1.0 / 1h 15:30:39 1Yi1rL-0002P6-4T H=mail-qg0-f103.google.com [209.85.192.103]:34610 Warning: Message has been scanned: no virus or other harmful content was found 15:30:43 1Yi1rL-0002P6-4T H=mail-qg0-f103.google.com [209.85.192.103]:34610 Warning: "SpamAssassin as xxx detected message as NOT spam (-0.7)" 15:30:43 1Yi1rL-0002P6-4T <= <> H=mail-qg0-f103.google.com [209.85.192.103]:34610 P=esmtps X=TLSv1.2:AES128-GCM-SHA256:128 S=13696 id=63a8ec45-4c69-40b6-91bb-ead948336ab3@usmef-ja.org[/EMAIL] T="Undeliverable: hi" for adamsdvg@user.co.uk[/EMAIL] 15:30:43 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Yi1rL-0002P6-4T 15:30:43 1Yi1rL-0002P6-4T => :blackhole: R=virtual_aliases 2015-04-14 15:30:43 1Yi1rL-0002P6-4T Completed 15:30:43 SMTP connection from mail-qg0-f103.google.com [209.85.192.103]:34610 closed by QUIT
  

  0
• 

  cPanelMichael

  • April 16, 2015 13:17

  Hello, The following line indicates the source of the message: 15:30:43 1Yi1rL-0002P6-4T <= <> H=mail-qg0-f103.google.com [209.85.192.103]:34610 P=esmtps X=TLSv1.2:AES128-GCM-SHA256:128 S=13696 id=63a8ec45-4c69-40b6-91bb-ead948336ab3@domain[/EMAIL] T="Undeliverable: hi" for adamsdvg@user.co.uk[/EMAIL]
  It's either SPAM, or a bounced message from "adamsdvg@user.co.uk[/EMAIL]". You may want to investigate that account to verify no SPAM messages are sent. Thank you.

  0
• 

  keat63

  • April 16, 2015 14:34

  In my case "adamsdvg@user.co.uk[/EMAIL]" doesnt exist. This was an email from sender <> to adamsdvg@user.co.uk[/EMAIL] which was in my logs. I have seen others recently.

  0
• 

  cPanelMichael

  • April 17, 2015 16:44

  Hello, Right, the message was sent to a blackhole since you have configured that for messages sent to email addresses that do not exist. The logs you provided show the message comes from "63a8ec45-4c69-40b6-91bb-ead948336ab3@$domain", but it's simply not included in the user interface from field due to the nature of the email address. Thank you.

  0

Please sign in to leave a comment.