Relayed Message

epanagio

• December 17, 2015 15:45

I received an email with the following information similar to the following: 2015-12-17 15:16:40 1a9eyc-0001W8-LK <= aboubillal@H=() [59.88.189.98]:50047 P=esmtpa A=dovecot_plain:epanagio@ S=12795 id=0939C7D3D33F76EA440E0738E2FC965E@ T="12/7/2015 9:11:59 PM" for e3-29494700393-1d2e7II15af0bII4@e3.emarsys.net e3-29492660379-15016II5842d8II4@e3.emarsys.net e3-29490694629-826bII1cf32cII4@e3.emarsys.net
I have limited this specific account to 100 email an hour. They reached the limit and I lowered it to 10 per hour. I changed the password for epanagio but I would like to know:

]
• how can I prevent this from happening again;
• was epanagio account's password compromised?

• 

  cPanelMichael

  • December 17, 2015 20:52

  Hello :) Could you provide more information about the email? What's the corresponding entry in /var/log/exim_mainlog? EX:
  exigrep user@domain /var/log/exim_mainlog
  Thank you.

  0
• 

  epanagio

  • December 17, 2015 21:06

  The email I referenced above was above the limit I had set: exigrep 1a9eyc-0001W8-LK /var/log/exim_mainlog 2015-12-17 15:16:40 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1a9eyc-0001W8-LK 2015-12-17 15:16:40 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1a9eyc-0001W8-LK 2015-12-17 15:16:40 1a9eyc-0001W8-LK H=() [59.88.189.98]:50047 Warning: "SpamAssassin as cpaneleximscanner detected OUTGOING smtp message as NOT spam (2.7)" 2015-12-17 15:16:40 1a9eyc-0001W8-LK <= aboubillal@ H=() [59.88.189.98]:50047 P=esmtpa A=dovecot_plain:epanagio@ S=12795 id=0939C7D3D33F76EA440E0738E2FC965E@ T="12/7/2015 9:11:59 PM" for e3-29494700393-1d2e7II15af0bII4@e3.emarsys.net e3-29492660379-15016II5842d8II4@e3.emarsys.net e3-29490694629-826bII1cf32cII4@e3.emarsys.net 2015-12-17 15:16:40 1a9eyc-0001W8-LK ** e3-29490694629-826bii1cf32cii4@e3.emarsys.net R=enforce_mail_permissions: Domain has exceeded the max emails per hour (125/100 (125%)) allowed. Message discarded. 2015-12-17 15:16:40 1a9eyc-0001W8-LK ** e3-29492660379-15016ii5842d8ii4@e3.emarsys.net R=enforce_mail_permissions: Domain has exceeded the max emails per hour (125/100 (125%)) allowed. Message discarded. 2015-12-17 15:16:40 1a9eyc-0001W8-LK ** e3-29494700393-1d2e7ii15af0bii4@e3.emarsys.net R=enforce_mail_permissions: Domain has exceeded the max emails per hour (125/100 (125%)) allowed. Message discarded. 2015-12-17 15:16:40 1a9eyc-0001W8-LK Completed 2015-12-17 15:16:40 1a9eye-0001WT-BH <= <> R=1a9eyc-0001W8-LK U=mailnull P=local S=14904 T="Mail delivery failed: returning message to sender" for aboubillal@ 2015-12-17 15:16:40 1a9eye-0001WT-BH => osr > R=localuser T=local_delivery 2015-12-17 15:16:40 1a9eye-0001WT-BH Completed
  

  0
• 

  epanagio

  • December 17, 2015 21:09

  I found spam email that was sent today: 2015-12-17 16:06:13 1a9fkV-0004aV-Af H=() [122.170.132.91]:54882 Warning: "SpamAssassin as cpaneleximscanner detected OUTGOING smtp message as NOT spam (3.7)" 2015-12-17 16:06:14 1a9fkV-0004aV-Af <= talvyalain@ H=() [122.170.132.91]:54882 P=esmtpa A=dovecot_plain:epanagio@ S=13628 id=48BE021565F88AF445E0E22EAFB7AD3F@ T="12/7/2015 10:01:18 PM" for [Removed]
  

  0
• 

  cPanelMichael

  • February 02, 2016 19:58

  I am happy to see you were able to determine the source of the SPAM. Note that this document may help for future cases: How to Prevent Email Abuse - cPanel Knowledge Base - cPanel Documentation Thank you.

  0

Please sign in to leave a comment.