External users sending e-mail as user __cpanel__service__auth__icontact__xxx
My server is sending e-mails that are authenticated by what seems to be a cpanel user. Here are some logs:
2025-02-17 12:59:58 1tk5PS-0000000DfvQ-45tR <= outsideuser@domain H=(localhost.localdomain) [127.0.0.1]:46654 P=esmtpa A=dovecot_plain:__cpanel__service__auth__icontact__anaslzwfqmqe0y49 S=7655 T="Invite: custom subject" for user1@domains1
2025-02-17 12:59:59 1tk5PT-0000000DfvT-2dBO <= outsideuser@domain H=(localhost.localdomain) [127.0.0.1]:46660 P=esmtpa A=dovecot_plain:__cpanel__service__auth__icontact__anaslzwfqmqe0y49 S=7661 T="Invite: custom subject" for user2@domain2
I replaced real emails by outsideuser@domain and user1@domain1 and so on to protect my data. All other information is what I have from /var/log/exim_mainlog
Does anyone know how can I block my server from sending these e-mails?
-
I also what to add that I have being receiving abuse reports for this server from SPFBL.net so it is very important to stop these e-mails from being sent
0 -
Hey there! I believe what you're seeing here is related to case HB-7786 which was discussed here:
Does that seem like the same behavior you're experiencing?
0 -
Yes, that's exactly the same
0 -
Thanks for the confirmation - I've added your report to the list and I've asked the developers to see if this could get some priority.
1 -
Hello
Could you please provide an update on this issue ? I am experiencing the same problem on my server and would appreciate any guidance or resolution steps1 -
I don't have any updates to provide just yet as the team is still working on this case.
0 -
More details can be found in the following thread: https://support.cpanel.net/hc/en-us/community/posts/27447318536087--cpanel-service-auth-icontact-sending-spam?page=1#community_comment_31931632991639
0
Please sign in to leave a comment.
Comments
7 comments