LFD "suspicious process" mails from other server suddenly treated as spam?

[Richard G]

I check several servers and normally my mail address is in the alias so I also get root mail. In this case the sendering server is a cPanel server and some LFD mails are refused now.
But I can't find out why as they are not on any blacklist.

Reporting MTA somehosting is the cpanel server.

Reporting-MTA: dns; srv12.somehosting.nl

Action: failed
Final-Recipient: rfc822;[email protected]
Status: 5.0.0
Remote-MTA: dns; mail.mycompany.nl
Diagnostic-Code: smtp; 550-Your message to <[email protected]> was classified as SPAM.  Please
 550-add more content, cut down on HTML links, use fewer naughty words etc.
 550-Also, ask your IT dept to make sure your mailserver has REVERSEDNS, SPF,
 550 DKIM, and is not on any black lists. Your score: 156

156???
Sending server has both SPF and DKIM and correct rDNS and is not on any blacklist.
Normal root mails (like ssh login warnings) from LFD have no issues. So probably something in the content triggers the spam but I don't know where to look for it or what it can be.

Since rather shortly, don't know exactly since when, but this was not happening before.

In the log I see this:

drop message based on users high-scoring-spam setting (153 >= 150)

and
F=<> rejected after DATA: High scoring spam message has been dropped

I might be able to whitelist, but I would just like these mails to come through without isseus and don't know why these are suddenly seen as spam. Might have seen that in the past but age and memory leaks...

 

[zEitEr]

Easy Spam Fighter in action. It checks REVERSEDNS, SPF, DKIM
Check exim logs for clues

 

[Richard G]

Check exim logs for clues

As stated, all things are good, rDNS, SPF and DKIM are present. Other LFD mails are coming through. So it's not either one of them. If that would be the case the other LFD mails of that server would also be blocked but that is not happening.

The Exim logs don't see anything extra then what is stated in the first codeblock. This is Exim:

2026-10-21 19:39:43 1xJaHp-0000000Atnf-1yPV H=srv12.somehosting.nl [148.251.xxx.xxx] X=TLS1.3:TLS_AES_256_GCM_SHA384:256:x25519 F=<[email protected]> rejected after DATA: Your message to <[email protected]> was classified as SPAM.  Please add more content, cut down on HTML links, use f
ewer naughty words etc.  Also, ask your IT dept to make sure your mailserver has REVERSEDNS, SPF, DKIM, and is not on any black lists. Your score: 156
2026-10-21 19:39:50 1xJaHw-0000000Atwe-075l drop message based on users high-scoring-spam setting (153 >= 150)
2026-10-21 19:39:50 1xJaHw-0000000Atwe-075l H=srv12.somehosting.nl [148.251.xxx.xxx] X=TLS1.3:TLS_AES_256_GCM_SHA384:256:x25519 F=<> rejected after DATA: High scoring spam message has been dropped

Today I also got 2 LFD mail without any issues.
It's must be purely based on content of those specific LFD mails.

The problem mails look like this, it's the "suspicious process running under user" mails:

Time:    Wed Oct 21 19:39:35 2026 +0200
PID:     858464 (Parent PID:850270)
Account: customer
Uptime:  61 seconds


Executable:

/opt/cpanel/ea-php82/root/usr/bin/php-cgi


Command Line (often faked in exploits):

/opt/cpanel/ea-php82/root/usr/bin/php-cgi


Network connections by the process (if any):

tcp: 148.251.xxx.xxx:36136 -> 65.21.176.107:11020


Files open by the process (if any):

/home/customer/public_html/diversen/server/server4/clientstats.php
/var/cpanel/php/sessions/ea-php82/sess_98551855e82ad9980cbbb5d853db8a0b


Memory maps by the process (if any):

00400000-0042c000 r--p 00000000 09:03 15991983                           /opt/cpanel/ea-php82/root/usr/bin/php-cgi
00600000-0096e000 r-xp 00200000 09:03 15991983                           /opt/cpanel/ea-php82/root/usr/bin/php-cgi
00a00000-00b06000 r--p 00600000 09:03 15991983                           /opt/cpanel/ea-php82/root/usr/bin/php-cgi
00d75000-00e00000 r--p 00775000 09:03 15991983                           /opt/cpanel/ea-php82/root/usr/bin/php-cgi
00e00000-00e03000 rw-p 00800000 09:03 15991983                           /opt/cpanel/ea-php82/root/usr/bin/php-cgi
00e03000-00e21000 rw-p 00000000 00:00 0
0150d000-0189e000 rw-p 00000000 00:00 0                                  [heap]
14fc5fa3a000-14fc5fadb000 rw-p 00000000 00:00 0
14fc5fadb000-14fc5fb87000 r--s 00000000 09:03 22282601                   /var/db/nscd/hosts
14fc5fbd8000-14fc5fc08000 rw-p 00000000 00:00 0
14fc5fc08000-14fc5fc0b000 r--p 00000000 09:03 15991771                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/xmlreader.so
14fc5fc0b000-14fc5fc10000 r-xp 00003000 09:03 15991771                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/xmlreader.so
14fc5fc10000-14fc5fc12000 r--p 00008000 09:03 15991771                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/xmlreader.so
14fc5fc12000-14fc5fc13000 r--p 00009000 09:03 15991771                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/xmlreader.so
14fc5fc13000-14fc5fc14000 rw-p 0000a000 09:03 15991771                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/xmlreader.so
14fc5fc14000-14fc5fc17000 r--p 00000000 09:03 15991734                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/pdo_sqlite.so
14fc5fc17000-14fc5fc1b000 r-xp 00003000 09:03 15991734                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/pdo_sqlite.so
14fc5fc1b000-14fc5fc1c000 r--p 00007000 09:03 15991734                   /opt/cpanel/ea-php82/root/usr/lib64/php/modules/pdo_sqlite.so-

etc.

Only these are blocked.

The other ones like this "Excessive processes running under user":

Time:          Fri Oct 23 02:50:51 2026 +0200
Account:       othercustomer
Process Count: 31 (Not killed)

Process Information:

User:othercustomer PID:3868563 PPID:3867943 Run Time:2(secs) Memory:236520(kb) RSS:150744(kb) exe:/opt/cpanel/ea-php82/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php82/root/usr/bin/php-cgi
User:othercustomer PID:3868565 PPID:3846157 Run Time:2(secs) Memory:234472(kb) RSS:148688(kb) exe:/opt/cpanel/ea-php82/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php82/root/usr/bin/php-cgi
User:othercustomer PID:3868566 PPID:3867802 Run Time:2(secs) Memory:234472(kb) RSS:148684(kb) exe:/opt/cpanel/ea-php82/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php82/root/usr/bin/php-cgi
User:othercustomer PID:3868568 PPID:3845875 Run Time:2(secs) Memory:229584(kb) RSS:143760(kb) exe:/opt/cpanel/ea-php82/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php82/root/usr/bin/php-cgi
User:othercustomer PID:3868570 PPID:3867804 Run Time:2(secs) Memory:238632(kb) RSS:153056(kb) exe:/opt/cpanel/ea-php82/root/usr/bin/php-cgi cmd:/opt/cpanel/ea-php82/root/usr/bin/php-cgi

and root login warnings are all coming through without issue and have X-Spam-Score: -1.1 (-). So that is great.

It's only those suspicious process mails which are blocked and as it looks due to content. This was not happening before.
In the headers of the return mails I don't see any score info.

 

[zEitEr]

As stated, all things are good, rDNS, SPF and DKIM are present.

Don't shoot the messenger. That block comes from Easy Spam Fighter, see the "Diagnostic-Code". Neither SpamAssassin nor rSpamd adds such lines. I don't know why Easy Spam Fighter is triggered here. Not going to hold a debate. Sorry))

p.s. Lines from exim's logs are from different emails. You might check and compare MID in the lines.

 

[Richard G]

Don't shoot the messenger.

I don't shoot, but you mentioned this and I already stated and prooved that this was fine, so I thought you might have missed that, sorry.

Indeed it looks from ESF as you say. Don't want to debate that either. Since SPF, DKIM and rDNS work correctly which is prooved at my side with any other mail inclusing other LFD mails, is the reason I thought it might be content since the error notice also says: cut down on HTML links. My mistake then.

p.s. Lines from exim's logs are from different emails.

No it's the same, I doublechecked.
October 21th 19:39 hours, same as that specific LFD message I got later as attachment on a undeliverable mail. And also same LFD message as the LFD message refused today.
The last one is no log but an LFD mail about excessive process which is received, only the suspicous ones are refused.

I don't know why Easy Spam Fighter is triggered here.

I don't either. Is there a way we can create a special log or add some stuff which would give more ESF info in the returned message or something?

 

[zEitEr]

The First line: 2026-10-21 19:39:43 1xJaHp-0000000Atnf-1yPV
The Second and following lines: 2026-10-21 19:39:50 1xJaHw-0000000Atwe-075l
By default ESF logs additional info in exim log.

The commands should catch them all:

exigrep [B]1xJaHp-0000000Atnf-1yPV[/B] /var/log/exim/mainlog

exigrep [B]1xJaHw-0000000Atwe-075l[/B] /var/log/exim/mainlog

 

[Richard G]

Ah buggers... I checked with nano and since it was a few seconds difference I missed that it was 2 messages, also because I only got a return of 1 refused message. I missed the message id's even when looking back when you wrote it was different ones. I mistakenly thought the second one was the result of the extra info of the first one. I feel stupid now.

Still... no extra info to be found what is not in previous posted logparts.

First command output:

+++ 1xJaHp-0000000Atnf-1yPV has not completed +++
2026-10-21 19:39:43 1xJaHp-0000000Atnf-1yPV H=srv12.somehosting.nl [148.251.xxx.xxx] X=TLS1.3:TLS_AES_256_GCM_SHA384:256:x25519 F=<[email protected]> rejected after DATA: Your message to <[email protected]> was classified as SPAM.  Please add more content, cut down on HTML links, use fewer naughty words etc.  Also, ask your IT dept to make sure your mailserver has REVERSEDNS, SPF, DKIM, and is not on any black lists. Your score: 156

Second command output:

+++ 1xJaHw-0000000Atwe-075l has not completed +++
2026-10-21 19:39:50 1xJaHw-0000000Atwe-075l drop message based on users high-scoring-spam setting (153 >= 150)
2026-10-21 19:39:50 1xJaHw-0000000Atwe-075l H=srv12.somehosting.nl [148.251.xxx.xxx] X=TLS1.3:TLS_AES_256_GCM_SHA384:256:x25519 F=<> rejected after DATA: High scoring spam message has been dropped

Thats all. Still can't find a cause that only those message are refused.
My variables.conf.custom file:

EASY_LIMIT == 50
EASY_SPF_PASS == 0
EASY_DKIM_PASS == 0
EASY_DNS_BLACKLIST == 100
EASY_FORWARD_CONFIRMED_RDNS == 0

I changed SPF an DKIM pass and confirmed rDNS to 0 not too long ago, because there is no reason anymore imho to reward systems to having this as also spammers have these nowadays.
However, then all LFD from that server should be refused, not only those with suspicious in the subject.

I've also root access to the sending sever, seems somehow it's going via Microsoft, same time, but other message id.
This is from same date/time on the sending server:

2026-10-21 19:39:37 1xJaHn-00000003cTg-31uJ => [email protected] <[email protected]> R=dkim_lookuphost T=dkim_remote_smtp H=somehosting-nl.mail.protection.outlook.com [52.101.103.39] X=TLS1.3:TLS_AES_256_GCM_SHA384:256:secp384r1 CV=yes C="250 2.6.0 <[email protected]> [InternalId=79671643355514, Hostname=PAWPR05MB10986.eurprd05.prod.outlook.com] 76994 bytes in 0.279, 269.091 KB/sec Queued mail for delivery"
2026-10-21 19:39:43 1xJaHn-00000003cTg-31uJ ** [email protected] <[email protected]> R=dkim_lookuphost T=dkim_remote_smtp H=mail.mycompany.nl [138.201.xxx.xxx] X=TLS1.3:TLS_AES_256_GCM_SHA384:256:x25519 CV=no : SMTP error from remote mail server after end of data: 550-Your message to <[email protected]> was classified as SPAM.  Please\n550-add more content, cut down on HTML links, use fewer naughty words etc.\n550-Also, ask your IT dept to make sure your mailserver has REVERSEDNS, SPF,\n550 DKIM, and is not on any black lists. Your score: 156
2026-10-21 19:39:43 cwd=/var/spool/exim 7 args: /usr/sbin/exim -t -oem -oi -f <> -E1xJaHn-00000003cTg-31uJ
2026-10-21 19:39:43 1xJaHv-00000003cZe-3i71 <= <> R=1xJaHn-00000003cTg-31uJ U=mailnull P=local S=65895 T="Mail delivery failed: returning message to sender" for [email protected]
2026-10-21 19:39:43 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1xJaHv-00000003cZe-3i71
2026-10-21 19:39:43 1xJaHn-00000003cTg-31uJ Completed
2026-10-21 19:39:44 1xJaHv-00000003cZe-3i71 Sender identification U=mailnull D=-system- S=mailnull
2026-10-21 19:39:44 1xJaHv-00000003cZe-3i71 Sender identification U=mailnull D=-system- S=mailnull
2026-10-21 19:39:44 1xJaHv-00000003cZe-3i71 [138.201.xxx.xxx] SSL verify error: certificate name mismatch: DN="/CN=server26.mycompanyhosting.nl" H="mail.mycompany.nl"
2026-10-21 19:39:50 1xJaHv-00000003cZe-3i71 ** [email protected] <[email protected]> R=dkim_lookuphost T=dkim_remote_smtp H=mail.mycompany.nl [138.201.xxx.xxx] X=TLS1.3:TLS_AES_256_GCM_SHA384:256:x25519 CV=no : SMTP error from remote mail server after end of data: 550 High scoring spam message has been dropped