Warning: ### emails have been sent yesterday by username

Hi,

I receive every day this message: Warning: ### emails have been sent yesterday by username

and now i'm blocked by spam filters so my emails are going to spam box or are not being sent. I have set up a limit, have the exim.pl last version changed passwords but its keeps saying that there are emails been sent yesterday by user *****.

What can i do more?

Thanks

Hello,

Find a spammer, or a compromised account - stop spam. Upgrade software/configuration, and secure your server.

You've got spam sent either through a PHP script or via authorisation with login/pass of an email box. Read exim logs and check email usage in directadmin to find more details.

All that you may do yourself or hire somebody to do it for you. Please feel free to PM anyone here who you trust for a quote.

Hello,

Thanks for the message. Which software i must upgrade exactly? I checked mainlog and see this, the mailadresses raqi and woliv i didnt make them:

2014-06-25 21:35:43 1WvCkJ-0001QY-Iw SMTP error from remote mail server after MAIL FROM:<raqi@****.nl> SIZE=1711: host mx3.hotmail.com [65.55.37.88]: 421 RP-001 (COL004-MC2F41) Unfortunately, some messages from ***** weren't sent. Please try again. We have limits for how many messages can be sent per hour and per day. You can also refer to http://mail.live.com/mail/troubleshooting.aspx#errors.
2014-06-25 21:35:43 1WvCkJ-0001QY-Iw SMTP error from remote mail server after MAIL FROM:<raqi@*****.nl> SIZE=1711: host mta5.am0.yahoodns.net [98.136.216.26]: 421 4.7.1 [TS03] All messages from ***** will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/421-ts03.html
2014-06-25 21:35:43 1Wrtfj-0007QY-UB SMTP error from remote mail server after MAIL FROM:<woliv@*****.nl> SIZE=1747: host mta5.am0.yahoodns.net [66.196.118.37]: 421 4.7.1 [TS03] All messages from ***** will be permanently deferred; Retrying will NOT succeed. See http://postmaster.yahoo.com/421-ts03.html

My mainlog is 81 MB big, its full of messages like this.

Actually, those users did send the emails, either by authorized login or because a php or other script on the server was compromised.

The loglines you posted don't help us determine how the mail got onto your server. You should find and post the lines which show how the spam arrived on your server.

Also, when you get those xxx emails have been sent notices, log in and read the messages on your server. They'll likely help you figure out the origin of the errors.

How many emails do you allow? What does the xxx really mean? Perhaps you need to use a lower number. When we find clients sending spam we temporarily lower their allowance to 1 (usually be creating their own limit file) so we can start cleaning up our reputation with blocklists immediately.

Jeff

myilmaz said:

Hello,

Thanks for the message. Which software i must upgrade exactly? I checked mainlog and see this, the mailadresses raqi and woliv i didnt make them:My mainlog is 81 MB big, its full of messages like this.

Click to expand...

Those are bounces. You should check email usage either in directadmin on per user level or in root shell by analyzing of /etc/virtual/usage/ to find more details. Also exigrep is at your service to grep lines related to one email message from exim logs.

Detailed commands you can find by searching the forums using exigrep as a keyword.

Hi Thanks both for messages, i'm a noob sorry so i don't know which info is needed to determine the script or where the mail is sending.

When i go now to user who is sending spam, i can't see the email addresses, by email usage i see this:



Maybe you can help me?

If these lines are from directadmin page, then check box upper them. There you should see some stats. You probably need to upgrade /etc/exim.pl to the latest release (http://help.directadmin.com/item.php?id=51) to exclude retries from being counted (it's an option, and won't help against spam).

Maybe you can help me?

Click to expand...

Yes, in case you need my private help, then I'm at your service. Please drop me a PM for a quote.

myilmaz said:

Hi Thanks both for messages, i'm a noob sorry so i don't know which info is needed to determine the script or where the mail is sending.

When i go now to user who is sending spam, i can't see the email addresses, by email usage i see this

Click to expand...

You need to grep your logs at /var/log/exim/mainlog for both the username and the auth information. As I wrote previously, those messages from DirectAdmin hold a lot of clues; if you've not yet deleted them they'll tell you a lot.

Both zEitEr and I are available for private work (to hire me send me an email to the address below in my siglines) but before I could help you I'd need answers to the questions I asked above.

Jeff

I got this system message from an account.
But that domain's email is not handled by local mail. It is handled by google's app. ALL MX records are pointed to google's gmail app service

It is handled by google's app.

Click to expand...

That does not mean that

1. emails can't be sent from PHP scripts on the account;
2. nobody can't use credentials of the account to connect to a SMTP server and send emails

You need investigate the issue either by yourself or hire somebody to check it for you. Your server (or account) might be compromised or login/password stolen. If you need someone to check it for you please feel free to contact Jeff or me for a quote.