New Message: Warning: 200 E-Mails have just been sent by [email protected]

[Tommyhara]

Hello,

I got this email

A new message or response with subject:

Warning: 200 E-Mails have just been sent by [email protected]

has arrived for you to view.
Follow this link to view it:

http://mydomain.com:2222/CMD_TICKET?action=view&number=000000762&type=message

================================
Automated Message Generated by DirectAdmin 1.60.4

Do Not Reply.


How to read the content of these emails and how to know where/which source sent these emails?


Thanks!

 

[Zhenyapan]

go to directadmin and check messages, there will be detailed message.

 

[Richard G]

How to read the content of these emails and how to know where/which source sent these emails?

Login as admin and have a look at the mail queue manager. Good chance some are not delivered or bounced and you might find where it's coming from in there.

 

[Tommyhara]

I didn't see any emails there.

Login as admin and have a look at the mail queue manager. Good chance some are not delivered or bounced and you might find where it's coming from in there.

 

[Richard G]

I don't know what messages @Zhenyapan was talking about, maybe he can explain what he means?
Unless he means the ticket messages, but that content is already in your post unless it says something additional.

Just a thought, it says:

Warning: 200 E-Mails have just been sent by [email protected]

Isn't [email protected] present on your server? If yes, than that is the source sending the emails.

If you can't find anything about it in the mail queue manager then also have a look in //var/log/exim if you can see something there.
It they are not authenticated mails, it can also be a malicious script or theme on that mydomain.com account which is abused.
You might want to do a scan by maldetect on that domain. I would install maldetect anyway for security purposes.

 

[Zhenyapan]

I mean this messages: http://joxi.ru/bmojjXPi9YdLlr
and here are: http://joxi.ru/l2ZppoJHEPL5jr
click on it and will see more detailed: http://joxi.ru/E2pQQxPuaLxoaA
also you can go directly to message by clicking on link from message

 

[Richard G]

click on it and will see more detailed: http://joxi.ru/E2pQQxPuaLxoaA
also you can go directly to message by clicking on link from message

The first 2 were known to me.
But I don't always get the last one. Isn't that only when it's authenticated mail? I don't see this info when it's mail send by a script (php mail).

 

[Zhenyapan]

detailed info only in "just been sent" messages, reminders copy "been sent yesterday" without details.

 

[Richard G]

I've had those "just been sent" about php send mails (so non authenticated), without detailed info. Odd... I'll have a look if it happens again. Thanks.

 

[Zhenyapan]

if you want to receive to email full messages too:
copy /usr/local/directadmin/data/templates/message_user.txt to /usr/local/directadmin/data/templates/custom/message_user.txt
and add tag |MESSAGE|
screen: http://joxi.ru/bmoJGgnt91KjDr

 

[Richard G]

Great, thank you very much!!

 

[Zhenyapan]

Version 1.32.3 | Directadmin Docs

DirectAdmin Knowledge Base

www.directadmin.com

 

[ikkeben]

Take care of spam mail en blockers for your server / domain after such, so check if you're not omn abuse list to be sure.

We had this once a custommer where one PC was hacked, his emailadres was abused through that pc to send mailspam over his emailasdres omn DA server.

So mailque , and which user, better to ask that user if they send many mails in that short time, if no warn them, and what i did was disabla account on DA server and amount alowed sending mails set to 0.

After that when a hacked adres, you better give them a new while it is kind of burned for lot of things, you wil see for very long time in log files it is.