Topic: email stops functioning [SOLVED]

[crazybob]

I am not sure where my problem is with my email, but it stops a couple of times a day. I have been uninstalling and re-installing qmail to get it running again.
I have Qmail queue management installed and when I look at the queue, I will see that there are 800 to 2000 messages in the remote queue.
Here are a couple of examples of the messages

Code: [Select]

MESSAGE NUMBER 18301999
 --------------
Received: (qmail 24871 invoked by uid 453); 21 Aug 2015 13:13:02 -0000
Received: from cable-178-148-247-163.dynamic.sbb.rs (HELO srdpc.com) (178.148.247.163)
  (smtp-auth username jmorgan@rjm-design.com, mechanism plain)
  by srdpc.com (qpsmtpd/0.84) with (AES256-SHA encrypted) ESMTPSA; Fri, 21 Aug 2015 09:13:02 -0400
Subject: from:  Prayuansy Langsy
From: Prayuansy Langsy
Content-Type: multipart/alternative;
boundary=Apple-Mail-3FE75221-2AFD-6FAB-E476-D7C3C70443C0
X-Mailer: iPhone Mail (12D508)
Message-Id: <74397864347b$8f90063b$4312b115$@rjm-design.com>
Date: Thu, 21 Aug 2015 02:13:01 +0000
To: "Roger"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (1.0)
X-Virus-Checked: Checked by ClamAV on srdpc.com


--Apple-Mail-3FE75221-2AFD-6FAB-E476-D7C3C70443C0
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit

Breaking news: http://gudangoxone.com/wait.php?Prayuansy_Langsy
 
Prayuansy Langsy

Sent from my iPhone   



--Apple-Mail-3FE75221-2AFD-6FAB-E476-D7C3C70443C0
Content-Type: text/html;
charset=utf-8
Content-Transfer-Encoding: 7bit

Breaking news: http://gudangoxone.com/wait.php?Prayuansy_Langsy

 

Prayuansy Langsy

Sent from my iPhone   



--Apple-Mail-3FE75221-2AFD-6FAB-E476-D7C3C70443C0--



 --------------
MESSAGE NUMBER 18302017
 --------------
Received: (qmail 24946 invoked by uid 453); 21 Aug 2015 13:13:15 -0000
Received: from cable-178-148-247-163.dynamic.sbb.rs (HELO srdpc.com) (178.148.247.163)
  (smtp-auth username jmorgan@rjm-design.com, mechanism plain)
  by srdpc.com (qpsmtpd/0.84) with (AES256-SHA encrypted) ESMTPSA; Fri, 21 Aug 2015 09:13:15 -0400
Subject: from:  Jeffrey Nadeau
From: Jeffrey Nadeau
Content-Type: multipart/alternative;
boundary=Apple-Mail-25D928D1-9FCB-D743-65E5-7C8E2A41F3AB
X-Mailer: iPhone Mail (12D508)
Message-Id: <7b6d111d9c80$c45f3d01$5fa8f27c$@rjm-design.com>
Date: Thu, 21 Aug 2015 02:13:09 +0000
To: "affinity ma" , "afrane" , "agentamyjolyns" , "atusz" , "bbauer" , "bergie11007" , "blm2" , "camerabird" , "camrabird" , "Careers" , "CBryntesen" , "cseidelman" , "dholzer" , "dominic00036" , "gvhanson" , "hmccool" , "jfroelke" , "job edxqb 2219909970" , "jobs" , "James"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (1.0)
X-Virus-Checked: Checked by ClamAV on srdpc.com


--Apple-Mail-25D928D1-9FCB-D743-65E5-7C8E2A41F3AB
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi! http://pakundobet.it/here.php?Jeffrey_Nadeau

How are you?

Jeffrey Nadeau
Sent from my iPhone
--Apple-Mail-25D928D1-9FCB-D743-65E5-7C8E2A41F3AB
Content-Type: text/html;
charset=utf-8
Content-Transfer-Encoding: 7bit

Hi! http://pakundobet.it/here.php?Jeffrey_Nadeau


How are you?


Jeffrey Nadeau
Sent from my iPhone
--Apple-Mail-25D928D1-9FCB-D743-65E5-7C8E2A41F3AB--

rjm-design is a domain I have on my server, and jmorgan@rjm-design is a user.
He is at a remote location, and I have checked his computer for virus and malware, and it came up clean.
 
srdpc.com is my main domain, and 134.215.197.162 is my static ip.

I am having the same issue with another domain on my server.
Have I been hacked, or is this a problem with spoofing?
Looking for a direction to go in to clear this up.
Thanks

[guest22]

Looks like someone is simply spamming your from Belgrade.

[mmccarn]

According to mxtoolbox, the sending IP is listed by both spamhaus and sorbs.

You might consider adding 'zen.spamhaus.org' to your RBLList config.

(Of course, it's also possible that you're already using spamhaus, but the sending IP wasn't listed for a day or two after it started spamming...)
 

[Stefano]

 maybe I'm wrong but

(smtp-auth username jmorgan@rjm-design.com, mechanism plain)

AFAIK this line is saying that it's legitimate email.. user is authenticating..
am I wrong?

[crazybob]

Yes, he is a legitimate user.

I am using zen.spamhaus.org in my RBBList

[Stefano]

Then change his password...

[crazybob]

I will try that.

[Stefano]

well, IIUC, you have a user account that is spamming via authenticated smtp..

I'm quite sure you MUST change his password ASAP

[crazybob]

Thank you all for a quick response.

I have changed passwords on two accounts that were showing to be the problem. I will watch how things progress.

Bob

[crazybob]

Changing the passwords seems to have fixed it. Thanks.