Email delivered to an unknown email address

[smeko]

Hello everyone,

I am adminstrating a cpanel shared hosting server and one of my client is facing an issue with email deliverability for one email account within its domain.
I checked mail delivery report and as i see email is not delivered to local email address as below:

Event:	success
Sender User:	user
Sender Domain:	mydomain
From Address:	[email protected]
Sender:	[email protected]
Sent Time:	Apr 27, 2021, 4:32:16 PM
Sender Host:	authsmtp28.register.it
Sender IP:	81.88.54.69
Authentication:	forwarder
Spam Score:
Recipient:	[email protected]
Delivered To:	[email protected]
Delivery User:	-remote-
Delivery Domain:
Router:	dkim_lookuphost
Transport:	dkim_remote_smtp
Out Time:	Apr 27, 2021, 4:32:16 PM
ID:	1lbOkx-00Grzp-UQ
Delivery Host:	gmail-smtp-in.l.google.com
Delivery IP:	172.217.218.26
Size:	501.53 KB
Result:	Accepted

Why authentication type is forwarder ? i dont know [email protected].
Please can you help me troubleshoot this? I think this account is hacked but dont know how to resolve this.

Silvi

 

[cPRex]

Hey there! It seems like there is a forwarder setup in cPanel for the email address. If you check cPanel >> Forwarders do you see any created there?

 

[smeko]

Yes i checked and there is no forward rule that forward [email protected] to that gmail address. That is weird.

Silvi

 

[cPRex]

Do you see anything set up in /etc/valiases/domain.com that could explain this?

 

[smeko]

Hi,

The forward rules did not exist on forwarders but in a email account specific filter. I deleted that filter and everything is ok now.

Thank you

Silvi

 

[cPRex]

I'm glad you were able to track that down :D

 

[Pak Ardiansyah]

hi iam facing this problem to, i has checked etc/valiases/domain.com and there is some gmail addresses. just want to know how this problem can be happen. I mean, our user not create any filter or forwarder in cpanel. is this from malware or virus through outlook?

 

[cPRex]

@Pak Ardiansyah - if you don't recognize those addresses, I suppose it could be malicious content, but it is possible to just write values to those files directly over an SSH connection. Mailman also uses these files as well to setup list forwarding addresses, so that is another option.