Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Email received without any headers at all

Discussion in 'E-mail Discussion' started by Frankc, Dec 1, 2017.

  1. Frankc

    Frankc Well-Known Member

    Joined:
    Jun 18, 2005
    Messages:
    103
    Likes Received:
    1
    Trophy Points:
    168
    I tried everywhere but can't get any answer so far so maybe one of your guys can help.

    1) Custom autoresponder 2) Pipe email info2@domain to program 3) Noticed unlikely email addresses 4) Identical subject + body

    Any way how I can find out where it comes from please?

    As per maillog

    Code:
    --------------
    
    Nov 27 12:34:32 venus dovecot: lmtp(7212): Connect from local
    Nov 27 12:34:32 venus dovecot: lmtp(info2@xxlocaldomainxx): msgid=<E1eJGkB-0001ti-WB@venus.xxlocaldomainxx>: saved mail to INBOX
    Nov 27 12:34:32 venus dovecot: lmtp(7212): Disconnect from local: Successful quit
    
    As per exim maillog
    -------------------
    
    2017-12-01 13:48:43 cwd=/home/saweb/public_html 3 args: /usr/sbin/sendmail -t -i
    2017-12-01 13:48:43 1eKjoB-0000kV-IV <= saweb@venus.xxlocaldomainxx U=saweb P=local S=473 T="Subscribe" for info2@--domain.com--
    2017-12-01 13:48:43 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1eKjoB-0000kV-IV
    2017-12-01 13:48:43 1eKjoB-0000kV-IV => info2 <info2@--domain.com--> R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 <info2@--domain.com--> mMG1J5tBIVosCgAAgSsXIg Saved"
    2017-12-01 13:48:43 cwd=/home/saweb/public_html 3 args: /usr/sbin/sendmail -t -i
    
    With the email source (for most the same except the "subscribe" email address
    ---------------------
    
    Return-Path: <saweb@venus.xxlocaldomainxx>
    Delivered-To: info2@--domain.com--
    Received: from venus.xxlocaldomainxx
       by venus.xxlocaldomainxx with LMTP id eDtCGcZ5IVqoYQAAgSsXIg
       for <info2@--domain.com-->; Fri, 01 Dec 2017 17:48:22 +0200
    Return-path: <saweb@venus.xxlocaldomainxx>
    Envelope-to: info2@--domain.com--
    Delivery-date: Fri, 01 Dec 2017 17:48:22 +0200
    Received: from saweb by venus.xxlocaldomainxx with local (Exim 4.89)
       (envelope-from <saweb@venus.xxlocaldomainxx>)
       id 1eKnY6-0006VS-AY
       for info2@--domain.com--; Fri, 01 Dec 2017 17:48:22 +0200
    To: info2@--domain-com--
    Subject: Subscribe
    From: 5a2179c72886e 5a2179c7288b5 < xxxxxxxx@yahoo.com>
    Content-Type: text/plain; charset=windows-1252
    Message-Id: <E1eKnY6-0006VS-AY@venus.xxlocaldomainxx>
    Date: Fri, 01 Dec 2017 17:48:22 +0200
    
    Please subscribe me
    
    5217c72886e 5a2179c7b5
    
    
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #1 Frankc, Dec 1, 2017
    Last edited by a moderator: Dec 1, 2017
  2. cPanelMichael

    cPanelMichael Technical Support Community Manager
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,827
    Likes Received:
    1,898
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    This line shows the message comes from a script in the referenced directory. Could you elaborate a little more on your question? Are you asking how to customize the script so it provides more information in the email header?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Frankc

    Frankc Well-Known Member

    Joined:
    Jun 18, 2005
    Messages:
    103
    Likes Received:
    1
    Trophy Points:
    168
    Thank you and I tracked the problem.

    I forgot that one online form subscribe email address in background by sending an email from client to subscribe email but have to remove or change the method because either people from all over the world enter their email address or it's bots. (The specific LAYOUT is for email address only so no room for validation....)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    cPanelMichael likes this.
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice