The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Emails received from no sender <>

Discussion in 'E-mail Discussions' started by samjsharples, Apr 10, 2015.

  1. samjsharples

    samjsharples Registered

    Joined:
    Apr 10, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    UK
    cPanel Access Level:
    Root Administrator
    Hi all

    On one of my accounts I am receiveing a large number of spam emails and the sender shows up as:
    <>

    Screen Shot 2015-04-10 at 17.29.58.png
    s.jpg

    Could somebody please explain whats going on and how I can prevent this?

    Many thanks
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    Could you search for that message ID in /var/log/exim_mainlog to see if you can find more information? EX:

    Code:
    exigrep MSGID /var/log/exim_mainlog
    Thank you.
     
  3. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I have also been getting a few of these, and would be interested to learn what's going on.

    Code:
    15:30:37 SMTP connection from [209.85.192.103]:34610 (TCP/IP connection count = 2)
    
    15:30:38 H=mail-qg0-f103.google.com [209.85.192.103]:34610 Warning: Sender rate 1.0 / 1h
    
    15:30:39 1Yi1rL-0002P6-4T H=mail-qg0-f103.google.com [209.85.192.103]:34610 Warning: Message has been scanned: no virus or other harmful content was found
    
    15:30:43 1Yi1rL-0002P6-4T H=mail-qg0-f103.google.com [209.85.192.103]:34610 Warning: "SpamAssassin as xxx detected message as NOT spam (-0.7)"
    
    15:30:43 1Yi1rL-0002P6-4T <= <> H=mail-qg0-f103.google.com [209.85.192.103]:34610 P=esmtps X=TLSv1.2:AES128-GCM-SHA256:128 S=13696 id=[EMAIL]63a8ec45-4c69-40b6-91bb-ead948336ab3@usmef-ja.org[/EMAIL] T="Undeliverable: hi" for [EMAIL]adamsdvg@user.co.uk[/EMAIL]
    
    15:30:43 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Yi1rL-0002P6-4T
    
    15:30:43 1Yi1rL-0002P6-4T => :blackhole: <[EMAIL]adamsdvg@user.co.uk[/EMAIL]> R=virtual_aliases
    2015-04-14 15:30:43 1Yi1rL-0002P6-4T Completed
    
    15:30:43 SMTP connection from mail-qg0-f103.google.com [209.85.192.103]:34610 closed by QUIT 
     
    #3 keat63, Apr 15, 2015
    Last edited by a moderator: Apr 15, 2015
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    The following line indicates the source of the message:

    It's either SPAM, or a bounced message from "adamsdvg@user.co.uk". You may want to investigate that account to verify no SPAM messages are sent.

    Thank you.
     
  5. keat63

    keat63 Well-Known Member

    Joined:
    Nov 20, 2014
    Messages:
    765
    Likes Received:
    20
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,854
    Likes Received:
    676
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    Right, the message was sent to a blackhole since you have configured that for messages sent to email addresses that do not exist. The logs you provided show the message comes from "63a8ec45-4c69-40b6-91bb-ead948336ab3@$domain", but it's simply not included in the user interface from field due to the nature of the email address.

    Thank you.
     
Loading...

Share This Page