Results 1 to 7 of 7

Thread: User Receiving Lots of 554 Emails

  1. #1
    dank is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    23
    Rep Power
    5

    Default User Receiving Lots of 554 Emails

    Hey Guys,
    I need some help getting a mail issue figured out. I have a user that receives a lot of bounced emails throughout the day. From what I can tell, this is a virus either on their network or out in the world somewhere sending spoof emails. How can I tell where this is coming from and/or how do I block it?

    Code:
    Nov 11 03:13:32 mail2 amavis[14434]: (14434-05) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20111111T030702-14434: <rd@-removed-.com> -> <george7802@yahoo.com> SIZE=970 BODY=8BITMIME Received: from mail2.-removed-.com ([127.0.0.1]) by localhost (mail2.-removed-.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP for <george7802@yahoo.com>; Fri, 11 Nov 2011 03:13:32 -0500 (EST)
    Nov 11 03:13:32 mail2 amavis[14434]: (14434-05) Checking: Q-cz+4CdAqHe [88.134.115.181] <rd@-removed-.com> -> <george7802@yahoo.com>
    Nov 11 03:13:32 mail2 amavis[14434]: (14434-05) Open relay? Nonlocal recips but not originating: george7802@yahoo.com
    Nov 11 03:13:33 mail2 amavis[14434]: (14434-05) FWD via SMTP: <rd@-removed-.com> -> <george7802@yahoo.com>,BODY=8BITMIME 250 2.0.0 Ok, id=14434-05, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 7561B264CD7D
    Nov 11 03:13:33 mail2 amavis[14434]: (14434-05) Passed CLEAN, [88.134.115.181] [88.134.115.181] <rd@-removed-.com> -> <george7802@yahoo.com>, Message-ID: <20111111081331.E6E01264CD74@mail2.-removed-.com>, mail_id: Q-cz+4CdAqHe, Hits: -2.9, size: 970, queued_as: 7561B264CD7D, 1046 ms
    Nov 11 03:13:33 mail2 postfix/smtp[16996]: E6E01264CD74: to=<george7802@yahoo.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.8, delays=0.75/0/0/1, dsn=2.0.0, status=sent (250 2.0.0 Ok, id=14434-05, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as 7561B264CD7D)
    Nov 11 03:13:35 mail2 postfix/smtp[18866]: 7561B264CD7D: to=<george7802@yahoo.com>, relay=mta7.am0.yahoodns.net[67.195.103.232]:25, delay=1.6, delays=0.01/0/0.55/1, dsn=5.0.0, status=bounced (host mta7.am0.yahoodns.net[67.195.103.232] said: 554 delivery error: dd This user doesn't have a yahoo.com account (george7802@yahoo.com) [-5] - mta1094.mail.gq1.yahoo.com (in reply to end of DATA command))

  2. #2
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,470
    Rep Power
    56

    Default

    Quote Originally Posted by dank View Post
    How can I tell where this is coming from and/or how do I block it?
    Have a look at the headers - right-click 'Show Original' or get the user to mark itr as Spam.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  3. #3
    dank is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    23
    Rep Power
    5

    Default

    Is there a way I can tell in the logs? This user does not use the web interface and almost exclusively uses their iPhone for email.

  4. #4
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,470
    Rep Power
    56

    Default

    Please update your forum profile with the output of the following command (do not post the output in this thread):

    Code:
    zmcontrol -v
    Quote Originally Posted by dank View Post
    Is there a way I can tell in the logs? This user does not use the web interface and almost exclusively uses their iPhone for email.
    If you are the Administrator of this server then you can only trace the message once it's received at your server (and the server that sent it to you), you can use 'zmmsgtrace' (if it's in your version of ZCS) for that, as the Admin you can also view the mailbox of any user by opening that mailbox via the Admin UI.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  5. #5
    dank is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    23
    Rep Power
    5

    Default

    I updated my profile, I am not familiar with zmmsgtrace. I tried to jump into his inbox, but all of his messages are deleted upon download, so it was empty.

    Release 6.0.14_GA_2928.MACOSXx86, Zimbra, Inc. MACOSXx86 FOSS edition.
    Last edited by dank; 11-14-2011 at 09:07 AM. Reason: I'm stupid and can't spell

  6. #6
    phoenix is offline Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,470
    Rep Power
    56

    Default

    Quote Originally Posted by dank View Post
    I updated my profile, I am not familiar with zmmsgtrace.
    Go to the wiki (link at the top of this page) and search for the word 'zmmsgtrace'.

    Quote Originally Posted by dank View Post
    I tried to jump into his inbox, but all of his messages are deleted upon download, so it was empty.
    That's rather a strange thing to do with an Inbox, what happens if he ever needs a copy of that email? In any case, next time he gets one of these email you should ask him to forward a copy to you - you can then view the headers.

    Your ZCS version needs to go in your forum profile as I asked earlier and not in this thread otherwise we have to keep asking '....which version of ZCS.....'.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  7. #7
    dank is offline Intermediate Member
    Join Date
    Aug 2009
    Posts
    23
    Rep Power
    5

    Default

    phoenix, thanks for your help. I was able to locate the offending account and shut down the problem.
    6.0.14_GA_2928.MACOSXx86, Zimbra, Inc. MACOSXx86 FOSS edition.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Replies: 21
    Last Post: 02-04-2010, 10:06 AM
  2. Post instsallation problems
    By Assaf in forum Installation
    Replies: 14
    Last Post: 01-29-2007, 11:38 AM
  3. Getting problems in FC4 while instalation
    By kitty_bhoo in forum Installation
    Replies: 13
    Last Post: 09-12-2006, 10:34 PM
  4. Services stopped working
    By lilwong in forum Administrators
    Replies: 4
    Last Post: 08-15-2006, 09:19 AM
  5. Fedora Core 3, Clean Install - Not working!
    By pcjackson in forum Installation
    Replies: 17
    Last Post: 03-05-2006, 07:38 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •