Strange things in WHM mail que

n1kko

I have some very strange mail in WHM mail que and the sender mail address is not on my server.

One sender is a yahoo email sending to multiple Recipients, could anyone advise? Thanks

wych

Open smtp server? No authentication?

n1kko

Would that be under tweak settings?

MisterHost_NET

Is there a link in the email body?

n1kko

This is the body

This is a multi-part message in MIME format.

------=_NextPart_000_5826_2BE8077B.0D750BD5
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

http://okcularyapi.com/zg/mswhphkuiixceicxuvxbnuqmwleolv.mtsuvcnitafpwylefzxgt=
ykxrvkgg 


 [email protected] 

 
------=_NextPart_000_5826_2BE8077B.0D750BD5
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

=EF=BB=BFhttp://okcularyapi.com/zg/mswhphkuiixceicxuvxbnuqmwleolv.mtsuvcn=
itafpwylefzxgtykxrvkgg=
 














=
 [email protected] 

 

------=_NextPart_000_5826_2BE8077B.0D750BD5--

n1kko

This was Off in Tweak settings

Mail authentication via domain owner password

Guess needs to be on?

n1kko

I seem to be getting random names sending email from clients domains

wych

@n1kko have a read of https://documentation.cpanel.net/display/CKB/How+to+Prevent+Email+Abuse

n1kko

Thanks @wych been through that the only thing I didn't have on was The Experimental: Rewrite From: header option which is now on

MisterHost_NET

Si the domain okcularyapi.com hosted with you?

n1kko

Not with me no

jar

Grab full headers. Feel free to message to me for an analysis. The idea is to find out where it is coming from. It's most likely from something compromised somewhere. Possible the from is spoofed and there's a X PHP Script header.

n1kko

Thanks could you help me out as need to find the problem