Is the server sending spam. Try this.
\nhttp:\/\/kb.parallels.com\/766<\/p>\n
First, check that all domains have the option \u2018Mail to non-existing user\u2019 set to \u2018reject\u2019 but not to \u2018forward.\u2019 You can change this setting to all domains using \u201cGroup Operations\u201d in the \u201cDomains\u201d tab in Parallels Plesk Control Panel. The option \u201cReject mail to nonexistent user\u201d is available since Parallels Plesk Panel 7.5.3.
\nAlso check that all the IPs and networks in the white lists are reliable and familiar to you.<\/p>\n
Check how many messages are in the queue with Qmail:<\/p>\n
\n# \/var\/qmail\/bin\/qmail-qstat\n<\/pre>\nmessages in queue: 27645
\nmessages in queue but not yet preprocessed: 82<\/p>\nIf the queue has too many messages, try to discover the source of SPAM.<\/p>\n
If mail is being sent by an authorized user but not from the PHP script, you can run the command below to find the user that has sent the most messages (available since Plesk 8.x). Note that you must have the \u2018SMTP authorization\u2019 activated on the server to see these records:<\/p>\n
# cat \/usr\/local\/psa\/var\/log\/maillog |grep -I smtp_auth |grep -I user |awk '{print $11}' |sort |uniq -c |sort -n\n<\/pre>\nThe path to \u2018maillog\u2019 may differ depending on the OS you are using.<\/p>\n
The next step is to use \u201cqmail-qread,\u201d which can be used to read the message headers:<\/p>\n
# \/var\/qmail\/bin\/qmail-qread\n<\/pre>\n18 Jul 2005 15:03:07 GMT #2996948 9073 <user@domain.com> bouncing
\ndone remote user1@domain1.com
\ndone remote user2@domain2.com
\ndone remote user3@domain3.com
\n….<\/p>\nThis shows the senders and recipients of messages. If the message contains too many recipients, probably this is spam. Now try to find this message in the queue by its ID ( # 2996948 in our example):<\/p>\n
# find \/var\/qmail\/queue\/mess\/ -name 2996948\n<\/pre>\nExamine the message and find the line \u201cReceived\u201d to find out from where it was sent for the first time. For example, if you find:<\/p>\n
Received: (qmail 19514 invoked by uid 10003); 13 Sep 2005 17:48:22 +0700<\/p>\n
it means that this message was sent via a CGI by user with UID 10003. Using this UID, it is possible to find the domain:<\/p>\n
# grep 10003 \/etc\/passwd\n<\/pre>\nIf the \u2018Received\u2019 line contains a UID of a user \u2018apache\u2019 (for example invoked by uid 48), it means that spam was sent through a PHP script. In this case, you can try to find the spammer using information from spam email (address from\/to or any other information). It is usually very difficult to discover the source of spam. If you are absolutely sure that this time there is a script which sends spam (tail grows rapidly for no apparent reason), you can use the following script to determine what PHP scripts are running at this time:<\/p>\n
# lsof +r 1 -p `ps axww | grep httpd | grep -v grep | awk ' { if(!str) { str=$1 } else { str=str","$1}}END{print str}'` | grep vhosts | grep php\n<\/pre>\nYou can also apply the KB article which describes the procedure of discovering which domains are sending mail through PHP scripts.<\/p>\n
http:\/\/kb.sp.parallels.com\/en\/766<\/a><\/p>\n
Lines in Received section like<\/p>\n
Received: (qmail 19622 invoked from network); 13 Sep 2005 17:52:36 +0700
\nReceived: from external_domain.com (192.168.0.1)<\/p>\nmeans that the message has been accepted and delivered via SMTP, and that the sender is an authorized mail user.<\/p>\n
Check the emails going out and look for a sending user that is in plesk:<\/p>\n
cat \/usr\/local\/psa\/var\/log\/maillog | grep \u2018validuser@user@domain.com\u2019\n<\/pre>\nOutput:<\/p>\n
Nov 7 10:01:07 mail smtp_auth: SMTP user @user@domain.com : logged in from (null) [188.xx.xx.xx]<\/p>\n
The multiple IP logins show that the spam is from a valid user.<\/p>\n
Check email passwords:<\/p>\n
mysql -uadmin -p`cat \/etc\/psa\/.psa.shadow ` psa -e \u2018select m.mail_name,a.password,d.name from mail m,accounts a,domains d where m.account_id=a.id and m.dom_id=d.id;\u2019\n<\/pre>\nOr <\/p>\n
\n\n# \/usr\/local\/psa\/admin\/bin\/mail_auth_view\n\n<\/pre>\nDelete qmail email queue<\/p>\n
\n\n# \/usr\/local\/psa\/admin\/sbin\/mailqueuemng -D\n\n<\/pre>\n","protected":false},"excerpt":{"rendered":"Is the server sending spam. Try this. http:\/\/kb.parallels.com\/766 First, check that all domains have the option \u2018Mail to non-existing user\u2019 set to \u2018reject\u2019 but not to \u2018forward.\u2019 You can change this setting to all domains using \u201cGroup Operations\u201d in the \u201cDomains\u201d tab in Parallels Plesk Control Panel. The option \u201cReject mail to nonexistent user\u201d is … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[92],"tags":[],"class_list":["post-52","post","type-post","status-publish","format-standard","hentry","category-qmail"],"_links":{"self":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":0,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.qbytes.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}