IP blocked by provider for mail spam

ash-development

hello! my ip was blocked by my vps provider for mail spam - i’m not exactly sure how this is happening and i was looking for advice on how to monitor where this spam is coming from and how to fix it? i’m the only one using my mail server so it’s either someone spoofing my domain or a hacked mailbox - im just not sure how to go about solving this

esackbauer

Check the logs… Start with postfix…

ash-development

it seems that one of my mailboxes have been breached? my admin account is secured with a passkey so i don’t believe its api/account creation abuse. it starts as soon as i start up my mailcow instance

postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/qmgr[385]: 9F0587FD5F3: from=<mqjqwkfor@ashie.lol>, size=2066, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/qmgr[385]: 997F67FD8AD: from=<vrtyutcxui@ashie.lol>, size=1276, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/cleanup[484]: 664727FBE8C: message-id=<20250207165903.664727FBE8C@mail.ashie.lol>
postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/bounce[513]: CB4FC7FC779: sender non-delivery notification: 664727FBE8C
postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/qmgr[385]: 9DFC77FD8AC: from=<xislr@ashie.lol>, size=1538, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/qmgr[385]: 9E0127FDAA0: from=<whzdxtwofaw@ashie.lol>, size=1347, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/qmgr[385]: 9E9D87FD7A2: from=<cohlr@ashie.lol>, size=1113, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb  7 11:59:03 3896729c3ba3 postfix/qmgr[385]: 9980F7FD32C: from=<uylkigymuc@ashie.lol>, size=1352, nrcpt=5 (queue active)

im just unsure as how to diagnose the issue without having the instance open for too long since it starts as soon as i start it up. getting my ip blocked again would just make the issue even worse lol

esackbauer

You should look for connection details.
from which IP does the connection come? is it using port 25 you have an open relay due to misconfiguration (allowed the wrong networks)
If its port 465 or 587 then one of your users got hacked, look for the auth auth details in postfix log.

ash-development

esackbauer I don’t see either of the sort. Could you provide an example?
Once my server starts up it just starts spamming the logs with the like

rspamd-mailcow-1     | 2025-02-16 00:15:33 #46(hs_helper) rspamd_hs_helper_cleanup_dir: successfully removed outdated hyperscan file: /var/lib/rspamd//f397fa1c5d008b9821a0b7ad4d4a9c2c42f113e6bd20e8a232a38e80248d333e.hs; reason for expiration: unknown hyperscan file
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 2ED60802B76: from=<rxgar@ashie.lol>, size=2047, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 986817FDEFA: from=<dyuqhgvldol@ashie.lol>, size=1027, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 9ABE67FDD68: from=<bxausfaf@ashie.lol>, size=1538, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 9AF057FD67A: from=<rowxi@ashie.lol>, size=1833, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 97E367FD966: from=<ioaegilorv@ashie.lol>, size=1556, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 9C1067FD4AA: from=<gajqwnvsc@ashie.lol>, size=1844, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 5D56E8077D0: from=<lhicalnlqp@ashie.lol>, size=1267, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 91F4A7FD260: from=<uterrreqci@ashie.lol>, size=2054, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: CBF777FC5BC: from=<usbpaayiev@ashie.lol>, size=1052, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 94CA67FD326: from=<wlgtrz@ashie.lol>, size=2047, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: EBDAF7FBED6: from=<>, size=4707, nrcpt=1 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: D7419803CF3: from=<kgcgx@ashie.lol>, size=1041, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 6E9B0800172: from=<sctzqxw@ashie.lol>, size=1800, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: E59807FF0A5: from=<rczgxevh@ashie.lol>, size=1837, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: 91C3B7FDE12: from=<zdpfkjj@ashie.lol>, size=2045, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/qmgr[387]: C3E587FD03E: from=<qccgbgllv@ashie.lol>, size=1792, nrcpt=5 (queue active)
postfix-mailcow-1    | Feb 16 00:15:33 a80c16c00b15 postfix/smtp[414]: CDE097FC086: to=<info@k-wrap.com>, relay=mx004.netsol.xion.oxcs.net[51.81.206.109]:25, delay=1136201, delays=1136199/0.7/1.2/0.43, dsn=2.6.0, status=sent (250 2.6.0 Message accepted with ID f61359eb-182498691b241cf1)

I just logged into my instance (after restoring it from a backup) and there appears to be no domains or mailboxes … so I’m even more confused

esackbauer

ash-development Could you provide an example?

THis is what a connection initiation in postfix looks like:
CONNECT from [10.0.0.11]:60736 to [172.22.1.253]:25

In this case the connection was initiated from an internal server on my LAN.
The logs you showing are from the queue manager (qmgr), which is when postfix already received the complete mail to send. There must be before that the connection initiation and the handover of the actual mail to postfix.

Cisco30

Your backup may be faulty, at this stage configure your domain and your mailboxes, change the password of your mailboxes and monitor the logs