r0nmlt

Thanks

This had been resolved yesterday with /var down to 95%. Today its back up to 100%!!!

Resolved

As per topic can administrators please check.

This already happened on the 13/08/2014 and jje gave a little bit of a clean-up to /var and all returned normal, but now /var is full again resulting in mail failure again.

actually the fact that /var is full is most probably the cause that mail seems to be not working lately!!!

When trying to send a text only email from webmail I am getting: Message not sent. Server replied: Connection refused 111 Can't open SMTP stream If I try to send an email with attatchment through webmail I get: 451 Error While Writing Spool File

Same here. I use my hosting account to forward email to my ISP, but that ain't working today.

Now it is working flawlessly as usual. It was only this time that it happened. I don't think we can replicate the behavior and therefore I dont think tracing what happened is possible.

No I never got them. They all came through now. This inflow now stopped but it kept on going for about 3-4 days. Say from the 14/05 - 17/05.

It started off yesterday (probably whilst the updates were being done). I am getting really old mail delivered to my mailbox! This is the header of one such email: Return-Path: <****@macm.org.mt> Delivered-To: ****@internet.vodafone.com.mt Received: from stevie.heliohost.org (stevie.heliohost.org [65.19.143.2]) by mail.internet.vodafone.com.mt (Postfix) with ESMTP id 1F9B83F7418 for <****@internet.vodafone.com.mt>; Thu, 15 May 2014 02:10:28 +0200 (CEST) Received: from outmail48.go.net.mt ([80.93.157.48] helo=outmail29.go.net.mt) by stevie.heliohost.org with esmtp (Exim 4.69) (envelope-from <info@macm.org.mt>) id 1WTZCy-0007r1-5A for ****@fcs.com.mt; Fri, 28 Mar 2014 09:00:19 -0700 Received: from [172.20.1.72] (helo=fender72.go.net.mt) by outmail29.go.net.mt with esmtp (Exim 4.72) (envelope-from <****@macm.org.mt>) id 1WTYXp-0001z9-Pp for ****@fcs.com.mt; Fri, 28 Mar 2014 16:18:09 +0100 Received: from [78.133.92.74] (helo=server) by fender72.go.net.mt with esmtp (Exim 4.72) (envelope-from <info@macm.org.mt>) id 1WTYYl-0004T7-Ts for ****@fcs.com.mt; Fri, 28 Mar 2014 16:19:19 +0100 Message-ID: <20140328.HHZOBWEQMMBEWARD@macm.org.mt> From: "Malta Association of Credit Management" <****@macm.org.mt> To: "Ronald Cordina" <****@fcs.com.mt> Reply-To: "MACM" <****@macm.org.mt> Subject: ******************************************** Date: Fri, 28 Mar 2014 16:18:01 +0100 Importance: Normal List-Unsubscribe: <mailto:****@macm.org.mt?subject=unsubscribe> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_643_1245_93883802.12639804" EM-Campaign: {FF393377-E404-44FE-BB82-0A67BF6F7525} EM-Task: 695 X-Spam-Status: No, score=1.1 X-Spam-Score: 11 X-Spam-Bar: + X-Ham-Report: Spam detection software, running on the system "stevie.heliohost.org", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Subject: MACM Dishonoured Cheques Report Dear Ronald Cordina Kindly find attached an Excel Worksheet, containing the list of all the Dishonoured Cheques reported today. Copies of these cheques have been received by the MACM Secretariat. For the benefit of the members reporting Dishonoured Cheques, the Secretariat is issuing the Dishonoured Cheques Report in this format. However, full details can be found from the Members Area on the MACM Website. [...] Content analysis details: (1.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.5 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS records 0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 HTML_FONT_SIZE_LARGE BODY: HTML font size is large -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1% [score: 0.0000] 1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars 0.3 AWL AWL: From: address is in the auto white-list X-Spam-Flag: NO X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - stevie.heliohost.org X-AntiAbuse: Original Domain - fcs.com.mt X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - macm.org.mt X-Get-Message-Sender-Via: stevie.heliohost.org: mailgid no entry from get_relayhosts_entry X-Source: X-Source-Args: X-Source-Dir: ---------------------------------- What do you think is going on??? Is there a way to ping the queues in future so emails don't get stuck like this? Ron.

Thanks a lor and sorry for the hassle i caused.

Did you get my email krydos?

Ok will do. The reports only came from one email: [censored] which I will be sending you confirmation of ownership soon. Would it be possible to redact all email addresses mentioned in this thread after the thread is closed? Thanks for your patience and excuse me for putting you through all this.

When I saw your post I was taken aback and shocked cause the only explanation coming to mind, knowing that I am not behind the spam, was that my account was hijacked. Believe me if you want, but I am not a spammer and I will try and show you this, through the emails if you grant some time. If you had a good look at the emails you would have realised that the spam is not originating from my account but merely forwarded. Call me naive yes, cause I reported these spam emails myself as being spam, but I never would have thought that he.net would have blamed my domain and heliohost, and thereby punishing ME, YOU and the other users without looking at the emails in detail. So let me explain: The service I was getting from your servers was to have a catchall account on my domain (fcs.com.mt) and all emails would then be directed to this 2 accounts, namely: [censored] & [censored] Lately I had been receiving loads of SPAM mail (expcially from some OZ dieting) so I decided to report this guy to hotmail! If you take a look at the emails they all follow the same trends: All emails were reported by: "X-HmXmrOriginalRecipient: [censored]" That is still ME. I was reporting the SPAM mail but not heliohost!!! Whoever is in charge of these systems at he.net should look more carefully. You too jumped to the conclusion that I am spamming but please look at the emails in detail and you realise that those emails are originating elsewhere, addressed to my domain and forwarded to my hotmail account and my vodafone account as per my setup forwards. Email (1): "To: [censored]" Email (2): "To: [censored]" Email (3): "To: [censored]" Email (4): "To: [censored]" Email (5): "To: [censored]" Email (6): "To: [censored]" Email (7): "To: [censored]" Email (8): "To: [censored]" Email (9): "To: [censored]" Email (10): "To: [censored]" The routing taking place showing that heliohost.org is NOT the originator but a forwarder to HOTMAIL.. TO MY HOTMAIL ACCOUNT that I set up in the FORWARDS!! Email (1)(2)(3) "Received: from nobody by server.definedhosting.com " "Received: from server.definedhosting.com by stevie.heliohost.org " "Received: from stevie.heliohost.org by BAY0-MC3-F9.Bay0.hotmail.com " Email (4) "Received: from [89.123.48.132] by stevie.heliohost.org with esmtp (Exim 4.69)" "Received: from stevie.heliohost.org ([65.19.143.2]) by BAY0-MC2-F28.Bay0.hotmail.com" Email (5) "Received: from [83.240.254.169] by stevie.heliohost.org with esmtp (Exim 4.69)" "Received: from stevie.heliohost.org ([65.19.143.2]) by SNT0-MC4-F36.Snt0.hotmail.com" Email (6) "Received: from 89-97-122-127.ip17.fastwebnet.it ([89.97.122.127]) by stevie.heliohost.org with esmtp (Exim 4.69)" "Received: from stevie.heliohost.org ([65.19.143.2]) by BAY0-MC1-F24.Bay0.hotmail.com" Email (7) "Received: from [86.35.150.126] by stevie.heliohost.org with esmtp (Exim 4.69)" "Received: from stevie.heliohost.org ([65.19.143.2]) by SNT0-MC4-F27.Snt0.hotmail.com" Email (8) "Received: from [2.179.209.70] by stevie.heliohost.org with esmtp (Exim 4.69)" "Received: from stevie.heliohost.org ([65.19.143.2]) by SNT0-MC4-F37.Snt0.hotmail.com" Email (9) "Received: from 213.37.216.63.dyn.user.ono.com ([213.37.216.63]) by stevie.heliohost.org with esmtp (Exim 4.69)" "Received: from stevie.heliohost.org ([65.19.143.2]) by BAY0-MC1-F19.Bay0.hotmail.com" Email (10) "Received: from stevie.heliohost.org ([65.19.143.2]) by BAY0-MC2-F15.Bay0.hotmail.com" "Received: from 70.15.86.39.res-cmts.sewb.ptd.net ([70.15.86.39]) by stevie.heliohost.org with esmtp (Exim 4.69)" Even the X-antiabuse says it: Email (1) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server.definedhosting.com X-AntiAbuse: Original Domain - fcs.com.mt X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] X-AntiAbuse: Sender Address Domain - server.definedhosting.com X-Get-Message-Sender-Via: server.definedhosting.com: uid via acl_c_vhost_owner from authenticated_id: nobody from /only user confirmed/virtual account not confirmed X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - stevie.heliohost.org X-AntiAbuse: Original Domain - fcs.com.mt X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - server.definedhosting.com I'm not going to paste all 10 x-antiabuse as I think I made my point. Again I must stress I am not the spammer though I must admit I am the one who effectively black listed heliohost as I reported emails being forwarded by my account as spam BUT, and this is the pivotal point, I did not expect he.net to blame heliohost but the ORIGINATING host. Now kindly share your final views with me. I will accept any decisions you may take but I need to know where I stand as I cannot drag this any longer. Sincerely.

Thanks much appreciated. Awaiting posts from admins then.

I cannot understand this. I use this account just to forward all emails to my domain to hotmail and my ISP. Can you please tell me how the mail was sent? I barely ever use heliohost SMTP and heliohost originating emails would have an X-abuse header. Would it be possible to get hold of one of these emails? My site is a simple html with a picture and no scripts so i dont think thats how the emails were sent and my password is not easy so honestly i cannot see how spam is originating from my account. i am trying to get to the bottom of this for.my own good and the admins. Thanks in advance.

Login: fcsltd Server: stevie Domain: fcs.com.mt

Bump

Can I know what is causing this as I only use the A/C to forward mail and the home page is plain HTML with no links.

a. fcsltd b. stevie c. fcs.com.mt

What's up with sending emails on stevie? Tried everything; even telnetting to stevie.heliohost.org port 25 but I keep getting:  421 Unexpected failure, please try later Obviously incoming mail is not being delivered as stevie will be refuse connection.

Hotmail has blacklisted Stevie during this last week. I have also seen an abandoned post about yahoo doing the same thing. Emails being sent out of stevie.heliohost.org (65.19.143.2), are being refused by hotmail servers, irrelevant of the content of the emails. Return mail headers are: Return-path: <> Envelope-to: ***@fcs.com.mt Delivery-date: Sat, 02 Feb 2013 01:03:38 -0800 Received: from mailnull by stevie.heliohost.org with local (Exim 4.69) id 1U1Z10-0002pb-V2 for ***@fcs.com.mt; Sat, 02 Feb 2013 01:03:38 -0800 X-Failed-Recipients: ***@hotmail.com Auto-Submitted: auto-replied From: Mail Delivery System <Mailer-Daemon@stevie.heliohost.org> To: ***@fcs.com.mt Subject: Mail delivery failed: returning message to sender Message-Id: <E1U1Z10-0002pb-V2@stevie.heliohost.org> Date: Sat, 02 Feb 2013 01:03:37 -0800 Returned mail content: This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address(es) failed: ***@hotmail.com SMTP error from remote mail server after MAIL FROM:<***@fcs.com.mt> SIZE=1837: host mx2.hotmail.com [65.55.92.184]: 550 SC-001 (SNT0-MC4-F9) Unfortunately, messages from 65.19.143.2 weren't sent. Please contact your Internet service provider since part of their network is on our block list. You can also refer your provider to http://mail.live.com/mail/troubleshooting.aspx#errors. Original message content: Return-path: <***@fcs.com.mt> Received: from [***] (helo=***) by stevie.heliohost.org with esmtpa (Exim 4.69) (envelope-from <***@fcs.com.mt>) id 1U1Z0z-0002o2-NF for ***@hotmail.com; Sat, 02 Feb 2013 01:03:37 -0800 From: "***" <***@fcs.com.mt> To: <***@hotmail.com> Subject: *** Date: Sat, 2 Feb 2013 10:03:30 +0100 Message-ID: <!&!AAAAAAAAAAAYAAAAAAAAAGlGG9itEwdAnk8tyq41bGbihQAAEAAAAFUVZ5RrjAtPsiz+MFBHyngBAAAAAA==@fcs.com.mt> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: Ac4BJCugoA+/KYsRTba6t67sbSS0Eg== Content-Language: en-gb Disposition-Notification-To: "***" ***@fcs.com.mt

any news regarding stevie?

I will refrain from doing that in the future, but somebody else did now! Most probably other users of heliohost are experiencing the same problems and they followed the link in the bounced email and clicked unlist. Now for the domains sending out the spam part. I have checked the email message header of stevie and this should have: X-AntiAbuse: Original Domain - fcs.com.mt (or something similar). I presume that this trojan cannot alter/fake/omit this right? If this is correct I will ask them to provide the domain names and if they do consent I will post them here.