Question Spoofed E-Mail Attack On Server

[NaeemA]

Hello.

I am posting this question. Someone else might have experienced this before. I am having Linux Dedicated Server with Plesk 12.5.30 Web Host Edition. Since yesterday i have noticed that someone is trying to send virus infected e-mails / scripts to my hosted mailbox user but all those have been identified and quarantined by Dr-Web Antivirus which is running on my Server.

But the issue is this that the sender e-mail address seems like a spoof as the address is not existed on my Server for the domain name it is trying to send e-mails. I am pasting one header below for your review as i might get a solution on how to trace and identify the culprit script or compromised account hosted on my Server.

=================================================================
Received-SPF: neutral (xxxxxx.xxxxxxxxxxxxxxx.com: 106.215.190.134 is neither permitted nor denied by domain of xxxxxxxxx.biz) client-ip=106.215.190.134; envelope-from=jamar.ashley@xxxxxxxxxx.biz; helo=[106.215.130.217];
Content-Type: multipart/mixed; boundary=Apple-Mail-A2D26C79-C439-689E-D8EA-4480477881E1
Content-Transfer-Encoding: 7bit
From: jamar ashley <jamar.ashley@xxxxxxxxxx.biz>
Mime-Version: 1.0 (1.0)
Date: Wed, 23 Nov 2016 17:36:02 +0530
Subject: Bill-0217
Message-Id: <70DF0B9D-FCD9-2B69-B902-A63C979A1764@xxxxxxxxxx.biz>
To: info@xxxxxxxxxx.biz
X-Mailer: iPhone Mail (13C75)
X-Identified-User: {0000:xxxxxxxxxx.biz:local:local} {sentbyelivered locally}
================================================================

Please do note that jamar.ashley@xxxxxxxxxx.biz is not a valid e-mail address as this is a spoofed e-mail address. I have also configured SPF record for this domain name correctly as written below.

v=spf1 +a +mx ip4:158.xxx.xxx.xxx include:spf.xxxxxxxxxx.biz -all

Awaiting for help on this particular matter.

Regards,

Naeem

 

[UFHH01]

Hi NaeemA,

you should consider to add depending log - files - entries and pls. consider to name your used mail - software and add it's configuration files. It is as well a good idea to provide informations about your used operating system, so that suggestions can be done according to it.

Plesk for Linux services logs and configuration files ( KB - article: 111 283 )​

 

[Linulex]

Received-SPF: neutral (xxxxxx.xxxxxxxxxxxxxxx.com: 106.215.190.134 is neither permitted nor denied by domain of xxxxxxxxx.biz)

The spf record in the dns is only half of the spf protection.
The other half is to actually test the spf record and act on it.

Seems like your spf is set to neutral under

Tools & Settings -> Server-Wide Mail Settings -> Switch on SPF spam protection

regards
Jan