Question Strange Mail-Spam issue

[cs50935]

Server operating system version

ubuntu 24.04

Plesk version and microupdate number

Plesk Obsidian 18.0.68 Update 2 Web Pro Edition

Hi,
when i looked up the Mail-Statistics which showed in the email Security extension, i realised, that most of the spam comes from strange mailadresses which don't really exist.

<SRS0=0+PX=WS=grenomdes.store=null@domain.de>

for example.
How can i find out from where this mail comes and better: stop these mails?

 

[hschramm]

Hi, this is a SRS rewritten Mailadress. Did you set null@domain.de here for data protection? or is the domain really null@domain.de?

 

[cs50935]

It‘s null@ an existing domain.

When i take a look at the statistics page there are several entrys like the one above. All with the srs0- beginning, a non existing mailaccount at an existing domain name.
Every entry shows exactly 3 sent spam mails.

 

[hschramm]

analyse the mail.log / mail.info file and search for the smtp clients who send these mails. it may be spam with the idea that the forged from address, covered in an srs0 cover may slip through the spamfilters. so i would check the smtp clients sending you that mails and investigate if they are spammer. is the content spam or valid email?