starred/anonaddy

Fork 0

mirror of https://github.com/anonaddy/anonaddy.git synced 2026-04-25 14:15:53 +03:00

[GH-ISSUE #577] Relay used as spam #978

New issue

Closed

opened 2026-03-14 11:21:02 +03:00 by kerem · 3 comments

kerem commented

2026-03-14 11:21:02 +03:00

Owner

Originally created by @GitTworn on GitHub (Jan 3, 2024).
Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/577

Hi all,
My hosting server does not allow the use of port 25 so I setup AnonAddy to with the use of the POSTFIX_RELAYHOST variables and use another server to send the email.

My setup works perfectly but once in the 2 months I get the below message.

I use AA only for myself so a max of 50 emails per month with 1 user.

Can anyone tell me how can I debug this?

The *USER_ACCOUNT* account has just finished sending 1000 emails.
There could be a spammer, the account could be compromised, or just sending more emails than usual.

After some processing of the /etc/virtual/usage/USER_ACCOUNT.bytes file, it was found that the highest sender was double-bounce@mail.anonaddy-domain.com, at 757 emails.

The top authenticated user was USER_ACCOUNT, at 1276 emails.
This accounts for 127% of the emails.  The higher the value, the more likely this is the source of the emails.
An authenticated username is the user and password value used at smtp time to authenticate with exim for delivery.

The top sending host was *IP*, at 1276 emails (127%).

This warning was generated because the 1000 email threshold was hit.

================================
Automated Message Generated by DirectAdmin

Originally created by @GitTworn on GitHub (Jan 3, 2024). Original GitHub issue: https://github.com/anonaddy/anonaddy/issues/577 Hi all, My hosting server does not allow the use of port 25 so I setup AnonAddy to with the use of the POSTFIX_RELAYHOST variables and use another server to send the email. My setup works perfectly but once in the 2 months I get the below message. I use AA only for myself so a max of 50 emails per month with 1 user. Can anyone tell me how can I debug this? ``` The *USER_ACCOUNT* account has just finished sending 1000 emails. There could be a spammer, the account could be compromised, or just sending more emails than usual. After some processing of the /etc/virtual/usage/USER_ACCOUNT.bytes file, it was found that the highest sender was double-bounce@mail.anonaddy-domain.com, at 757 emails. The top authenticated user was USER_ACCOUNT, at 1276 emails. This accounts for 127% of the emails. The higher the value, the more likely this is the source of the emails. An authenticated username is the user and password value used at smtp time to authenticate with exim for delivery. The top sending host was *IP*, at 1276 emails (127%). This warning was generated because the 1000 email threshold was hit. ================================ Automated Message Generated by DirectAdmin ```

kerem closed this issue

2026-03-14 11:21:08 +03:00

kerem commented

2026-03-14 11:21:13 +03:00

Author

Owner

@willbrowningme commented on GitHub (Jan 24, 2024):

I'm sorry but I don't think I can help in this situation. I would recommend checking the mail logs on your other mail server on the dates when you get that message.

@willbrowningme commented on GitHub (Jan 24, 2024): I'm sorry but I don't think I can help in this situation. I would recommend checking the mail logs on your other mail server on the dates when you get that message.

kerem commented

2026-03-14 11:21:18 +03:00

Author

Owner

@Bart1909 commented on GitHub (Jun 29, 2024):

Did you find a solution for this @GitTworn? I'm facing the same issue.

@Bart1909 commented on GitHub (Jun 29, 2024): Did you find a solution for this @GitTworn? I'm facing the same issue.

kerem commented

2026-03-14 11:21:24 +03:00

Author

Owner

@GitTworn commented on GitHub (Aug 31, 2024):

Unfortunately not. I still have the issue. It is a very annoying one.

Now and then this still occurs. The spam messages are not actually delivered to other people. The system still blocks the spam messages, but the spammer does try to send them and then my server maxes out the amount of allowed emails sent which is 1000 in my case.

@GitTworn commented on GitHub (Aug 31, 2024): Unfortunately not. I still have the issue. It is a very annoying one. Now and then this still occurs. The spam messages are not actually delivered to other people. The system still blocks the spam messages, but the spammer does try to send them and then my server maxes out the amount of allowed emails sent which is 1000 in my case.

No labels

bug

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/anonaddy#978

No description provided.

Rows
Columns