Getting Frequent Warning from Contabo.

aaP_rehanhasanofficial

We have noticed a significant increase of outgoing connections from your server with IP 38.XXX.XXX.XXX (vmi234XXXX). The level of SMTP traffic on port 25/tcp is unusually high and at this pace you will hit the limit soon and all connections on this port will be blocked until the next day.

We do this to protect the reputation of our network and to make sure that your Ip’s, and all our customers, will not be blacklisted.

The most common explanation of such a spike in outgoing connections is that your server was hacked. If this is the case, we recommend reinstalling your server from scratch.

If these connections are initiated by you on purpose, please reply to this email and let us know what the expected traffic volume is and we will adjust the limits accordingly.

Thank you for your cooperation and understanding.

Best,

Your Contabo support team

I have have every password, added cloudflare under attack mode, added ssl, scan website using wordfence, malcare, sucuri plugins. No virus or modifies file found.

So, Where and how hacker using my website? what is exact reason for this warning from contabo?

aaPanel_Kern

Hello, please check the Postfix outgoing queue: postqueue -p

aaP_rehanhasanofficial

in cron job found, [Do not delete] Cut_maillog.

Then search it at files and showing here: /www/server/panel/plugin/mail_sys/script/cut_maillog.py

This script sending mass mail from my server?
Can i delete it?

aaP_rehanhasanofficial

aaPanel_Kern
root@mail:~# postqueue -p
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
26B3A100857 2889 Mon Dec 16 01:55:15 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.example.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

2C30E10088B 2631 Mon Dec 16 14:42:11 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

25BF4100876 4117 Mon Dec 16 14:08:19 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

F258A10089E 2836 Tue Dec 17 02:09:42 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

F1A1110084D 2882 Mon Dec 16 01:19:51 MAILER-DAEMON
(connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
www@mail.mydomain.com

F247F100855 2927 Mon Dec 16 01:42:37 MAILER-DAEMON
(connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

DE7A710088E 3888 Mon Dec 16 14:42:30 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

D0DBF10086E 3595 Mon Dec 16 09:50:53 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
www@mail.mydomain.com

DDA28100807 691 Sat Dec 14 19:46:13 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

D6FC310084C 2991 Mon Dec 16 01:04:33 MAILER-DAEMON
(connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

D8E8910082F 4433 Sun Dec 15 13:58:18 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

D369F10082E 4424 Sun Dec 15 13:58:18 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

D2F2F100820 1247 Sun Dec 15 07:42:08 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
postmaster@mail.mydomain.com

DCFF910086C 2914 Mon Dec 16 07:51:15 MAILER-DAEMON
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

754EC10081A 4232 Sat Dec 14 22:15:07 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

76C7910081E 1249 Sun Dec 15 17:54:24 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

98E9C100892 3530 Mon Dec 16 15:16:41 MAILER-DAEMON
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

99D60100891 14998 Mon Dec 16 15:12:12 MAILER-DAEMON
(connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
www@mail.mydomain.com

97B47100887 780 Mon Dec 16 14:41:57 www@mail.mydomain.com
(host mx01.gmx.net[212.227.17.4] refused to talk to me: 554-gmx.net (mxgmx109) Nemesis ESMTP Service not available 554-No SMTP service 554-Bad DNS PTR resource record. 554 For explanation visit https://postmaster.gmx.net/en/case?c=r0601&i=ip&v=38.242.141.160&r=1MXVqB-1t5RcQ2fGB-00UWZH)
skg9@gmx.com

946801007FE 1247 Sun Dec 15 06:13:29 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
postmaster@mail.mydomain.com

9F930100825 967 Sun Dec 15 13:24:04 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

9214B100831 1249 Sun Dec 15 16:53:58 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

945C9100853 3617 Mon Dec 16 11:20:49 MAILER-DAEMON
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

93DDB100898 2856 Mon Dec 16 17:25:15 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

8088D100835 1241 Sun Dec 15 19:04:45 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

8508F100827 967 Sun Dec 15 13:45:13 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
postmaster@mail.mydomain.com

AF46D100832 4441 Sun Dec 15 14:53:47 MAILER-DAEMON
(connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
www@mail.mydomain.com

A8389100829 939 Sun Dec 15 14:08:42 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
postmaster@mail.mydomain.com

A1FA7100889 2612 Mon Dec 16 14:41:56 MAILER-DAEMON
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

A2FC310086D 2951 Mon Dec 16 07:56:34 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
www@mail.mydomain.com

A8B4A100880 791 Mon Dec 16 14:41:46 www@mail.mydomain.com
(connect to brokerclicks.com[208.91.196.152]:25: Connection refused)
nestinka@brokerclicks.com

05A0D100862 571 Mon Dec 16 16:07:52 root@mail.mydomain.com
(connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
root@mail.mydomain.com

0BBC2100821 1247 Sun Dec 15 07:00:49 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

0392D100861 817 Mon Dec 16 06:25:48 root@mail.mydomain.com
(connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
root@mail.mydomain.com

0007B100875 4021 Mon Dec 16 12:40:00 MAILER-DAEMON
(connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
www@mail.mydomain.com

0778010089A 2827 Mon Dec 16 19:32:21 MAILER-DAEMON
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

C8C3110087E 2627 Mon Dec 16 14:41:45 MAILER-DAEMON
(connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

1ABD3100851 2897 Mon Dec 16 01:32:05 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

EE35D10084B 2910 Mon Dec 16 01:04:20 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

E4FE2100830 571 Mon Dec 16 00:26:00 root@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
root@mail.mydomain.com

E1283100826 4397 Sun Dec 15 13:58:18 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

E76C310084A 4257 Mon Dec 16 00:41:22 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

E120F100849 2968 Mon Dec 16 00:36:32 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

E227310082C 4449 Sun Dec 15 14:53:47 MAILER-DAEMON
(connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

58E1C100893 2782 Mon Dec 16 15:21:16 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

5310510082A 966 Sun Dec 15 14:50:16 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

5FED9100817 939 Sat Dec 14 22:24:29 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

4C1F110088F 11665 Mon Dec 16 14:47:31 MAILER-DAEMON
(connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

4A2F010082B 1249 Sun Dec 15 16:24:35 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

41C18100822 1257 Sun Dec 15 07:19:02 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
postmaster@mail.mydomain.com

46CEA100823 966 Sun Dec 15 11:45:01 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

4B2D110086B 11674 Mon Dec 16 12:02:53 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

41B1610082D 1249 Sun Dec 15 16:33:22 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

49DA710081C 1257 Sun Dec 15 00:25:46 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

4618110083B 571 Mon Dec 16 02:31:55 root@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
root@mail.mydomain.com

317D7100899 2833 Mon Dec 16 18:33:52 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
www@mail.mydomain.com

3947B100824 1247 Sun Dec 15 08:01:12 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

3ACD8100837 940 Sun Dec 15 19:31:44 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

3F75F100897 2871 Mon Dec 16 17:21:40 MAILER-DAEMON
(connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

B558D10089C 2848 Mon Dec 16 20:07:44 MAILER-DAEMON
(connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
www@mail.mydomain.com

BFD2D10081F 1247 Sun Dec 15 06:42:28 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
postmaster@mail.mydomain.com

B7DB5100828 4414 Sun Dec 15 14:53:47 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
www@mail.mydomain.com

BC241100812 965 Sat Dec 14 21:35:10 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

BD97E100834 1257 Sun Dec 15 18:10:46 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
postmaster@mail.mydomain.com

6428710081B 966 Sun Dec 15 05:38:50 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[2606:4700:3032::6815:5065]:25: Connection timed out)
postmaster@mail.mydomain.com

63E99100833 695 Sun Dec 15 19:17:36 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

63FF710088D 2619 Mon Dec 16 14:42:27 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

63F5A10089B 4943 Mon Dec 16 19:53:28 MAILER-DAEMON
(delivery temporarily suspended: connect to mail.mydomain.com[172.67.177.44]:25: Connection timed out)
www@mail.mydomain.com

65A84100805 992 Sat Dec 14 17:02:45 double-bounce@mail.mydomain.com
(connect to mail.mydomain.com[2606:4700:3034::ac43:b12c]:25: Connection timed out)
postmaster@mail.mydomain.com

6CC06100815 995 Sat Dec 14 20:52:24 double-bounce@mail.mydomain.com
(delivery temporarily suspended: connect to mail.mydomain.com[104.21.80.101]:25: Connection timed out)
postmaster@mail.mydomain.com

aaP_rehanhasanofficial

aaPanel_Kern
Kindly Check postqueue report and reply me.

aaP_rehanhasanofficial

Also noticed ram is using always morthan 78%.
What exactly used these huge ram? I have only 3 website with low volume traffic.

aaPanel_Kern

Hello, are the MX records of your domain name proxied by Cloudfalre? MX records can only be DNS resolved and point to the IP of the server
You can try clearing the queue
postsuper -d ALL

aaP_rehanhasanofficial

aaPanel_Kern
Last login: Tue Dec 17 02:42:25 2024 from 127.0.0.1
root@mail:~# postsuper -d all
postsuper: Deleted: 0 messages
root@mail:~# postsuper -d All
postsuper: Deleted: 0 messages
root@mail:~#

MX records not proxied by cloudflare, Here is the screenshot.

aaPanel_Kern

aaP_rehanhasanofficial

use DNS only
aaP_rehanhasanofficial

aaP_rehanhasanofficial

aaPanel_Kern
I did it, Problem not fix, even it increased, But still someone using my server for spamming;
Who is using my server?

aaP_rehanhasanofficial

aaPanel_Kern
Can you take look at my above 2 screenshot, Its so much dangerous that i have no file, But still RAM is using 90%+.
How is it possible?

aaP_rehanhasanofficial

Now I have removed all of the websites, files and database from aapanel, Now still showing "12" user using my server and RAM using morethan 90%.

What should i do? If i reinstall server and install fresh aapanel then this problem will be solve?

aaPanel_Kern

Hello, I suggest you use the monitoring interface to check which programs are using resources?

aaP_rehanhasanofficial

aaPanel_Kern
I have reinstall server and aapanel. Now its seems okay.