Re: [qmailtoaster] Close to quota message or scam

2020-12-04 Thread Gary Bowling

  
  


Yes, this is why I would like to get the quota graph working in
  squirrelmail again. This was the easy place for customers to see
  if they actually had a quota problem if they got these scam
  messages. 



Gary



On 12/4/2020 9:58 AM, Angus McIntyre
  wrote:

"Valued
  Customer" is such an obvious giveaway that I wouldn't bother
  looking any further. It's a very common phrase in scams of all
  kinds. Your message is a scam and it almost certainly came from
  outside your system.
  
  
  Incidentally, on the subject of quota messages, I did see an
  interesting case the other day. Mail was bouncing from one user
  and the bounce messages claimed that the message couldn't be
  delivered because the user was over their quota.
  
  
  I knew this couldn't be the case, because I don't have quotas and
  in fact the user in question was 'virtual': a non-existent user
  who was being processed by the catch-all and delivered directly to
  a mailbox (a sub-mailbox of another user who was having no trouble
  receiving mail).
  
  
  I finally tracked it down to a dovecot file -- 'dovecot-uidlist',
  if I remember correctly -- that had the wrong ownership. It was
  owned by root instead of vpopmail, so dovecot couldn't read it and
  was bouncing mail with that spurious 'over quota' message.
  
  
  This doesn't relate to your case -- which sounds like simple
  phishing -- but I thought I'd share it just for general
  enlightenment. If you get weird quota-related bounces, remember to
  check ownership and permissions.
  
  
  Angus
  
  
  
  
  Jeff Koch wrote on 12/4/20 9:41 AM:
  
  

One of our QT7 mailserver accounts got an email addressed to a
non-existent account that was picked up by his catch-all with
the subject


'Mail quota warning - You are close to your quota'


He's using about 0% of his quota which I confirmed by manually
checking the space used by his account. The header on this email
says almost nothing except the email came from Mailer-Daemon and
it's addressed to 'Valued Customer:;'


I've seen over-quota messages but never a warning message.  Is
there anything in QT7 that could be generating such a message.


Thanks,


Jeff Koch






  
  
-
  
  To unsubscribe, e-mail:
  qmailtoaster-list-unsubscr...@qmailtoaster.com
  
  For additional commands, e-mail:
  qmailtoaster-list-h...@qmailtoaster.com
  
  

  


-
To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com
For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com



Re: [qmailtoaster] Close to quota message or scam

2020-12-04 Thread Angus McIntyre
"Valued Customer" is such an obvious giveaway that I wouldn't bother 
looking any further. It's a very common phrase in scams of all kinds. 
Your message is a scam and it almost certainly came from outside your 
system.


Incidentally, on the subject of quota messages, I did see an interesting 
case the other day. Mail was bouncing from one user and the bounce 
messages claimed that the message couldn't be delivered because the user 
was over their quota.


I knew this couldn't be the case, because I don't have quotas and in 
fact the user in question was 'virtual': a non-existent user who was 
being processed by the catch-all and delivered directly to a mailbox (a 
sub-mailbox of another user who was having no trouble receiving mail).


I finally tracked it down to a dovecot file -- 'dovecot-uidlist', if I 
remember correctly -- that had the wrong ownership. It was owned by root 
instead of vpopmail, so dovecot couldn't read it and was bouncing mail 
with that spurious 'over quota' message.


This doesn't relate to your case -- which sounds like simple phishing -- 
but I thought I'd share it just for general enlightenment. If you get 
weird quota-related bounces, remember to check ownership and permissions.


Angus



Jeff Koch wrote on 12/4/20 9:41 AM:


One of our QT7 mailserver accounts got an email addressed to a 
non-existent account that was picked up by his catch-all with the subject


'Mail quota warning - You are close to your quota'

He's using about 0% of his quota which I confirmed by manually checking 
the space used by his account. The header on this email says almost 
nothing except the email came from Mailer-Daemon and it's addressed to 
'Valued Customer:;'


I've seen over-quota messages but never a warning message.  Is there 
anything in QT7 that could be generating such a message.


Thanks,

Jeff Koch







-
To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com
For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com