E-mail entrou em uma lista de SPAM e não paro de receber "Mail delivery failed: returning message to sender"

[Paulo Pedroso]

Boa noite pessoal! Contratei uma hospedagem Hostgator para o e-commerce da minha cunhada, ela desenvolveu uma loja virtual e estava usando o webmail para fazer o contato com os clientes da loja. Acontece que agora ela recebe uns 150 e-mails por dia, parece que o próprio e-mail tenta enviar mensagens para uns destinatários esquisitos e a mensagem acaba retornando, e recebo diversas notificações do sistema de e-mail falando que o envio não pode ser concluído. 

Já troquei a senha, que basicamente, é a única coisa que existe para fazer através do webmail, mas esses e-mails continuam chegando, falando que não consegui enviar o tal do e-mail para esses destinatários esquisitos. O que devo fazer? A conta de e-mail é muito importante pra ela, vou anexar aqui prints e textos completos do e-mail. 

Vou anexar aqui duas imagens, uma da lista de e-mails que chegaram e um e-mail, logo abaixo vou anexar os dois tipos de mensagens que recebo: 

 

Imagem 1:   https://ibb.co/GFbLJHH
Imagem 2:   https://ibb.co/m89MZGn

 

EXEMPLO E-MAIL 1: 

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  anthony@paxton-access.com
    host mx1.mtaroutes.com [38.109.53.17]
    SMTP error from remote mail server after end of data:
    550 High probability of spam

Reporting-MTA: dns; vps-4739254.ecohbrasil.com.br

Action: failed
Final-Recipient: rfc822;anthony@paxton-access.com
Status: 5.0.0
Remote-MTA: dns; mx1.mtaroutes.com
Diagnostic-Code: smtp; 550 High probability of spam

De	Mark Gibbon
Para	anthony
Data	Hoje 6:31 pm

Anthony    https://u.to/zcA4Fw    Mark

 

 

EXEMPLO E-MAIL 2:

 

Your message to shaun.wilde@apolline.uk.com couldn't be delivered.

shaun.wilde wasn't found at apolline.uk.com.

contato Office 365 shaun.wilde Action Required   Recipient Unknown To address

How to Fix It The address may be misspelled or may not exist. Try one or more of the following: Send the message again following these steps: In Outlook, open this non-delivery report (NDR) and choose Send Again from the Report ribbon. In Outlook on the web, select this NDR, then select the link "To send this message again, click here." Then delete and retype the entire recipient address. If prompted with an Auto-Complete List suggestion don't select it. After typing the complete address, click Send. Contact the recipient (by phone, for example) to check that the address exists and is correct. The recipient may have set up email forwarding to an incorrect address. Ask them to check that any forwarding they've set up is working correctly. Clear the recipient Auto-Complete List in Outlook or Outlook on the web by following the steps in this article: Fix email delivery issues for error code 5.1.10 in Office 365, and then send the message again. Retype the entire recipient address before selecting Send. If the problem continues, forward this message to your email admin. If you're an email admin, refer to the More Info for Email Admins section below.

Was this helpful? Send feedback to Microsoft.

More Info for Email Admins

Status code: 550 5.1.10 This error occurs because the sender sent a message to an email address hosted by Office 365 but the address is incorrect or doesn't exist at the destination domain. The error is reported by the recipient domain's email server, but most often it must be fixed by the person who sent the message. If the steps in the How to Fix It section above don't fix the problem, and you're the email admin for the recipient, try one or more of the following: The email address exists and is correct - Confirm that the recipient address exists, is correct, and is accepting messages. Synchronize your directories - If you have a hybrid environment and are using directory synchronization make sure the recipient's email address is synced correctly in both Office 365 and in your on-premises directory. Errant forwarding rule - Check for forwarding rules that aren't behaving as expected. Forwarding can be set up by an admin via mail flow rules or mailbox forwarding address settings, or by the recipient via the Inbox Rules feature. Recipient has a valid license - Make sure the recipient has an Office 365 license assigned to them. The recipient's email admin can use the Office 365 admin center to assign a license (Users > Active Users > select the recipient > Assigned License > Edit). Mail flow settings and MX records are not correct - Misconfigured mail flow or MX record settings can cause this error. Check your Office 365 mail flow settings to make sure your domain and any mail flow connectors are set up correctly. Also, work with your domain registrar to make sure the MX records for your domain are configured correctly. For more information and additional tips to fix this issue, see Fix email delivery issues for error code 5.1.10 in Office 365.

Original Message Details

Created Date: 1/15/2020 8:10:48 PM Sender Address: emaildaminhaclienteaqui Recipient Address: shaun.wilde@apolline.uk.com Subject:

Error Details

Reported error: 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient shaun.wilde@apolline.uk.com not found by SMTP address lookup DSN generated by: AM6PR01MB6070.eurprd01.prod.exchangelabs.com

 

Message Hops
HOP	TIME (UTC)	FROM	TO	WITH	RELAY TIME
1	1/15/2020 8:10:48 PM	n1164839253.netvigator.com	vps-4739254.ecohbrasil.com.br	esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.92) (envelope-from <emaildaminhaclienteaqui>)	*
2	1/15/2020 8:10:51 PM	vps-4739254.ecohbrasil.com.br	VE1EUR02FT006.mail.protection.outlook.com	Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)	3 sec
3	1/15/2020 8:10:52 PM	VE1EUR02FT006.eop-EUR02.prod.protection.outlook.com	HE1PR0101CA0013.outlook.office365.com	Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)	1 sec
4	1/15/2020 8:10:52 PM	HE1PR0101CA0013.eurprd01.prod.exchangelabs.com	AM6PR01MB6070.eurprd01.prod.exchangelabs.com	Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)	*

Original Message Headers

Received: from HE1PR0101CA0013.eurprd01.prod.exchangelabs.com
 (2603:10a6:3:77::23) by AM6PR01MB6070.eurprd01.prod.exchangelabs.com
 (2603:10a6:20b:d4::17) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2623.11; Wed, 15 Jan
 2020 20:10:52 +0000
Received: from VE1EUR02FT006.eop-EUR02.prod.protection.outlook.com
 (2a01:111:f400:7e06::204) by HE1PR0101CA0013.outlook.office365.com
 (2603:10a6:3:77::23) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2644.18 via Frontend
 Transport; Wed, 15 Jan 2020 20:10:52 +0000
Authentication-Results: spf=pass (sender IP is 162.241.94.133)
 smtp.mailfrom=ecohbrasil.com.br; apolline.uk.com; dkim=pass (signature was
 verified) header.d=ecohbrasil.com.br;apolline.uk.com; dmarc=bestguesspass
 action=none header.from=ecohbrasil.com.br;
Received-SPF: Pass (protection.outlook.com: domain of ecohbrasil.com.br
 designates 162.241.94.133 as permitted sender)
 receiver=protection.outlook.com; client-ip=162.241.94.133;
 helo=vps-4739254.ecohbrasil.com.br;
Received: from vps-4739254.ecohbrasil.com.br (162.241.94.133) by
 VE1EUR02FT006.mail.protection.outlook.com (10.152.12.221) with Microsoft SMTP
 Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
 15.20.2644.19 via Frontend Transport; Wed, 15 Jan 2020 20:10:51 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ecohbrasil.com.br; s=default; h=Content-Transfer-Encoding:Content-Type:
	MIME-Version:Reply-To:To:From:Message-Id:Subject:Date:Sender:Cc:Content-ID:
	Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
	:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
	List-Subscribe:List-Post:List-Owner:List-Archive;
	bh=+Nv55FswKQ1nw+b+Tz7kTmIjKf30VOlSqYe57PyLDxY=; b=VobscbLir2+QkypQEIkRGqQTqO
	cS9CFkV8pHHExdlX/w6XCgK8Xuv95+Hrth9l9ompWQTNDJ7PrKMLh+paaQAxjO04dLrONmNctHr72
	ldiIVnmbIXO+OAeHqrWnGyyIM8lwOZlZPqyfQZgKC2+NKdm9GOLopr34ZVy+qXkMlNTwqjmsefDs9
	F9Svr1nQjE5gV14FCghfslec6EGzC2dOzFW8VtfeEIzyZ62ZbGnbx7ynbF55YdOx77flszcrr5ZVo
	9gX+SqEceH4FW1Vb5fQRdIyszw8ekbGWTxWreug7dN4y055ghbhUvjXVR0UcIIvCY0YV5NNEaCY44
	JV6h0K1w==;
Received: from n1164839253.netvigator.com ([116.48.39.253]:38762 helo=mail.ecohbrasil.com.br)
	by vps-4739254.ecohbrasil.com.br with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128)
	(Exim 4.92)
	(envelope-from <contato@ecohbrasil.com.br>)
	id 1irp04-0003RY-CH
	for shaun.wilde@apolline.uk.com; Wed, 15 Jan 2020 17:10:48 -0300
Date: Wed, 15 Jan 2020 23:10:48 +0300
Subject:
Message-ID: <gff8b9s3e8evqvs9x8pdmea0.15791190485281@email.android.com>
From: "Phillip J Hufton" <phufton@ecohbrasil.com.br>
To: "Shaun" <shaun.wilde@apolline.uk.com>
Reply-To: "Phillip J Hufton" <phuftonr@btinternet.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - vps-4739254.ecohbrasil.com.br
X-AntiAbuse: Original Domain - apolline.uk.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - ecohbrasil.com.br
X-Get-Message-Sender-Via: vps-4739254.ecohbrasil.com.br: authenticated_id: contato@ecohbrasil.com.br
X-Authenticated-Sender: vps-4739254.ecohbrasil.com.br: contato@ecohbrasil.com.br
X-Source:
X-Source-Args:
X-Source-Dir:
Return-Path: contato@ecohbrasil.com.br
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: df95fdfe-25cf-47b7-8b19-e2d931779ec2:0
X-Forefront-Antispam-Report: CIP:162.241.94.133;IPV:;CTRY:US;EFV:NLI;
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 2346e1f0-85a9-44ff-da0f-08d799f70534
X-MS-TrafficTypeDiagnostic: AM6PR01MB6070:

Reporting-MTA: dns;AM6PR01MB6070.eurprd01.prod.exchangelabs.com
Received-From-MTA: dns;vps-4739254.ecohbrasil.com.br
Arrival-Date: Wed, 15 Jan 2020 20:10:52 +0000

Final-Recipient: rfc822;shaun.wilde@apolline.uk.com
Action: failed
Status: 5.1.10
Diagnostic-Code: smtp;550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient shaun.wilde@apolline.uk.com not found by SMTP address lookup
X-Display-Name: Shaun
 

De	Phillip J Hufton
Para	Shaun
Data	Hoje 5:10 pm

  Shaun

https://clck.ru/LrUoz

 

[Andre Juliano]

Verifique se não a algum arquivo malware nos arquivos dessa loja. Pode ser que ela esteja enviando esses emails.

Editado Janeiro 15, 2020 por Andre Juliano

[Paulo Pedroso]

Citar

10 minutos atrás, Andre Juliano disse:

Verifique se não a algum arquivo malware nos arquivos dessa loja. Pode ser que ela esteja enviando esses emails.

Acontece que a loja foi desenvolvida com Wordpress, tudo foi feito corretamente e todos os plugins são originais, acho pouco provável a chance de um malware, já que não subimos nenhum arquivo a parte pra hospedagem

 

[Andre Juliano]

@Paulo Pedroso Não é bem assim, se o wordpress utiliza senha fraca e plugins desatualizados a chance é alta. Até mesmo se o wordpress em si está usando uma versão antiga já corre esse risco. Wordpress é um prato cheio para invasões.

Nesse caso aconselho salvar as imagens e o banco sql e reinstalar o wordpress.

Editado Janeiro 16, 2020 por Andre Juliano

[AngelCosta]

E o template da loja é original?

[McGuyver]

Bom dia!

Eu de volta aqui depois de um século afastado! :-D
Já tive problemas assim e posso falar que, assim como a @AngelCosta e o @Andre Juliano falaram, é extremamente importante:

• Ter a última versão do Wordpress instalado
• Wordpress baixado diretamente do site original ou instalado através de ferramenta padrão da hospedagem
• Ter as últimas versões dos plugins
• Somente plugins originais, baixados diretamente do site da Wordpress ou do desenvolvedor
• Plugins confiáveis, bastante reconhecidos no mercado
• Senhas fortes no Wordpress
• Usuário padrão diferente do admin, se possível remover o admin, após criar um usuário com poderes administrativos
• Senha forte no painel de controle da hospedagem
• Senha forte nos e-mails
• Caso seja utilizado o Outlook ou outro cliente de email, verificar completamente a(s) máquina(s) que utilizam essas ferramentas

Às vezes se esquece o óbvio, mas eu mesmo já vi muitos casos de problemas desse tipo justamente porque a máquina onde estava o Outlook foi contaminada e virou spammer. Outros casos foram plugins piratas ou de procedência duvidosa.

Verifique essas questões acima com cuidado. Depois de ter localizado o problema você poderá correr atrás de limpar o IP ou conseguir um novo. Até lá qualquer ação nesse sentido não surtirá resultados favoráveis.