Re: Your OVHcloud ticket-431210 requires further action from you to resolve

Re: Your OVHcloud ticket-431210 requires further action from you to resolve

[Ammar Faizi]

[ Top post per OVH's request ]

Hello,

We acknowledge receipt of your notice regarding the abuse report.

We have identified the source of the issue as a compromised user
account on our mail server (IP: 51.81.211.47) under the domain
gnuweeb.org. The account in question, Yoga Pranata
zyxdevs@gnuweeb.org, was used to send spam emails, including the XARF
report mentioned.

Immediate action has been taken to suspend the compromised account.
Additionally, we are implementing an SMTP quota limit to prevent such
incidents in the future. We will also conduct a thorough review of all
user accounts to identify and mitigate any further malicious activity.

For your reference, we have attached our postqueue log as evidence of
the spam activity originating from the compromised account:

Postqueue Log Evidence:
https://gist.githubusercontent.com/ammarfaizi2/91aaefa212ed88476cbcbdf8eb907d1d/raw/b2a9783f624c8fdfe6791bf936f323f7a5e99c51/postqueue.txt

We deeply regret this occurrence and are committed to ensuring it does
not happen again. Thank you for your understanding and cooperation.

Best regards,
-- 
Ammar Faizi

[ Top post per OVH's request ]

On Tue, Jul 2, 2024 at 11:50 PM OVH US Support
<support@corp1.zendesk.com> wrote:
>
> ##- Please type your reply above this line -##
>
> We need your help in order to solve your case with us for 431210. Please see the agent's next steps needed from you in order to progress your case -
>
> Abuse Agent (OVHcloud US)
>
> Jul 2, 2024, 12:50 PM EDT
>
> Good Day,
>
> We have received reports that your IP listed in the subject line above is issuing malicious traffic. As this is possibly a violation of our Terms of Service, we request that you address these reports immediately. Failure to respond to this notice may ultimately result in the suspension of your service(s).
>
> Please see below for proof:
>
>
>
> The report concerns:
>
> 2024-06-30T08:39:25Z
>
> Spam
>
> 51.81.211.47
>
> Attached is a detailed report in XARF format.
>
>
>
> Please respond with acknowledgment of receipt of this notice and any information you may have regarding these reports, including any actions taken, or that will be taken, to halt the issuance of malicious traffic. If you feel these reports are unfounded, please provide evidence as such.
>
> Thank you for your swift action and cooperation in the matter. If you have any further questions, comments or concerns, please respond directly to this notice.
>
>
> Regards,
>
> This email is a service from US OVHcloud.
> [PMWRNW-RZZLM]

Important Notice: Abuse Report - 51.81.211.47

[OVH US Support]

[-- Attachment #1: Type: text/plain, Size: 3133 bytes --]

##- Please type your reply above this line -##

You are registered as a CC on this request (431210). Reply to this email to add a comment to the request.

----------------------------------------------

Abuse Agent, Jul 3, 2024, 12:16 PM EDT

Hello,

Thank you for the prompt reply and action taken, it is appreciated.

We will close the case as resolved for now, if anything further comes in we will reach out here again.

Regards,

----------------------------------------------

Ammar Faizi, Jul 2, 2024, 3:22 PM EDT

[ Top post per OVH's request ]

Hello,

We acknowledge receipt of your notice regarding the abuse report.

We have identified the source of the issue as a compromised user
account on our mail server (IP: 51.81.211.47) under the domain
gnuweeb.org. The account in question, Yoga Pranata
zyxdevs@gnuweeb.org, was used to send spam emails, including the XARF
report mentioned.

Immediate action has been taken to suspend the compromised account.
Additionally, we are implementing an SMTP quota limit to prevent such
incidents in the future. We will also conduct a thorough review of all
user accounts to identify and mitigate any further malicious activity.

For your reference, we have attached our postqueue log as evidence of
the spam activity originating from the compromised account:

Postqueue Log Evidence:
https://gist.githubusercontent.com/ammarfaizi2/91aaefa212ed88476cbcbdf8eb907d1d/raw/b2a9783f624c8fdfe6791bf936f323f7a5e99c51/postqueue.txt

We deeply regret this occurrence and are committed to ensuring it does
not happen again. Thank you for your understanding and cooperation.

Best regards,
-- 
Ammar Faizi

[ Top post per OVH's request ]

----------------------------------------------

Abuse Agent, Jul 2, 2024, 12:50 PM EDT

Good Day,

We have received reports that your IP listed in the subject line above is issuing malicious traffic**.** As this is possibly a violation of our Terms of Service, we request that you address these reports immediately. Failure to respond to this notice may ultimately result in the suspension of your service(s).

Please see below for proof:



> The report concerns:
>
> 2024-06-30T08:39:25Z
>
> Spam
>
> 51.81.211.47
>
> Attached is a detailed report in XARF format.



Please respond with acknowledgment of receipt of this notice and any information you may have regarding these reports, including any actions taken, or that will be taken, to halt the issuance of malicious traffic. If you feel these reports are unfounded, please provide evidence as such.

Thank you for your swift action and cooperation in the matter. If you have any further questions, comments or concerns, please respond directly to this notice.


Regards,

Attachment(s):
xarf(1).json - https://support.us.ovhcloud.com/attachments/token/hPr7vPfXVdKq1vxdnWWZ94Rfj/?name=xarf%281%29.json

--------------------------------
This email is a service from OVHcloud US.









[PMWRNW-RZZLM]

[-- Attachment #2: Type: text/html, Size: 9755 bytes --]