Hi all,
Not sure if this is the right list to post this to.
I was reviewing my flow records and I can see in the last 24h we have
started doing a much larger amount of POP3 traffic to Microsoft than
usual. As an example, some of the IP's that are making the POP3
connections are:
40.96.25.117
40.100.0.132
40.100.1.237
40.96.18.165
40.96.47.101
40.96.2.53
40.96.15.165
40.100.2.29
I have reviewed the mail server logs on my end and found that it looks
like these IP's are grabbing complete copies of the same mailbox over
and over again. I have put an example of the pop3 logs from dovecot
below from one of our servers which show the repeated downloads. For
this particular domain the user has 1.7GB of emails total in all
mailboxes but I can see in the last 24H Microsoft has downloaded the
mailbox multiple times totalling over 180GB...
I am not exactly sure what on the MS end these IP's belong to and I am
not sure what the customers have setup, I am waiting to hear back from a
few. This is happening across a bunch of different servers on different
mailboxes.
I would be interested to hear if anyone else has experienced this
recently, it appears to still be happening now.
May 5 04:31:36 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 04:56:21 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=442,
session=<4FwzdQoylAkoYBKl>
May 5 04:56:21 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 04:56:25 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=475,
session=<daVwdQoyFLQoYBKl>
May 5 05:03:29 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 05:20:03 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=37159,
session=<ZWf3yQoyzAwoYBKl>
May 5 05:20:03 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 05:20:06 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=37344,
session=<l5koygoylnsoYBKl>
May 5 05:25:53 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 05:47:11 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=89853,
session=<jk4FKwsys0EoYBKl>
May 5 05:47:12 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 05:47:15 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=89886,
session=<WO1GKwsycW8oYBKl>
May 5 05:54:00 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 06:16:53 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=127954,
session=<Poc+lQsyWj8oYBKl>
May 5 06:16:54 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 06:16:58 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=128036,
session=<aqaIlQsysNcoYBKl>
May 5 06:22:31 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 06:51:20 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=170010,
session=<XFBuEAwyiZ8oYBKl>
May 5 06:51:20 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 06:51:29 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=170137,
session=<b8vyEAwyfk4oYBKl>
May 5 06:58:51 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 07:24:25 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=211166,
session=<WCW/hgwyaFwoYBKl>
May 5 07:24:25 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 07:24:39 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=211461,
session=<P12ZhwwyqzcoYBKl>
May 5 07:32:22 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 07:55:49 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=254377,
session=<Ff8F9wwyPPIoYBKl>
May 5 07:55:49 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 07:55:52 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=254460,
session=<71489wwyBSMoYBKl>
May 5 08:04:11 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 08:29:37 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=316387,
session=<8H7qbw0y1OQoYBKl>
May 5 08:29:37 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 08:29:41 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=316465,
session=<1FYpcA0y6g4oYBKl>
May 5 08:38:40 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 09:03:51 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=366954,
session=<sYtf6g0yhSEoYBKl>
May 5 09:03:52 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 09:03:55 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=367047,
session=<oBWR6g0yyQwoYBKl>
May 5 09:11:21 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 09:35:21 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=413154,
session=<09cBWw4yhw4oYBKl>
May 5 09:35:21 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 09:35:24 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=413226,
session=<Kz8yWw4yx+goYBKl>
May 5 09:45:18 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 10:04:12 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=476411,
session=<sHgswg4ydJkoYBKl>
May 5 10:04:12 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 10:04:16 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=476495,
session=<rGxqwg4y7TcoYBKl>
May 5 10:14:11 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 10:33:16 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=520754,
session=<hKwjKg8yMVMoYBKl>
May 5 10:33:17 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 10:33:20 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=520858,
session=<3edaKg8y5wgoYBKl>
May 5 10:40:42 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 11:03:59 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=565412,
session=<2az9lw8yH6AoYBKl>
May 5 11:04:00 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 11:04:02 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=565489,
session=<N9ovmA8yEyQoYBKl>
May 5 11:10:45 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 11:31:20 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=603446,
session=<w/HG+Q8yrMcoYBKl>
May 5 11:31:20 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
May 5 11:31:23 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=603508,
session=<1IP/+Q8y0o8oYBKl>
May 5 11:39:23 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339,
bytes=22081/957917270
May 5 11:58:34 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>,
method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=642418,
session=<GrEzWxAyjMMoYBKl>
May 5 11:58:35 server47 dovecot: pop3(admin@XXXXX): Disconnected:
Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908
_______________________________________________
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
