[imp] Strange logs in apache

Rodrigo Abrantes Antunes rodrigoantunes at pelotas.ifsul.edu.br
Tue Oct 16 15:54:38 UTC 2012


Citando Vilius Šumskas <vilius at lnk.lt>:
> Rodrigo Abrantes Antunes <rodrigoantunes at pelotas.ifsul.edu.br> rašė:
>> More logs in my mail server, not the one where horde is:
>>
>>    mail.log.2:Sep 17 13:02:03 mymailserver postfix/smtp[7196]: 92481216C7:
>>    to=<MDRatcliff at hotmail.com>, relay=mx4.hotmail.com[65.55.92.152]:25,
>>    delay=2.2, delays=0.13/0.2/0.5/1.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:03 mymailserver postfix/smtp[7196]: 92481216C7:
>>    to=<a2zgram at hotmail.com>, relay=mx4.hotmail.com[65.55.92.152]:25,
>>    delay=2.2, delays=0.13/0.2/0.5/1.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:03 mymailserver postfix/smtp[7196]: 92481216C7:
>>    to=<craigspecker at hotmail.com>, relay=mx4.hotmail.com[65.55.92.152]:25,
>>    delay=2.2, delays=0.13/0.2/0.5/1.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:03 mymailserver postfix/smtp[7196]: 92481216C7:
>>    to=<gwen.lisa at hotmail.com>, relay=mx4.hotmail.com[65.55.92.152]:25,
>>    delay=2.2, delays=0.13/0.2/0.5/1.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:08 mymailserver postfix/smtp[7193]: 92481216C7:
>>    to=<buckley01 at msn.com>, relay=mx4.hotmail.com[65.55.92.136]:25,  
>> delay=6.8,
>>    delays=0.13/2.5/0.74/3.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:08 mymailserver postfix/smtp[7193]: 92481216C7:
>>    to=<haljrat at msn.com>, relay=mx4.hotmail.com[65.55.92.136]:25, delay=6.8,
>>    delays=0.13/2.5/0.74/3.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:08 mymailserver postfix/smtp[7193]: 92481216C7:
>>    to=<james.taylor78 at msn.com>, relay=mx4.hotmail.com[65.55.92.136]:25,
>>    delay=6.8, delays=0.13/2.5/0.74/3.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:08 mymailserver postfix/smtp[7193]: 92481216C7:
>>    to=<jimmyjg2 at msn.com>, relay=mx4.hotmail.com[65.55.92.136]:25, delay=6.8,
>>    delays=0.13/2.5/0.74/3.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:08 mymailserver postfix/smtp[7193]: 92481216C7:
>>    to=<lgtk_50 at msn.com>, relay=mx4.hotmail.com[65.55.92.136]:25, delay=6.8,
>>    delays=0.13/2.5/0.74/3.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:08 mymailserver postfix/smtp[7193]: 92481216C7:
>>    to=<mardeck at msn.com>, relay=mx4.hotmail.com[65.55.92.136]:25, delay=6.8,
>>    delays=0.13/2.5/0.74/3.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>>    mail.log.2:Sep 17 13:02:08 mymailserver postfix/smtp[7193]: 92481216C7:
>>    to=<sswinshaw at msn.com>, relay=mx4.hotmail.com[65.55.92.136]:25,  
>> delay=6.8,
>>    delays=0.13/2.5/0.74/3.4, dsn=2.0.0, status=sent (250 
>>    <20120917130155.Horde.Rgb1fEv4Cn9QV0lzuz0nzRA at myhordeserver.xxx.xxx>
>>    Queued mail for delivery)
>   Looks like your mail server or one of the accounts was hacked.
>
>   --
>   Vilius
>
>
>   --
>   imp mailing list
>   Frequently Asked Questions: http://wiki.horde.org/FAQTo  
> unsubscribe, mail: imp-unsubscribe at lists.horde.org

But the strange thing is how the message id is .. at myhordeserver.xxx.xxx if
it's not my mail server?


More information about the imp mailing list