Established connection by rogue IP

jeffschips

• October 29, 2020 10:27

When I run lsof | grep ">" imap-logi 967 dovenull 20u IPv4 20446 0t0 TCP xxxx.xxxxxxx.com:imap->145.185.xxx.xx.dyn.plus.net:62222 (ESTABLISHED) imap-logi 967 dovenull 22u IPv4 25060 0t0 TCP bxxxx.xxxxxxx.com:imap->145.185.xxx.xx.dyn.plus.net:62225 (ESTABLISHED) this connection is always active. The IP is not associated with my system. If it's of any help I am also getting more frequent notices about spamd excessive usage from csf. Any ideas?

• 

  keat63

  • October 29, 2020 19:41

  Could this just be an end user connected to imap email ?

  0
• 

  jeffschips

  • October 29, 2020 19:44

  that's what I thought but only I have imap/email accounts on the server and the ip's are none of those I use. Maybe that's someone attempting brute force? If that was the case though I would recieve a brute force message, which I'm not receiving. Plus, the connection lasts a long time.

  0
• 

  cPanelAaronH

  • October 30, 2020 01:38

  Hey there, I would grep the mail log file in /var/log/maillog grep 145.185 /var/log/maillog
  

  0
• 

  jeffschips

  • November 01, 2020 03:34

  SOLVED: Thanks that works. It's important to remember that if the logs show a connection (established) but not authenticated, it would appear that no results are returned from this command. This command only returns those that are both established AND authenticated. Correct?

  0
• 

  cPRex Jurassic Moderator

  • November 03, 2020 17:11

  @jeffschips - can you let me know what you mean when you say "the command" ? Are you referring to the initial lsof of the search of /var/log/maillog?

  0

Please sign in to leave a comment.