File: /home/golnoor/mail/golnoor.com/root/cur/1667682484.M370981P3211.vps.golnoor.com,S=11155,W=11343:2,
Return-Path: <>
Delivered-To: root@golnoor.com
Received: from vps.golnoor.com
by vps.golnoor.com with LMTP
id KCn4FbTQZmOLDAAA/P5FDA
(envelope-from <>)
for <root@golnoor.com>; Sun, 06 Nov 2022 00:38:04 +0330
Return-path: <>
Envelope-to: root@vps.golnoor.com
Delivery-date: Sun, 06 Nov 2022 00:38:04 +0330
Received: from mailnull by vps.golnoor.com with local (Exim 4.95)
id 1or3gj-000248-Hz
for root@vps.golnoor.com;
Sat, 05 Nov 2022 00:23:17 +0330
X-Failed-Recipients: root@golnoor.com
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@vps.golnoor.com>
To: root@vps.golnoor.com
References: <E1or3gW-0001wH-Jl@vps.golnoor.com>
Content-Type: multipart/report; report-type=delivery-status; boundary=1667595197-eximdsn-65194952
MIME-Version: 1.0
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1or3gj-000248-Hz@vps.golnoor.com>
Date: Sat, 05 Nov 2022 00:23:17 +0330
--1667595197-eximdsn-65194952
Content-type: text/plain; charset=us-ascii
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
root@golnoor.com
(generated from root@vps.golnoor.com)
LMTP error after RCPT TO:<root@golnoor.com>: 552 5.2.2 <root@golnoor.com> Mailbox is full / Blocks limit exceeded / Inode limit exceeded
--1667595197-eximdsn-65194952
Content-type: message/delivery-status
Reporting-MTA: dns; vps.golnoor.com
Action: failed
Final-Recipient: rfc822;root@vps.golnoor.com
Status: 5.0.0
--1667595197-eximdsn-65194952
Content-type: message/rfc822
Return-path: <root@vps.golnoor.com>
Received: from root by vps.golnoor.com with local (Exim 4.95)
(envelope-from <root@vps.golnoor.com>)
id 1or3gW-0001wH-Jl
for root@vps.golnoor.com;
Sat, 05 Nov 2022 00:23:04 +0330
To: root@vps.golnoor.com
Subject: lfd on vps.golnoor.com: Suspicious process running under user dovecot
From: <root@vps.golnoor.com>
Message-Id: <E1or3gW-0001wH-Jl@vps.golnoor.com>
Date: Sat, 05 Nov 2022 00:23:04 +0330
X-YourOrg-MailScanner-Information: Please contact the ISP for more information
X-YourOrg-MailScanner-ID: 1or3gW-0001wH-Jl
X-YourOrg-MailScanner: Found to be clean
X-YourOrg-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=0.811, required 5, DKIM_ADSP_NXDOMAIN 0.80,
KAM_DMARC_STATUS 0.01, URIBL_BLOCKED 0.00)
X-YourOrg-MailScanner-From: root@vps.golnoor.com
X-Spam-Status: No
Time: Sat Nov 5 00:23:04 2022 +0330
PID: 6161 (Parent PID:21241)
Account: dovecot
Uptime: 444 seconds
Executable:
/usr/libexec/dovecot/auth
Command Line (often faked in exploits):
dovecot/auth
Network connections by the process (if any):
tcp: 127.0.0.1:54050 -> 127.0.0.1:579
Files open by the process (if any):
/dev/null
/dev/urandom
/dev/null
anon_inode:[eventpoll]
/run/dovecot/old-stats-user
Memory maps by the process (if any):
55c90e7da000-55c90e839000 r-xp 00000000 fd:00 1053332 /usr/libexec/dovecot/auth
55c90ea39000-55c90ea3c000 r--p 0005f000 fd:00 1053332 /usr/libexec/dovecot/auth
55c90ea3c000-55c90ea3e000 rw-p 00062000 fd:00 1053332 /usr/libexec/dovecot/auth
55c90f585000-55c90f5cf000 rw-p 00000000 00:00 0 [heap]
7f6b24e09000-7f6b24e20000 r-xp 00000000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6b24e20000-7f6b2501f000 ---p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6b2501f000-7f6b25020000 r--p 00016000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6b25020000-7f6b25021000 rw-p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6b25021000-7f6b25025000 rw-p 00000000 00:00 0
7f6b25025000-7f6b25126000 r-xp 00000000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6b25126000-7f6b25325000 ---p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6b25325000-7f6b25326000 r--p 00100000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6b25326000-7f6b25327000 rw-p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6b25327000-7f6b2533c000 r-xp 00000000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6b2533c000-7f6b2553b000 ---p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6b2553b000-7f6b2553c000 r--p 00014000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6b2553c000-7f6b2553d000 rw-p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6b2553d000-7f6b25653000 r-xp 00000000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6b25653000-7f6b25853000 ---p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6b25853000-7f6b25856000 r--p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6b25856000-7f6b25859000 rw-p 00119000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6b25859000-7f6b2585a000 rw-p 00000000 00:00 0
7f6b2585a000-7f6b2585e000 r-xp 00000000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6b2585e000-7f6b25a5d000 ---p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6b25a5d000-7f6b25a5e000 r--p 00003000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6b25a5e000-7f6b25a5f000 rw-p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6b25a5f000-7f6b25a62000 r-xp 00000000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6b25a62000-7f6b25c61000 ---p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6b25c61000-7f6b25c62000 r--p 00002000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6b25c62000-7f6b25c63000 rw-p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6b25c63000-7f6b25d1b000 r-xp 00000000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6b25d1b000-7f6b25f1b000 ---p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6b25f1b000-7f6b25f1d000 r--p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6b25f1d000-7f6b25f1e000 rw-p 000ba000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6b25f1e000-7f6b25f22000 rw-p 00000000 00:00 0
7f6b25f22000-7f6b25f26000 r-xp 00000000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6b25f26000-7f6b26126000 ---p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6b26126000-7f6b26127000 r--p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6b26127000-7f6b26128000 rw-p 00005000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6b26128000-7f6b26146000 r-xp 00000000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6b26146000-7f6b26345000 ---p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6b26345000-7f6b26346000 r--p 0001d000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6b26346000-7f6b26347000 rw-p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6b26347000-7f6b26351000 rw-p 00000000 00:00 0
7f6b26351000-7f6b26353000 r-xp 00000000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6b26353000-7f6b26552000 ---p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6b26552000-7f6b26553000 r--p 00001000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6b26553000-7f6b26554000 rw-p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6b26554000-7f6b26718000 r-xp 00000000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6b26718000-7f6b26917000 ---p 001c4000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6b26917000-7f6b2691b000 r--p 001c3000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6b2691b000-7f6b2691d000 rw-p 001c7000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6b2691d000-7f6b26922000 rw-p 00000000 00:00 0
7f6b26922000-7f6b2692f000 r-xp 00000000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6b2692f000-7f6b26b2f000 ---p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6b26b2f000-7f6b26b30000 r--p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6b26b30000-7f6b26b31000 rw-p 0000e000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6b26b31000-7f6b26b39000 r-xp 00000000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6b26b39000-7f6b26d38000 ---p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6b26d38000-7f6b26d39000 r--p 00007000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6b26d39000-7f6b26d3a000 rw-p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6b26d3a000-7f6b26d68000 rw-p 00000000 00:00 0
7f6b26d68000-7f6b26d6a000 r-xp 00000000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6b26d6a000-7f6b26f6a000 ---p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6b26f6a000-7f6b26f6b000 r--p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6b26f6b000-7f6b26f6c000 rw-p 00003000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6b26f6c000-7f6b27120000 r-xp 00000000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6b27120000-7f6b2731f000 ---p 001b4000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6b2731f000-7f6b27328000 r--p 001b3000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6b27328000-7f6b2732a000 rw-p 001bc000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6b2732a000-7f6b2732d000 rw-p 00000000 00:00 0
7f6b2732d000-7f6b2732e000 r-xp 00000000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6b2732e000-7f6b2752e000 ---p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6b2752e000-7f6b2752f000 r--p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6b2752f000-7f6b27530000 rw-p 00002000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6b27530000-7f6b27552000 r-xp 00000000 fd:00 3400 /usr/lib64/ld-2.17.so
7f6b2773f000-7f6b27744000 rw-p 00000000 00:00 0
7f6b2774f000-7f6b27751000 rw-p 00000000 00:00 0
7f6b27751000-7f6b27752000 r--p 00021000 fd:00 3400 /usr/lib64/ld-2.17.so
7f6b27752000-7f6b27753000 rw-p 00022000 fd:00 3400 /usr/lib64/ld-2.17.so
7f6b27753000-7f6b27754000 rw-p 00000000 00:00 0
7fffa113c000-7fffa115d000 rw-p 00000000 00:00 0 [stack]
7fffa116d000-7fffa116f000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
--1667595197-eximdsn-65194952--