File: /home/golnoor/mail/golnoor.com/root/cur/1667691220.M930338P14801.vps.golnoor.com,S=11166,W=11354:2,
Return-Path: <>
Delivered-To: root@golnoor.com
Received: from vps.golnoor.com
by vps.golnoor.com with LMTP
id iLhQN9TyZmPROQAA/P5FDA
(envelope-from <>)
for <root@golnoor.com>; Sun, 06 Nov 2022 03:03:40 +0330
Return-path: <>
Envelope-to: root@vps.golnoor.com
Delivery-date: Sun, 06 Nov 2022 03:03:40 +0330
Received: from mailnull by vps.golnoor.com with local (Exim 4.95)
id 1or6BY-0006Da-Ol
for root@vps.golnoor.com;
Sat, 05 Nov 2022 03:03:16 +0330
X-Failed-Recipients: root@golnoor.com
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@vps.golnoor.com>
To: root@vps.golnoor.com
References: <E1or6BV-0006DH-Ps@vps.golnoor.com>
Content-Type: multipart/report; report-type=delivery-status; boundary=1667604796-eximdsn-1299040236
MIME-Version: 1.0
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1or6BY-0006Da-Ol@vps.golnoor.com>
Date: Sat, 05 Nov 2022 03:03:16 +0330
--1667604796-eximdsn-1299040236
Content-type: text/plain; charset=us-ascii
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
root@golnoor.com
(generated from root@vps.golnoor.com)
LMTP error after RCPT TO:<root@golnoor.com>: 552 5.2.2 <root@golnoor.com> Mailbox is full / Blocks limit exceeded / Inode limit exceeded
--1667604796-eximdsn-1299040236
Content-type: message/delivery-status
Reporting-MTA: dns; vps.golnoor.com
Action: failed
Final-Recipient: rfc822;root@vps.golnoor.com
Status: 5.0.0
--1667604796-eximdsn-1299040236
Content-type: message/rfc822
Return-path: <root@vps.golnoor.com>
Received: from root by vps.golnoor.com with local (Exim 4.95)
(envelope-from <root@vps.golnoor.com>)
id 1or6BV-0006DH-Ps
for root@vps.golnoor.com;
Sat, 05 Nov 2022 03:03:13 +0330
To: root@vps.golnoor.com
Subject: lfd on vps.golnoor.com: Suspicious process running under user dovecot
From: <root@vps.golnoor.com>
Message-Id: <E1or6BV-0006DH-Ps@vps.golnoor.com>
Date: Sat, 05 Nov 2022 03:03:13 +0330
X-YourOrg-MailScanner-Information: Please contact the ISP for more information
X-YourOrg-MailScanner-ID: 1or6BV-0006DH-Ps
X-YourOrg-MailScanner: Found to be clean
X-YourOrg-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=0.811, required 5, DKIM_ADSP_NXDOMAIN 0.80,
KAM_DMARC_STATUS 0.01, URIBL_BLOCKED 0.00)
X-YourOrg-MailScanner-From: root@vps.golnoor.com
X-Spam-Status: No
Time: Sat Nov 5 03:03:13 2022 +0330
PID: 23577 (Parent PID:21241)
Account: dovecot
Uptime: 154 seconds
Executable:
/usr/libexec/dovecot/auth
Command Line (often faked in exploits):
dovecot/auth
Network connections by the process (if any):
tcp: 127.0.0.1:33510 -> 127.0.0.1:579
Files open by the process (if any):
/dev/null
/dev/urandom
/dev/null
anon_inode:[eventpoll]
/run/dovecot/old-stats-user
Memory maps by the process (if any):
558ccb474000-558ccb4d3000 r-xp 00000000 fd:00 1053332 /usr/libexec/dovecot/auth
558ccb6d3000-558ccb6d6000 r--p 0005f000 fd:00 1053332 /usr/libexec/dovecot/auth
558ccb6d6000-558ccb6d8000 rw-p 00062000 fd:00 1053332 /usr/libexec/dovecot/auth
558cccedd000-558cccf27000 rw-p 00000000 00:00 0 [heap]
7f6f953d0000-7f6f953e7000 r-xp 00000000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6f953e7000-7f6f955e6000 ---p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6f955e6000-7f6f955e7000 r--p 00016000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6f955e7000-7f6f955e8000 rw-p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f6f955e8000-7f6f955ec000 rw-p 00000000 00:00 0
7f6f955ec000-7f6f956ed000 r-xp 00000000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6f956ed000-7f6f958ec000 ---p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6f958ec000-7f6f958ed000 r--p 00100000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6f958ed000-7f6f958ee000 rw-p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f6f958ee000-7f6f95903000 r-xp 00000000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6f95903000-7f6f95b02000 ---p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6f95b02000-7f6f95b03000 r--p 00014000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6f95b03000-7f6f95b04000 rw-p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f6f95b04000-7f6f95c1a000 r-xp 00000000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6f95c1a000-7f6f95e1a000 ---p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6f95e1a000-7f6f95e1d000 r--p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6f95e1d000-7f6f95e20000 rw-p 00119000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f6f95e20000-7f6f95e21000 rw-p 00000000 00:00 0
7f6f95e21000-7f6f95e25000 r-xp 00000000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6f95e25000-7f6f96024000 ---p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6f96024000-7f6f96025000 r--p 00003000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6f96025000-7f6f96026000 rw-p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f6f96026000-7f6f96029000 r-xp 00000000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6f96029000-7f6f96228000 ---p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6f96228000-7f6f96229000 r--p 00002000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6f96229000-7f6f9622a000 rw-p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f6f9622a000-7f6f962e2000 r-xp 00000000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6f962e2000-7f6f964e2000 ---p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6f964e2000-7f6f964e4000 r--p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6f964e4000-7f6f964e5000 rw-p 000ba000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f6f964e5000-7f6f964e9000 rw-p 00000000 00:00 0
7f6f964e9000-7f6f964ed000 r-xp 00000000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6f964ed000-7f6f966ed000 ---p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6f966ed000-7f6f966ee000 r--p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6f966ee000-7f6f966ef000 rw-p 00005000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f6f966ef000-7f6f9670d000 r-xp 00000000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6f9670d000-7f6f9690c000 ---p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6f9690c000-7f6f9690d000 r--p 0001d000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6f9690d000-7f6f9690e000 rw-p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f6f9690e000-7f6f96918000 rw-p 00000000 00:00 0
7f6f96918000-7f6f9691a000 r-xp 00000000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6f9691a000-7f6f96b19000 ---p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6f96b19000-7f6f96b1a000 r--p 00001000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6f96b1a000-7f6f96b1b000 rw-p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f6f96b1b000-7f6f96cdf000 r-xp 00000000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6f96cdf000-7f6f96ede000 ---p 001c4000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6f96ede000-7f6f96ee2000 r--p 001c3000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6f96ee2000-7f6f96ee4000 rw-p 001c7000 fd:00 3407 /usr/lib64/libc-2.17.so
7f6f96ee4000-7f6f96ee9000 rw-p 00000000 00:00 0
7f6f96ee9000-7f6f96ef6000 r-xp 00000000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6f96ef6000-7f6f970f6000 ---p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6f970f6000-7f6f970f7000 r--p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6f970f7000-7f6f970f8000 rw-p 0000e000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f6f970f8000-7f6f97100000 r-xp 00000000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6f97100000-7f6f972ff000 ---p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6f972ff000-7f6f97300000 r--p 00007000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6f97300000-7f6f97301000 rw-p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f6f97301000-7f6f9732f000 rw-p 00000000 00:00 0
7f6f9732f000-7f6f97331000 r-xp 00000000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6f97331000-7f6f97531000 ---p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6f97531000-7f6f97532000 r--p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6f97532000-7f6f97533000 rw-p 00003000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f6f97533000-7f6f976e7000 r-xp 00000000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6f976e7000-7f6f978e6000 ---p 001b4000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6f978e6000-7f6f978ef000 r--p 001b3000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6f978ef000-7f6f978f1000 rw-p 001bc000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f6f978f1000-7f6f978f4000 rw-p 00000000 00:00 0
7f6f978f4000-7f6f978f5000 r-xp 00000000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6f978f5000-7f6f97af5000 ---p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6f97af5000-7f6f97af6000 r--p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6f97af6000-7f6f97af7000 rw-p 00002000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f6f97af7000-7f6f97b19000 r-xp 00000000 fd:00 3400 /usr/lib64/ld-2.17.so
7f6f97d06000-7f6f97d0b000 rw-p 00000000 00:00 0
7f6f97d16000-7f6f97d18000 rw-p 00000000 00:00 0
7f6f97d18000-7f6f97d19000 r--p 00021000 fd:00 3400 /usr/lib64/ld-2.17.so
7f6f97d19000-7f6f97d1a000 rw-p 00022000 fd:00 3400 /usr/lib64/ld-2.17.so
7f6f97d1a000-7f6f97d1b000 rw-p 00000000 00:00 0
7fff10946000-7fff10967000 rw-p 00000000 00:00 0 [stack]
7fff10967000-7fff10969000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
--1667604796-eximdsn-1299040236--