File: /home/golnoor/mail/golnoor.com/root/cur/1668059196.M789645P12308.vps.golnoor.com,S=9811,W=9957:2,
Return-Path: <root@vps.golnoor.com>
Delivered-To: root@golnoor.com
Received: from vps.golnoor.com
by vps.golnoor.com with LMTP
id h1U4LjyQbGMUMAAA/P5FDA
(envelope-from <root@vps.golnoor.com>)
for <root@golnoor.com>; Thu, 10 Nov 2022 09:16:36 +0330
Return-path: <root@vps.golnoor.com>
Envelope-to: root@vps.golnoor.com
Delivery-date: Thu, 10 Nov 2022 09:16:36 +0330
Received: from root by vps.golnoor.com with local (Exim 4.95)
(envelope-from <root@vps.golnoor.com>)
id 1ot0OY-0003CD-Sq
for root@vps.golnoor.com;
Thu, 10 Nov 2022 09:16:34 +0330
To: root@vps.golnoor.com
Subject: lfd on vps.golnoor.com: Suspicious process running under user dovecot
From: <root@vps.golnoor.com>
Message-Id: <E1ot0OY-0003CD-Sq@vps.golnoor.com>
Date: Thu, 10 Nov 2022 09:16:34 +0330
X-YourOrg-MailScanner-Information: Please contact the ISP for more information
X-YourOrg-MailScanner-ID: 1ot0OY-0003CD-Sq
X-YourOrg-MailScanner: Found to be clean
X-YourOrg-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=0.811, required 5, DKIM_ADSP_NXDOMAIN 0.80,
KAM_DMARC_STATUS 0.01, URIBL_BLOCKED 0.00)
X-YourOrg-MailScanner-From: root@vps.golnoor.com
X-Spam-Status: No
Time: Thu Nov 10 09:16:34 2022 +0330
PID: 12099 (Parent PID:21241)
Account: dovecot
Uptime: 148 seconds
Executable:
/usr/libexec/dovecot/auth
Command Line (often faked in exploits):
dovecot/auth
Network connections by the process (if any):
tcp: 127.0.0.1:38560 -> 127.0.0.1:579
Files open by the process (if any):
/dev/null
/dev/urandom
/dev/null
anon_inode:[eventpoll]
/run/dovecot/old-stats-user
Memory maps by the process (if any):
5623d64c0000-5623d651f000 r-xp 00000000 fd:00 1053332 /usr/libexec/dovecot/auth
5623d671f000-5623d6722000 r--p 0005f000 fd:00 1053332 /usr/libexec/dovecot/auth
5623d6722000-5623d6724000 rw-p 00062000 fd:00 1053332 /usr/libexec/dovecot/auth
5623d7387000-5623d73f1000 rw-p 00000000 00:00 0 [heap]
7f2ee4645000-7f2ee465c000 r-xp 00000000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f2ee465c000-7f2ee485b000 ---p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f2ee485b000-7f2ee485c000 r--p 00016000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f2ee485c000-7f2ee485d000 rw-p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f2ee485d000-7f2ee4861000 rw-p 00000000 00:00 0
7f2ee4861000-7f2ee4962000 r-xp 00000000 fd:00 3417 /usr/lib64/libm-2.17.so
7f2ee4962000-7f2ee4b61000 ---p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f2ee4b61000-7f2ee4b62000 r--p 00100000 fd:00 3417 /usr/lib64/libm-2.17.so
7f2ee4b62000-7f2ee4b63000 rw-p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f2ee4b63000-7f2ee4b78000 r-xp 00000000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f2ee4b78000-7f2ee4d77000 ---p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f2ee4d77000-7f2ee4d78000 r--p 00014000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f2ee4d78000-7f2ee4d79000 rw-p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f2ee4d79000-7f2ee4e8f000 r-xp 00000000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f2ee4e8f000-7f2ee508f000 ---p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f2ee508f000-7f2ee5092000 r--p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f2ee5092000-7f2ee5095000 rw-p 00119000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f2ee5095000-7f2ee5096000 rw-p 00000000 00:00 0
7f2ee5096000-7f2ee509a000 r-xp 00000000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f2ee509a000-7f2ee5299000 ---p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f2ee5299000-7f2ee529a000 r--p 00003000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f2ee529a000-7f2ee529b000 rw-p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f2ee529b000-7f2ee529e000 r-xp 00000000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f2ee529e000-7f2ee549d000 ---p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f2ee549d000-7f2ee549e000 r--p 00002000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f2ee549e000-7f2ee549f000 rw-p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f2ee549f000-7f2ee5557000 r-xp 00000000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f2ee5557000-7f2ee5757000 ---p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f2ee5757000-7f2ee5759000 r--p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f2ee5759000-7f2ee575a000 rw-p 000ba000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f2ee575a000-7f2ee575e000 rw-p 00000000 00:00 0
7f2ee575e000-7f2ee5762000 r-xp 00000000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f2ee5762000-7f2ee5962000 ---p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f2ee5962000-7f2ee5963000 r--p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f2ee5963000-7f2ee5964000 rw-p 00005000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f2ee5964000-7f2ee5982000 r-xp 00000000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f2ee5982000-7f2ee5b81000 ---p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f2ee5b81000-7f2ee5b82000 r--p 0001d000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f2ee5b82000-7f2ee5b83000 rw-p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f2ee5b83000-7f2ee5b8d000 rw-p 00000000 00:00 0
7f2ee5b8d000-7f2ee5b8f000 r-xp 00000000 fd:00 2556 /usr/lib64/libfreebl3.so
7f2ee5b8f000-7f2ee5d8e000 ---p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f2ee5d8e000-7f2ee5d8f000 r--p 00001000 fd:00 2556 /usr/lib64/libfreebl3.so
7f2ee5d8f000-7f2ee5d90000 rw-p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f2ee5d90000-7f2ee5f54000 r-xp 00000000 fd:00 3407 /usr/lib64/libc-2.17.so
7f2ee5f54000-7f2ee6153000 ---p 001c4000 fd:00 3407 /usr/lib64/libc-2.17.so
7f2ee6153000-7f2ee6157000 r--p 001c3000 fd:00 3407 /usr/lib64/libc-2.17.so
7f2ee6157000-7f2ee6159000 rw-p 001c7000 fd:00 3407 /usr/lib64/libc-2.17.so
7f2ee6159000-7f2ee615e000 rw-p 00000000 00:00 0
7f2ee615e000-7f2ee616b000 r-xp 00000000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f2ee616b000-7f2ee636b000 ---p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f2ee636b000-7f2ee636c000 r--p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f2ee636c000-7f2ee636d000 rw-p 0000e000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f2ee636d000-7f2ee6375000 r-xp 00000000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f2ee6375000-7f2ee6574000 ---p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f2ee6574000-7f2ee6575000 r--p 00007000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f2ee6575000-7f2ee6576000 rw-p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f2ee6576000-7f2ee65a4000 rw-p 00000000 00:00 0
7f2ee65a4000-7f2ee65a6000 r-xp 00000000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f2ee65a6000-7f2ee67a6000 ---p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f2ee67a6000-7f2ee67a7000 r--p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f2ee67a7000-7f2ee67a8000 rw-p 00003000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f2ee67a8000-7f2ee695c000 r-xp 00000000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f2ee695c000-7f2ee6b5b000 ---p 001b4000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f2ee6b5b000-7f2ee6b64000 r--p 001b3000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f2ee6b64000-7f2ee6b66000 rw-p 001bc000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f2ee6b66000-7f2ee6b69000 rw-p 00000000 00:00 0
7f2ee6b69000-7f2ee6b6a000 r-xp 00000000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f2ee6b6a000-7f2ee6d6a000 ---p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f2ee6d6a000-7f2ee6d6b000 r--p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f2ee6d6b000-7f2ee6d6c000 rw-p 00002000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f2ee6d6c000-7f2ee6d8e000 r-xp 00000000 fd:00 3400 /usr/lib64/ld-2.17.so
7f2ee6f7b000-7f2ee6f80000 rw-p 00000000 00:00 0
7f2ee6f8b000-7f2ee6f8d000 rw-p 00000000 00:00 0
7f2ee6f8d000-7f2ee6f8e000 r--p 00021000 fd:00 3400 /usr/lib64/ld-2.17.so
7f2ee6f8e000-7f2ee6f8f000 rw-p 00022000 fd:00 3400 /usr/lib64/ld-2.17.so
7f2ee6f8f000-7f2ee6f90000 rw-p 00000000 00:00 0
7fff710b0000-7fff710d1000 rw-p 00000000 00:00 0 [stack]
7fff711b5000-7fff711b7000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]