lihtian Absent Member.
Absent Member.
1452 views

POP3 Command

Recently, i have some weird "pop3 command" in my GWIA log file. I suspected this is causing by spammer and i have been disabled pop3 after that.

Anyone have the same issue?

Below is the sample log i copied out from GWIA log:

06:29:04 264 POP3 command: PASS
06:29:05 264 POP3 command: user webpop
06:29:05 264 POP3 command: PASS
06:29:05 264 POP3 command: user technicom
06:29:05 264 POP3 command: PASS
06:29:06 264 POP3 command: user susan
06:29:06 264 POP3 command: PASS
06:29:06 264 POP3 command: user sunsun
06:29:06 264 POP3 command: PASS
06:29:07 264 POP3 command: user sunny
06:29:07 264 POP3 command: PASS
06:29:07 264 POP3 command: user steven
06:29:07 264 POP3 command: PASS
06:29:08 264 POP3 command: user search
06:29:08 264 POP3 command: PASS
06:29:08 264 POP3 command: user sara
06:29:08 264 POP3 command: PASS
06:29:09 264 POP3 command: user robert
06:29:09 264 POP3 command: PASS
06:29:09 264 POP3 command: user richard
06:29:09 264 POP3 command: PASS
06:29:10 264 POP3 command: user postmaster
06:29:10 264 POP3 command: PASS
06:29:10 264 POP3 command: user party
06:29:10 264 POP3 command: PASS
06:29:11 264 POP3 command: user michael
06:29:11 264 POP3 command: PASS
06:29:11 264 POP3 command: user amanda
06:29:11 264 POP3 command: PASS
06:29:12 264 POP3 command: user mysql
06:29:12 264 POP3 command: PASS
06:29:12 264 POP3 command: user rpm
06:29:12 264 POP3 command: PASS
06:29:13 264 POP3 command: user operator
06:29:13 264 POP3 command: PASS
06:29:13 264 POP3 command: user sgi
06:29:13 264 POP3 command: PASS
06:29:14 264 POP3 command: user Aaliyah
06:29:14 264 POP3 command: PASS
06:29:14 264 POP3 command: user Aaron
06:29:14 264 POP3 command: PASS
06:29:15 264 POP3 command: user Aba
06:29:15 264 POP3 command: PASS
06:29:15 264 POP3 command: user Abel
06:29:15 264 POP3 command: PASS
06:29:16 264 POP3 command: user Jewel
06:29:16 264 POP3 command: PASS
06:29:16 264 POP3 command: user sshd
06:29:16 264 POP3 command: PASS
06:29:17 264 POP3 command: user users
06:29:17 264 POP3 command: PASS
06:29:17 264 POP3 command: user admins
06:29:17 264 POP3 command: PASS
06:29:18 264 POP3 command: user admins
06:29:18 264 POP3 command: PASS
06:29:18 032 DMN: MSG 10344 Accepted connection:
Labels (2)
0 Likes
1 Reply
Anonymous_User Absent Member.
Absent Member.

Re: POP3 Command

Spammer or some type of attack = yes.

Have the same issue = no.

>>> On 12/30/2009 at 12:56 AM, lihtian<lihtian@no-mx.forums.novell.com>

wrote:

> Recently, i have some weird "pop3 command" in my GWIA log file. I
> suspected this is causing by spammer and i have been disabled pop3 after
> that.
>
> Anyone have the same issue?
>
> Below is the sample log i copied out from GWIA log:
>
> 06:29:04 264 POP3 command: PASS
> 06:29:05 264 POP3 command: user webpop
> 06:29:05 264 POP3 command: PASS
> 06:29:05 264 POP3 command: user technicom
> 06:29:05 264 POP3 command: PASS
> 06:29:06 264 POP3 command: user susan
> 06:29:06 264 POP3 command: PASS
> 06:29:06 264 POP3 command: user sunsun
> 06:29:06 264 POP3 command: PASS
> 06:29:07 264 POP3 command: user sunny
> 06:29:07 264 POP3 command: PASS
> 06:29:07 264 POP3 command: user steven
> 06:29:07 264 POP3 command: PASS
> 06:29:08 264 POP3 command: user search
> 06:29:08 264 POP3 command: PASS
> 06:29:08 264 POP3 command: user sara
> 06:29:08 264 POP3 command: PASS
> 06:29:09 264 POP3 command: user robert
> 06:29:09 264 POP3 command: PASS
> 06:29:09 264 POP3 command: user richard
> 06:29:09 264 POP3 command: PASS
> 06:29:10 264 POP3 command: user postmaster
> 06:29:10 264 POP3 command: PASS
> 06:29:10 264 POP3 command: user party
> 06:29:10 264 POP3 command: PASS
> 06:29:11 264 POP3 command: user michael
> 06:29:11 264 POP3 command: PASS
> 06:29:11 264 POP3 command: user amanda
> 06:29:11 264 POP3 command: PASS
> 06:29:12 264 POP3 command: user mysql
> 06:29:12 264 POP3 command: PASS
> 06:29:12 264 POP3 command: user rpm
> 06:29:12 264 POP3 command: PASS
> 06:29:13 264 POP3 command: user operator
> 06:29:13 264 POP3 command: PASS
> 06:29:13 264 POP3 command: user sgi
> 06:29:13 264 POP3 command: PASS
> 06:29:14 264 POP3 command: user Aaliyah
> 06:29:14 264 POP3 command: PASS
> 06:29:14 264 POP3 command: user Aaron
> 06:29:14 264 POP3 command: PASS
> 06:29:15 264 POP3 command: user Aba
> 06:29:15 264 POP3 command: PASS
> 06:29:15 264 POP3 command: user Abel
> 06:29:15 264 POP3 command: PASS
> 06:29:16 264 POP3 command: user Jewel
> 06:29:16 264 POP3 command: PASS
> 06:29:16 264 POP3 command: user sshd
> 06:29:16 264 POP3 command: PASS
> 06:29:17 264 POP3 command: user users
> 06:29:17 264 POP3 command: PASS
> 06:29:17 264 POP3 command: user admins
> 06:29:17 264 POP3 command: PASS
> 06:29:18 264 POP3 command: user admins
> 06:29:18 264 POP3 command: PASS
> 06:29:18 032 DMN: MSG 10344 Accepted connection:

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.