You'd think some rDNS, but... It's not Azure. I have no idea, sorry.
But by virtue of the, "admin" I'd want whomever owns that domain to be advised? It might be some Dev doing something with their own mailbox, or ... I have no idea, sorry. Aloha, Michael. -- Sent from my Windows Phone ________________________________ From: Chris via mailop<mailto:mailop@mailop.org> Sent: 5/4/2016 10:53 PM To: mailop@mailop.org<mailto:mailop@mailop.org> Subject: [mailop] Microsoft POP3 Troubles Hi all, Not sure if this is the right list to post this to. I was reviewing my flow records and I can see in the last 24h we have started doing a much larger amount of POP3 traffic to Microsoft than usual. As an example, some of the IP's that are making the POP3 connections are: 40.96.25.117 40.100.0.132 40.100.1.237 40.96.18.165 40.96.47.101 40.96.2.53 40.96.15.165 40.100.2.29 I have reviewed the mail server logs on my end and found that it looks like these IP's are grabbing complete copies of the same mailbox over and over again. I have put an example of the pop3 logs from dovecot below from one of our servers which show the repeated downloads. For this particular domain the user has 1.7GB of emails total in all mailboxes but I can see in the last 24H Microsoft has downloaded the mailbox multiple times totalling over 180GB... I am not exactly sure what on the MS end these IP's belong to and I am not sure what the customers have setup, I am waiting to hear back from a few. This is happening across a bunch of different servers on different mailboxes. I would be interested to hear if anyone else has experienced this recently, it appears to still be happening now. May 5 04:31:36 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 04:56:21 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=442, session=<4FwzdQoylAkoYBKl> May 5 04:56:21 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 04:56:25 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=475, session=<daVwdQoyFLQoYBKl> May 5 05:03:29 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 05:20:03 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=37159, session=<ZWf3yQoyzAwoYBKl> May 5 05:20:03 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 05:20:06 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=37344, session=<l5koygoylnsoYBKl> May 5 05:25:53 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 05:47:11 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=89853, session=<jk4FKwsys0EoYBKl> May 5 05:47:12 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 05:47:15 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=89886, session=<WO1GKwsycW8oYBKl> May 5 05:54:00 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 06:16:53 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=127954, session=<Poc+lQsyWj8oYBKl> May 5 06:16:54 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 06:16:58 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=128036, session=<aqaIlQsysNcoYBKl> May 5 06:22:31 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 06:51:20 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=170010, session=<XFBuEAwyiZ8oYBKl> May 5 06:51:20 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 06:51:29 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=170137, session=<b8vyEAwyfk4oYBKl> May 5 06:58:51 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 07:24:25 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=211166, session=<WCW/hgwyaFwoYBKl> May 5 07:24:25 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 07:24:39 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=211461, session=<P12ZhwwyqzcoYBKl> May 5 07:32:22 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 07:55:49 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=254377, session=<Ff8F9wwyPPIoYBKl> May 5 07:55:49 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 07:55:52 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=254460, session=<71489wwyBSMoYBKl> May 5 08:04:11 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 08:29:37 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=316387, session=<8H7qbw0y1OQoYBKl> May 5 08:29:37 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 08:29:41 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=316465, session=<1FYpcA0y6g4oYBKl> May 5 08:38:40 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 09:03:51 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=366954, session=<sYtf6g0yhSEoYBKl> May 5 09:03:52 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 09:03:55 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=367047, session=<oBWR6g0yyQwoYBKl> May 5 09:11:21 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 09:35:21 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=413154, session=<09cBWw4yhw4oYBKl> May 5 09:35:21 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 09:35:24 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=413226, session=<Kz8yWw4yx+goYBKl> May 5 09:45:18 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 10:04:12 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=476411, session=<sHgswg4ydJkoYBKl> May 5 10:04:12 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 10:04:16 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=476495, session=<rGxqwg4y7TcoYBKl> May 5 10:14:11 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 10:33:16 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=520754, session=<hKwjKg8yMVMoYBKl> May 5 10:33:17 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 10:33:20 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=520858, session=<3edaKg8y5wgoYBKl> May 5 10:40:42 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 11:03:59 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=565412, session=<2az9lw8yH6AoYBKl> May 5 11:04:00 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 11:04:02 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=565489, session=<N9ovmA8yEyQoYBKl> May 5 11:10:45 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 11:31:20 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=603446, session=<w/HG+Q8yrMcoYBKl> May 5 11:31:20 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 May 5 11:31:23 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=603508, session=<1IP/+Q8y0o8oYBKl> May 5 11:39:23 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=2/2831, retr=2204/957869252, del=0/1102, size=478908339, bytes=22081/957917270 May 5 11:58:34 server47 dovecot: pop3-login: Login: user=<admin@XXXXX>, method=PLAIN, rip=40.96.18.165, lip=27.124.XXX.XX, mpid=642418, session=<GrEzWxAyjMMoYBKl> May 5 11:58:35 server47 dovecot: pop3(admin@XXXXX): Disconnected: Logged out top=0/0, retr=0/0, del=0/1102, size=478908339, bytes=24/25908 _______________________________________________ mailop mailing list mailop@mailop.org https://na01.safelinks.protection.outlook.com/?url=https%3a%2f%2fchilli.nosignal.org%2fcgi-bin%2fmailman%2flistinfo%2fmailop&data=01%7c01%7cmichael.wise%40microsoft.com%7ca5e8bf1bf4c24afded0908d374a98c36%7c72f988bf86f141af91ab2d7cd011db47%7c1&sdata=UHGzPFm9Ya717symr%2fnUXsoMb8nECn1sqQH21I46SxM%3d
_______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
