> I was reviewing my flow records and I can see in the last 24h we have > started doing a much larger amount of POP3 traffic to Microsoft than > usual. As an example, some of the IP's that are making the POP3 > connections are:
Yes, we started seeing these logins from around April 18th. Some users have gone from 5MB a day of POP traffic to 25GB per day :-\ May 5 17:31:52 server dovecot: pop3-login: Login: user=<u...@domain.com>, method=PLAIN, rip=40.100.16.125, lip=45.xx.xx.xx, mpid=294947, session=<7VRKwRMytG4oZBB9> May 5 17:31:52 server dovecot: pop3(u...@domain.com): Disconnected: Logged out top=0/0, retr=0/0, del=0/512, size=223773360, bytes=24/12306 May 5 17:32:17 server dovecot: pop3-login: Login: user=<u...@domain.com>, method=PLAIN, rip=40.100.16.125, lip=45.xx.xx.xx, mpid=295053, session=<gaDKwhMypNUoZBB9> May 5 17:40:34 server dovecot: pop3(u...@domain.com): Disconnected: Logged out top=2/3772, retr=1024/447566492, del=0/512, size=223773360, bytes=10074/447591247 Cheers, Joseph _______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
