> <i...@anotherdomain.com>: host smx1.web-hosting.com[209.188.21.38] said: 550 > The > sending IP (my dotted quad) is listed on https://spamrl.com as a source of > dictionary attacks. (in reply to end of DATA command)
That would mean that something tried logins against a POP/IMAP/SMTP server -- not necessarily your MTA itself, but some piece of software (it could be a root shell exploit or some abusable piece of Word Press to give you a few ideas!) > Is the "in reply to end of DATA command" significant? I don't think so -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein
