What the .....? What's this? Weird lines in my mail log...

Discussion in 'Technical' started by 30uke, Jan 23, 2021.

  1. 30uke

    30uke Member HowtoForge Supporter

    Sometimes I see some weird lines in my mail log.
    Who sees lines like these too? It's just weird... It's a jungle out there.
    Code:
    Jan 20 15:58:51 vps2 postfix/submission/smtpd[27907]: warning: non-SMTP command from unknown[159.89.171.117]: GET /system_api.php HTTP/1.1
    Jan 20 15:58:55 vps2 postfix/submission/smtpd[27907]: warning: non-SMTP command from unknown[159.89.171.117]: GET /c/version.js HTTP/1.1
    Jan 20 15:58:59 vps2 postfix/submission/smtpd[27907]: warning: non-SMTP command from unknown[159.89.171.117]: GET /streaming/clients_live.php HTTP/1.1
    Jan 20 15:59:02 vps2 postfix/submission/smtpd[27907]: warning: non-SMTP command from unknown[159.89.171.117]: GET /stalker_portal/c/version.js HTTP/1.1
    Jan 20 15:59:06 vps2 postfix/submission/smtpd[27907]: warning: non-SMTP command from unknown[159.89.171.117]: GET /client_area/ HTTP/1.1
    Jan 20 15:59:10 vps2 postfix/submission/smtpd[27907]: warning: non-SMTP command from unknown[159.89.171.117]: GET /stalker_portal/c/ HTTP/1.1
    
    Jan 22 15:02:02 s2 postfix/smtpd[10857]: warning: hostname 14-scan-andrew.foma-gmail.com does not resolve to address 188.166.157.194: Name or service not known
    Jan 22 17:36:02 s2 postfix/smtpd[17823]: warning: hostname 23-scan-andrew.foma-gmail.com does not resolve to address 143.110.158.81: Name or service not known
    Jan 22 18:27:39 s2 postfix/smtpd[20384]: warning: hostname 46-scan-andrew.foma-gmail.com does not resolve to address 138.197.158.236: Name or service not known
    
     
  2. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Code:
    postfix/submission/smtpd[27907]: warning: non-SMTP command from unknown[159.89.171.117]
    Someone from India is trying to access your host but in a wrong way. Using Internet Search Engines with error message often explains what it means.
    Code:
    warning: hostname 14-scan-andrew.foma-gmail.com does not resolve to address 188.166.157.194:
    Incorrectly configured e-mail server tries to send to your server.
     
  3. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    You can use fail2ban to block the invalid commands; anyone trying HTTP on the SMTP port could be blocked pretty aggressively.
     

Share This Page