But those queued mails were from the contacto mail account?
I don’t know but looks like the server is not compromised, only the mail account.
I see on logs some loggins but those I guess are from me, not IP showed but showed as secured loggin, I see other failed attempts from other IP showing their logins failed…
About the emails on queue I deleted for the email address I saw there they were sent from my domain email.
Look @sahsanu
tail /var/log/dovecot.log
Mar 29 16:04:56 imap-login: Info: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=13919, secured, session=<hCY+5StOyN0AAAAAAAAAAAAAAAAAAAAB>
Mar 29 16:04:56 imap([email protected])<13919><hCY+5StOyN0AAAAAAAAAAAAAAAAAAAAB>: Info: Disconnected: Logged out in=300 out=693 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0
Mar 29 16:04:57 imap-login: Info: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=13921, secured, session=<2y9G5StO0t0AAAAAAAAAAAAAAAAAAAAB>
Mar 29 16:04:57 imap([email protected])<13921><2y9G5StO0t0AAAAAAAAAAAAAAAAAAAAB>: Info: Disconnected: Logged out in=558 out=6401 deleted=0 expunged=0 trashed=0 hdr_count=9 hdr_bytes=3183 body_count=0 body_bytes=0
Mar 29 16:05:00 imap-login: Info: Login: user=<[email protected]>, method=PLAIN, rip=::1, lip=::1, mpid=13923, secured, session=<EPpx5StOeL0AAAAAAAAAAAAAAAAAAAAB>
Mar 29 16:05:00 imap([email protected])<13923><EPpx5StOeL0AAAAAAAAAAAAAAAAAAAAB>: Info: Disconnected: Logged out in=571 out=6542 deleted=0 expunged=0 trashed=0 hdr_count=9 hdr_bytes=3210 body_count=0 body_bytes=0
Mar 29 16:11:13 auth: Info: passwd-file([email protected],165.140.216.237): Password mismatch
Mar 29 16:18:49 auth: Info: passwd-file([email protected],94.72.114.138): Password mismatch
Mar 29 16:18:55 auth: Info: passwd-file([email protected],94.72.114.138): Password mismatch
Mar 29 16:19:02 auth: Info: passwd-file([email protected],94.72.114.138): Password mismatch
tail /var/log/exim4/mainlog
2026-03-29 15:38:32 1w6BVk-0035Z7-0S Completed
2026-03-29 16:07:04 Start queue run: pid=14479
2026-03-29 16:07:04 End queue run: pid=14479
2026-03-29 16:10:43 no host name found for IP address 165.140.216.228
2026-03-29 16:11:12 no host name found for IP address 165.140.216.237
2026-03-29 16:11:15 dovecot_plain authenticator failed for (localhost) [165.140.216.237]: 535 Incorrect authentication data ([email protected])
2026-03-29 16:18:51 dovecot_plain authenticator failed for vmi2396000.contaboserver.net [94.72.114.138]: 535 Incorrect authentication data ([email protected])
2026-03-29 16:18:57 dovecot_login authenticator failed for vmi2396000.contaboserver.net [94.72.114.138]: 535 Incorrect authentication data ([email protected])
2026-03-29 16:19:04 dovecot_plain authenticator failed for vmi2396000.contaboserver.net [94.72.114.138]: 535 Incorrect authentication data ([email protected])
2026-03-29 16:19:04 TLS error on connection from vmi2396000.contaboserver.net [94.72.114.138] (recv): The TLS connection was non-properly terminated.
Ok, good news, the spammers can’t login to either Exim or Dovecot and Roundcube.
Just in case, execute this command and pay attention to active sessions for your contacto account and the IPs used.
mariadb -uroot -se "SELECT ip, vars FROM roundcube.session;" | while read ip vars; do; user=$(echo "$vars" | base64 -d 2>/dev/null | sed -n 's/.*username|s:[0-9]\+:"\([^"]\+\)".*/\1/p');if [ ! -z "$user" ]; then echo "$ip | $user"; fi; done | grep contacto
It’s ok if no output or the IP is your own IP.
I got: bash: syntax error near unexpected token `;’
Double check that you are copy/pasting the entire line correctly. It works fine on all my servers.
I’m using zsh and it allows ; after do. For bash use this one:
mariadb -uroot -se "SELECT ip, vars FROM roundcube.session;" | while read ip vars; do user=$(echo "$vars" | base64 -d 2>/dev/null | sed -n 's/.*username|s:[0-9]\+:"\([^"]\+\)".*/\1/p');if [ ! -z "$user" ]; then echo "$ip | $user"; fi; done | grep contacto
Thanks @sahsanu , it works now, currently, there is no output… in the meantime, I’m changing passwords everywhere, just in case hehe…
Thanks again @sahsanu , I have been monitoring and attempts still happend, exim logs of email sent stop on March 28th as last day, and success logins also shows only mines, I have even suspend that email between yesterday and today and I still can only see logins I performed based on date and hour. I have also tail to exim logs and dovecot and attempts shows there as failed, all good by now. 