5quidhost and IMAP bandwidth

[RogerS]

Real oddball, this one. Feb 4th I get an automated email from them telling me that my monthly bandwidth quota (500MB) has been used by 80%. Feb 5th my site is down. Not even any cpanel access. OK - quickly resolved by 5quidhost as they doubled my bandwidth quota.

But I could not see why. On looking into the bandwidth logs for Feb 3rd and 4th, it shows that IMAP used 200MB on the 3rd and 300MB on the 4th.

Yet I have received no emails in February nor have I sent any.

So how/what/why can rack up that amount of bandwidth?

There is nothing in the webmail logs for February either and so it's not a question of me missing something on my Mac mail program.

Bizarre.

Does anyone have any ideas?

 

[mseries]

Does the bandwidth include the general public viewing your webpages ?
Have you got a phone or tablet or something checking for messages every minute ?

 

[RogerS]

Does the bandwidth include the general public viewing your webpages ?

No...this figure was just IMAP

Have you got a phone or tablet or something checking for messages every minute ?

No but I like your lateral thinking.

These were two massive spikes on just those two days. Normal IMAP might be 10MB for the whole month!

 

[mseries]

might have been something trying to hack your site

 

[Eric The Viking]

+1 for a hacking attack.

IMAP uses ports 143 & 993: Check the logs.

 

[RogerS]

+1 for a hacking attack.

IMAP uses ports 143 & 993: Check the logs.

I would if ..

(a) I knew where to look and

(b) what I was looking for!

 

[RogerS]

OK...looking at the available Raw Access Logs available to me, I see two identical listings on Feb 1 and Feb 3 which IIRC coincide with the dates of the two spikes. Looks to me very much a brute force attack. Or at least an attempt at trying to get in.

5.189.166.34 - - [01/Feb/2016:17:34:01 +0000] "GET /wp-login.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
5.189.166.34 - - [01/Feb/2016:17:34:01 +0000] "GET /administrator/index.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
5.189.166.34 - - [01/Feb/2016:17:34:01 +0000] "GET /admin.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
5.189.166.34 - - [01/Feb/2016:17:34:01 +0000] "GET /bitrix/admin/index.php?lang=en HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
5.189.166.34 - - [01/Feb/2016:17:34:01 +0000] "GET /admin/login.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
5.189.166.34 - - [01/Feb/2016:17:34:01 +0000] "GET /admin/ HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
5.189.166.34 - - [01/Feb/2016:17:34:01 +0000] "GET /user/ HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"

Comments welcome

EDIT: Yup. This block of code goes back to at least 2011 and is an attempt to guess what system is behind the website...Joomla, Wordpress etc.

Have blocked the IP address.

EDIT EDIT : yup, and that IP address has already been picked up. https://www.blocklist.de/en/view.html?i ... .34&page=1

So now all they need to do is go and get the PC of the user with that IP address and confiscate it as the owner is clearly too lazy/stupid/ignorant to run proper anti-malware.

 

[RogerS]

Mmmm.....misinterpretaion on my part.

These logs show http traffic and not IMAP traffic. So no further forward but perhaps reasonable to assume that the IMAP peaks were part of a brute force attack.

 

[Eric The Viking]

Two different sorts of attack: the http stuff was trying to get admin control of your web site (to embed nasties in your web pages). The IMAP stuff was (probably) trying to use your email capability as a mail relay so as to forward nasty emails with links to viruses, etc.

To achieve the bandwidth use claimed on IMAP port(s), it would have included graphics probably - at a guess the same message send would have been attempted using a raft of logins and ip addresses hoping to get lucky.

 

[RogerS]

.....The IMAP stuff was (probably) trying to use your email capability as a mail relay so as to forward nasty emails with links to viruses, etc.

To achieve the bandwidth use claimed on IMAP port(s), it would have included graphics probably - at a guess the same message send would have been attempted using a raft of logins and ip addresses hoping to get lucky.

How would it do that ...use my email as a mail relay? They'd have to be able to log into my email address there and then forward the incoming emails. They would then be seen in the logs. Unless they then went ahead and deleted just those emails that they forwarded...which seems a lot of effort. Why not just delete the whole inbox.

 

[RogerS]

SORTED !!!!

After a bit of Googling, it would seem that some IMAP clients can get their knickers in a twist. So I went into the iMac system logs to see if they could shed any light. Over a hundred of them, all looping round in Apple Mail trying or actually accessing the email account in question. Constantly. Every second.

And because there is no new mail to report, nothing of note appears in the Inbox.

Now to find out how to stop that. The other IMAP client on Apple Mail I have is behaving perfectly.

 

[Eric The Viking]

Well, one lives and learns

 

[mseries]

SORTED !!!!

After a bit of Googling, it would seem that some IMAP clients can get their knickers in a twist. So I went into the iMac system logs to see if they could shed any light. Over a hundred of them, all looping round in Apple Mail trying or actually accessing the email account in question. Constantly. Every second.

And because there is no new mail to report, nothing of note appears in the Inbox.

Now to find out how to stop that. The other IMAP client on Apple Mail I have is behaving perfectly.

So was I on the right track when I asked about email clients checking very frequently ?

 

[RogerS]

SORTED !!!!

After a bit of Googling, it would seem that some IMAP clients can get their knickers in a twist. So I went into the iMac system logs to see if they could shed any light. Over a hundred of them, all looping round in Apple Mail trying or actually accessing the email account in question. Constantly. Every second.

And because there is no new mail to report, nothing of note appears in the Inbox.

Now to find out how to stop that. The other IMAP client on Apple Mail I have is behaving perfectly.

So was I on the right track when I asked about email clients checking very frequently ?

You certainly were. Or in this case constantly!!