I have personally operated a mail server for several years now, hosted on a VPS by Vultr.com with my domain attached. I recently started transitioning from my Gmail address to a personal one on different web services, using the service_name@mydomain.tld template to know, which one leaked my email address, if that ever happens.

Just a week after this change, I received a Logwatch report with incorrect authentication attempts for these new email addresses:

dovecot: auth: passwd-file(service_name2@mydomain.tld): unknown user : 17 Time(s) dovecot: auth: passwd-file(service_name4@mydomain.tld): unknown user : 68 Time(s) dovecot: auth: passwd-file(service_name1@mydomain.tld): unknown user : 16 Time(s) dovecot: auth: passwd-file(service_name5@mydomain.tld): unknown user : 68 Time(s) dovecot: auth: passwd-file(service_name3@mydomain.tld): unknown user : 17 Time(s)

1. The VPS is 100% not compromised (besides, why would anyone brute-force a password to something they already have access to?).

2. All software on the VPS is FOSS and is almost always kept up-to-date; the logs are not shared anywhere (e.g., they're not uploaded to a third-party SaaS for analysis).

3. The listed web services do not provide any public profiles that contain these email addresses.

4. All listed services sent confirmation emails upon the change of email address.

5. Services that did not send confirmation messages are not mentioned in the logs with the authentication attempts.

6. I found no evidence that those services have the same ISP, hosting/cloud provider, or even backbone provider (this was analyzed by tracking SMTP client source IP addresses and network traces to them).

7. All this suggests that the email addresses were harvested from the SMTP traffic to my VPS, either at Vultr's infra level or through one of their network providers in the Amsterdam location.

P.S.: My mail server is configured with STARTTLS support, but for some reason, the SMTP clients of those web services chose to use plain SMTP for the confirmation messages.

user:	tuga
created:	May 8, 2022
karma:	-2