Server emitting phish spam to steal access credentials, probably thanks to a compromised password.
Problem started around Thu, 28 Oct 2021 23:30 UTC, still going on on Sun, 31 Oct 2021.
The compromised machine appears to be 192.241.214.14, but the spam is delivered through 138.201.176.89.
mx1.librem.one. 300 IN A 138.201.176.94 (source is .89)
smtp.librem.one. 300 IN A 192.241.214.14
==============================================================================
Return-Path: <kin76@librem.one>
Received: from mx1.librem.one (HELO mx1.librem.one) (138.201.176.89)
by x (x) with (AES256-SHA encrypted) ESMTPS; Fri, 29 Oct 2021 xx:xx:xx +0000
Received: from smtp.librem.one (unknown [192.241.214.14])
by mx1.librem.one (Postfix) with ESMTPS id x;
Fri, 29 Oct 2021 xx:xx:xx -0700 (PDT)
Content-Type: multipart/alternative; boundary=»===============x==»
Subject: Your mailbox quota is almost full.
To: Recipients <kin76@librem.one>
From: Mail System Administrator <kin76@librem.one>
Date: Fri, 29 Oct 2021 xx:xx:xx +0000
Your mailbox quota is almost full. Do this now in order to prevent your account from being blocked.
Click <A href=»https://tearbelt.com/Dox/ge/1/»>Login Here</A> to reduce size automatically, so that all pending mails can be delivered to you. Dear User
3840MB 4096MB
Current size Maximum size
Thanks, Mail System Administrator This notification was sent to you Unsubscribe now.