I just received an email that corresponds to the description here, which was posted just a couple of hours ago:


Since the sender was was [email protected], might someone have logged into my Ubuntu server, or was the email simply sent to the email service on my server, in which case it's just spam.

I couldn't find any evidence of unknown logins using last or in syslog, but there are an insane amount of these in syslog today:

postfix/smtpd[24558]: connect from jackofallthreads.co[]
postfix/smtpd[24558]: lost connection after UNKNOWN from jackofallthreads.co[]
postfix/smtpd[24558]: disconnect from jackofallthreads.co[]

SSH login to my server requires a private key, and root login is disabled.

EDIT: Here is the email's Delivered history. Note I have email forward from $ME@$MYDOMAIN to [email protected]. How can glean from this whether my server was compromised?

Delivered-To: [email protected]
Received: by $SOMEIP with SMTP id $ID;
Received: from localhost ($MYHOSTNAME. [$MYIP])
        by mx.google.com with ESMTP id $ID
        for <[email protected]>;
Received-SPF: neutral (google.com: $MYIP is neither ... admin@$MYDOMAIN) client-ip=$MYIP;
Authentication-Results: mx.google.com;
       spf=neutral (google.com: $MYIP is neither ... admin@$MYDOMAIN) smtp.mailfrom=admin@MYDOMAIN
Received: from [$SOMEIP] (unknown [$SOMEIP])
    by localhost (Postfix) with ESMTP id $ID
    for <$ME@$MYDOMAIN>; $DATE
  • 3
    Anybody can set any email address in the From:-line of an email. The address in itself is not grounds for worry.
    – Jenny D
    Mar 17, 2016 at 15:03
  • If you want to be sure, do the usual reactionary stuff. Change all your passwords to the server / webhost, check your server for any newly created files and make sure you or someone else with access can account for their creation, and keep a close eye on the logs at times someone might assume you normally wouldn't. Mar 17, 2016 at 15:12
  • If in doubt, preserve your oldest backup (and take if offline) before proceeding. Mar 17, 2016 at 16:52

1 Answer 1


SSH login to my server requires a private key, and root login is disabled.

Is a sensible precaution for ssh.

Since the sender was was [email protected]

If you take precautions for your ssh, do you apply the same to your SMTP? You should at least have SPF configured for your domain. Do you? Is the SPF validated by your receiving MTA? This should prevent you getting emails not from a legitimate source (or at least cut down the noise).

Assuming tat SPF is not working end-to-end for whatever reason, have you checked the email headers to see if it really did originate on your servers? I think it's very unlikely it did, but if this is the case, then you have good reason to suspect that your server or the hosting environment has been compromised.

If not, then think of it as a wee prompt to get your email security sorted out.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .