Connection logs
-
I've been hacked a few weeks before but I just found two email error regarding mails I 'sent' to an odd email but that I couldn't find in my "sent" folder.
I'm suspecting another hack even though I have 2FA with OTP. Where can I see logs of connection to my account ?
For the curious, here are the errors
This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address failed: [SUS MAIL]: SMTP error from remote server for TEXT command, host: mx-aol.mail.gm0.yahoodns.net (67.195.204.75) reason: 554 5.7.9 Message not accepted for policy reasons. See https://senders.yah ooinc.com/error-codes --- The header of the original message is following. --- Received: from winhex19beus5.winusa.mail ([10.72.152.13]) by mrieueus.server.lan (mrieueus001 [172.19.150.82]) with ESMTPS (Nemesis) id 0MUX8H-1s7SZM48p9-00REk5 for <[SUS MAIL]>; Tue, 23 Apr 2024 00:53:31 +0200 Received: from [172.245.244.108] (10.72.152.122) by winhex19beus5.winusa.mail (10.72.152.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.1544.9; Mon, 22 Apr 2024 18:53:31 -0400 Content-Type: multipart/mixed; boundary="===============3780880033862187110==" MIME-Version: 1.0 Subject: NetFlix SMTP-1 From: <[my mail]> To: <[SUS MAIL]> Message-ID: <[email protected]> Return-Path: [my mail] Date: Mon, 22 Apr 2024 18:53:31 -0400 X-ClientProxiedBy: winhex19beus5.winusa.mail (10.72.152.13) To winhex19beus5.winusa.mail (10.72.152.13) X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:p78sLy/K7Nc=;vQmN3snz5qYAfvCwnwhfaNTyziK EVa50rWl8OfkdPzd/9+CR/ArOXbn/W17Wp0cDALNdyRRgi+Ko7Gmu34bovx4mV14vCGs9d16Q iQavQ1Q4nG3WZUr7wlsB29rcm1rZQ2qg9n/M4jEJ1q9TfMzW/CjnQCVDLAcPoPRfPc8Cn+ZQt Lht6PJg9czNasv5v3iIyAe9GIVLSrDbDoJW9c5runxe8PeOfFAtOqoNbHtTHhtqtqv2Smtc+/ vzgS+5U5EP3OeckRta8kymU+G2UXRAX2CW8BflXeZ1Nzs0uuryrm9Y12W2F3yyHXsDrRwTDwT 9IWlepefhuzgZmxV2Kzh9RbE8ayREFTWHQvbc2ayzTqQkxEFBLHd0DVQPepH+1WhVT3pgBMtR uZwtmKsJ+1aTN7kBJkFGuRKe4ZbRpt27MUiep5vXSVBNBud2nMfsxl4zccPkYR6YVcXwRdYsU k9Tu7s1m9bl7z6RcpYPWjd3nt8L3sqQq0naq9TWV/XrRHWu27aRgqPpDLQ9E7wE/bBDB3Llg0 rhdYoBpYJ3MtwGCDIrRylymdC58Zj8R3lL7ZnULhgl5kcIhgDI3rJ7BsvroIXAZpNqcx11KKx v68QhJFCCn9Cu7g6+6I7z/m2yqqRI5CtPFSyJHLlcGU94L1EkZ2skpgtQZoSLLZFZeSxHkL67 +CBxoQ/VFE4xvbE0UOZW+iqXsxEOtCEECiEmw6Hm++Xl3DNlAV4BMQVRhqTgwI1bmim7i/tps MnT1Vp8Awd2i4V9iv2nrJv24uLwpnjIo3YIb2gjRmYFo8FlXe06LsU= Reporting-MTA:dns;perfora.net Arrival-Date:Tue, 23 Apr 2024 00:53:31 +0200 Final-Recipient:rfc822;[SUS MAIL] Action:failed Status:5.0.0 Final-Log-ID:0MUX8H-1s7SZM48p9-00REk5This message was created automatically by mail delivery software. A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. The following address failed: [SUS MAIL]: SMTP error from remote server for TEXT command, host: mx-aol.mail.gm0.yahoodns.net (67.195.228.84) reason: 554 5.7.9 Message not accepted for policy reasons. See https://senders.yah ooinc.com/error-codes --- The header of the original message is following. --- Received: from winhex19beus1.winusa.mail ([10.72.152.11]) by mrieueus.server.lan (mrieueus002 [172.19.150.82]) with ESMTPS (Nemesis) id 0LjNFp-1sYgEy1zyR-00dYsM for <[SUS MAIL]>; Tue, 23 Apr 2024 03:08:07 +0200 Received: from [172.245.244.108] (10.72.152.122) by winhex19beus5.winusa.mail (10.72.152.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.1544.9; Mon, 22 Apr 2024 21:08:07 -0400 Content-Type: multipart/mixed; boundary="===============9011073670635861011==" MIME-Version: 1.0 Subject: NetFlix SMTP-1 From: <[my mail]> To: <[SUS MAIL]> Message-ID: <[email protected]> Return-Path: [my mail] Date: Mon, 22 Apr 2024 21:08:07 -0400 X-ClientProxiedBy: winhex19beus1.winusa.mail (10.72.152.11) To winhex19beus5.winusa.mail (10.72.152.13) X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:ErjGTYFni5I=;aVywJO6Y71pL7g8vvoZ7HL1tgxU /avNzRtb1986ZaGy8SGdoIQjcjVg9EWaW8GbJqyhbZsnB4ou4Je6zWd0N/PA2B0h0NiIRy1OQ 8ccOw0o7yww39MPgqOzaasCjiLB9uGoZe23/8V2qfu3HH/mQn3ayBdQ2MbX7Zqp5vx3SX0z6+ v+CQ9w/iZV+0pAh4hxLqTovssTCa5bjMVoRR+aV8v6d1sP/YYMhzWDalitCiVt+UqMeQUCD5d hNfLarY5zLqPxEaVPSlluSOWZ7QnES+cTpgfxfMyVVqYJ6sl7EmoEKUVDhhP6AO2E1kx8hjvY EMdwxadfJ5KgGwaW/5W+Rr9Yf02XGrJMkrS+rmDcW9byKyJS9Olaeo4nGN7Gb4NpBhh41Noyg NMtM5w6iTDqJfGpg8zWeNri3qvHt+7qmnk20spSvjmdUNKbZflYGLpVk8hAv8rZ4Kkd+usIje cdZu7DR+1N70D7bsIOrngMAv5MwTOxX+RODg2/RRbXjRGnQgAdX37CaLXn4Wi8bStlVCRrIDj +QId8O9vcOIl9y/rUo6Y5kGsxeCWdfygo2qm3bzqlWbZL0qm9KU/ausFWT6tYuPTw7/MhG3UM x+zFBQvGFF9EJrDawYbFK/N7+9/IMlPrBCEpXqUvdpKMgxQLF/E2A3Douq4hzFZJfDVIr75SU 2BSyiUpJ2JXP4hOVWzxiOFFclccz9oCSvLQMcyxtf4Lz3KKi3iWYYu3YXj0yzmGX1TBv9OgW9 t1nyvNOABX+f9wiW7t20BhhINqwhqY8NPkVEGM+AxNBmpQcNiplA1Y= Reporting-MTA:dns;perfora.net Arrival-Date:Tue, 23 Apr 2024 03:08:07 +0200 Final-Recipient:rfc822;[SUS MAIL] Action:failed Status:5.0.0 Final-Log-ID:0LjNFp-1sYgEy1zyR-00dYsM -
@GabrielSchell can't say anything about the topic itself, sorry. But you may want to redact the email addresses in the information you posted to avoid spambots having a new target
-
@GabrielSchell Reading https://senders.yahooinc.com/smtp-error-codes/, that error (554) is coming from Yahoo's mail server.
It indicates Yahoo is rejecting e-mail messages from the sending server (winusa.mail) you are using. The provider would need to contact Yahoo to remove the block.
