within my network I have a Linux Server configured with Fetchmaill to retrieve Mails via POP3 from my Mail Provider. It is connected via postfix to an old Windows Server. Clients are connected via Outlook to the Windows Server. So every mail is routed through my linux machine.
Just today I received a Phishing Mail from
email@example.com. Please note that this account does not exist. Neither at my Mail Provider nor on my Windows Server. I tried to configure my Linux Server that it only accepts connections from inside my local network. Not from the outside. I need help on how to check where the following mail came from:
12:22:57 proxy postfix/smtpd: 34B562EE023E: client=localhost.localdomain[127.0.0.1]
12:22:57 proxy postfix/cleanup: 34B562EE023E: firstname.lastname@example.org
12:22:57 proxy postfix/qmgr: 34B562EE023E: email@example.com, size=3190, nrcpt=1 (queue active)
12:22:57 proxy postfix/smtp: 34B562EE023E: firstname.lastname@example.org, relay=192.168.1.9[192.168.1.9]:25, delay=0.14, delays=0.09/0/0/0.06, dsn=2.6.0, status=sent (250 2.6.0 email@example.com Queued mail for delivery)
12:22:57 proxy postfix/qmgr: 34B562EE023E: removed
Whereas 192.168.1.9 is my Windows Server machine. Do you have any idea what to look for?
I tried different online services to check if my server is an open relay, but they all timeout.