Question Does a very large email data transfer rate possibly imply compromise on an email account?

[MHC_1]

Server operating system version

alam Linux 9.7

Plesk version and microupdate number

18.0.80 #3

I realise this isn't a specific Plesk question; but using the Plesk GUI I've noticed that a certain client account spends ~18Gb per month on IMAP/POP3 connections.

The account has a single email address sized around 50Gb . This is a long term client personal account.

Others accounts on the Plesk server running a busy business have POP3/IMAP of 0 and SMTP of a few megabytes.

"Normal" yet busy account:



And the unusual account is here below:




This has been similar for the last 4 months (~30Gb per month total for whole months)

MY QUERY:

Does this imply the account may have been compromised and is sending/receiving spams?

 

[MHC_1]

Follow Up -- and making it more specifically Plesk relevant:

Does plesk have a GUI of displaying what time of day email logins occur for an address (Like the HTML visitors graphs are broken up into hours per day)?

 

[MHC_1]

Reasoning this is compromise/spam indicator:​

• Email is a personal email account and has low volume (no mailings etc.)
• Values have been this high consistently for several months .
• We are not aware client is using POP3 so it's almost certainly IMAP usage.

Client email has multiple breaches on haveibeenpwned.com too.

 

[Sebahat.hadzhi]

Does plesk have a GUI of displaying what time of day email logins occur for an address (Like the HTML visitors graphs are broken up into hours per day)?

No, there's no such GUI tool.

I wouldn't automatically conclude the account has been compromised. Occasionally, similar spikes are caused by IMAP sync loops occurring on a particular client device. I would start off by reviewing the logs for IMAP authentication:

cat /var/log/maillog | grep '[email protected]'
cat /var/log/maillog | grep imap-login | grep '[email protected]'

Check if there are lots of authentication attempts from different IP addresses.

 

[MHC_1]

@Sebahat.hadzhi thank you for your feedback. End user has IPad using Apple Mail (as far as I am aware) so that may be an issue with IMAP sync loops. Checking the range of login IP addresses over the last month it doesn't show anything unusual. Thank you for that command line help.

 

[Sebahat.hadzhi]

Is there any chance you can ask the user to temporarily set the account offline in Apple Mail and use only webmail to rule out an issue with the local device?

 

[MHC_1]

Is there any chance you can ask the user to temporarily set the account offline in Apple Mail and use only webmail to rule out an issue with the local device?

Thanks. The end user is not very IT literate so we tried to avoid giving them too much hassle.

However, with some investigation we found the cause was that their end point disk is not large enough to hold the full email account (~52Gb) and so was downloading and then silently locally clearing less relevant emails (or their headers) a LOT and this is very probably the cause of the traffic volume.