From owner-freebsd-questions@freebsd.org  Wed Sep 26 14:09:37 2018
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 94D5310ADE78
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Wed, 26 Sep 2018 14:09:37 +0000 (UTC)
 (envelope-from david+dated+1538402010.13332a@skytracker.ca)
Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org
 [IPv6:2001:1900:2254:206a::50:5])
 by mx1.freebsd.org (Postfix) with ESMTP id 342467F55B
 for <freebsd-questions@freebsd.org>; Wed, 26 Sep 2018 14:09:37 +0000 (UTC)
 (envelope-from david+dated+1538402010.13332a@skytracker.ca)
Received: by mailman.ysv.freebsd.org (Postfix)
 id E7CD810ADE77; Wed, 26 Sep 2018 14:09:36 +0000 (UTC)
Delivered-To: questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id D60A910ADE76
 for <questions@mailman.ysv.freebsd.org>; Wed, 26 Sep 2018 14:09:36 +0000 (UTC)
 (envelope-from david+dated+1538402010.13332a@skytracker.ca)
Received: from 3s1.com (3s1.com [162.213.106.199])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client CN "3s1.com", Issuer "CA Cert Signing Authority" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id 7397C7F55A
 for <questions@freebsd.org>; Wed, 26 Sep 2018 14:09:36 +0000 (UTC)
 (envelope-from david+dated+1538402010.13332a@skytracker.ca)
Received: from 3s1.com (localhost [127.0.0.1])
 by 3s1.com (8.14.9/8.14.9) with ESMTP id w8QDrUF7024318
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
 for <questions@freebsd.org>; Wed, 26 Sep 2018 09:53:30 -0400 (EDT)
 (envelope-from david+dated+1538402010.13332a@skytracker.ca)
Received: (from david@localhost)
 by 3s1.com (8.14.9/8.14.9/Submit) id w8QDrUZC024317
 for questions@freebsd.org; Wed, 26 Sep 2018 09:53:30 -0400 (EDT)
 (envelope-from david+dated+1538402010.13332a@skytracker.ca)
X-Authentication-Warning: 3s1.com: david set sender to
 david+dated+1538402010.13332a@skytracker.ca using -f
Received: by 3s1.com (tmda-sendmail, from uid 1000);
 Wed, 26 Sep 2018 09:53:30 -0400
Date: Wed, 26 Sep 2018 09:53:29 -0400
To: questions@freebsd.org
Subject: dictionary attacks check
Message-ID: <20180926135329.GA24139@skytracker.ca>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.2.3i
X-Delivery-Agent: TMDA/1.1.12 (Macallan)
From: David Banning <david+dated+1538402010.13332a@skytracker.ca>
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Sep 2018 14:09:37 -0000

I just got an email bounce - reason;

The sending IP (162.213.106.199) is listed on https://spamrl.com as a source of dictionary attacks.

The first thing I did was run a check on mxmailbox.com which shows my server as clean from all sites checked.
I wonder what the best way is of checking my system to see if it is commiting these dictionary attacks.

My system it somewhat older;

FreeBSD 3s1.com 9.3-RELEASE FreeBSD 9.3-RELEASE #0

Any pointers would be helpful.