Brute-Force attacks from server itself?

Hi,

Since I moved all my websites from old servers to new servers (3 weeks ago) I get bizarre Brute-Force attack e-mails.


I get lot's of these Brute-Force errors and always for the same e-mail address. The domain.com domain is mine, but it's not located on server1.mydomain.com.
The IP address (111.222.333.444) is the IP address of the server.

I have no clue where to look, because I see nothing weird in the log files. How should I troubleshoot this?

Hello,

Scan your PHP files (and MySQL tables) for [email protected], it might be a script, which is triggered by cron.

Interesting, I found the e-mail address in a PHP script. I disabled the domain (unused domain anyway) and now I have to wait to see if more BF attempts pop up. Thanks for the suggestion!