Our IP address is blacklisted ...Exchange Server 2010....steps to take?

[brickwall53]

Hello all

 

I have a problemwith spam on our network and I think its from a compromised email account.

 

What steps should I take to remove the problem

 

I ask this as I have had no training on how to deal with this issue or how to manage Exchange Server.

 

Would getting all of our staff to have their account passwords changed be the first step

 

Thanks

[synaesthesia]

Absolutely; get everyone to change their passwords immediately. Do it today; say at 11AM *all* passwords will be set to expire (do that in Active Directory) and they must be changed.

 

Also the most likely cause for a compromised account is going to be someone clicking a link emailed to them; a phishing email. It would be wise to educate people on that.

 

Unfortunately I don't know Exchange myself, but having gone through a similar experience when we ran Zimbra and sending out tens of thousands of spam mails, I feel your pain. We were able to trace the source email address for the spam, checked their account and found a phishing email which they admitted to falling for.

[mitchell1981]

Have you tried access the report from here:

 

MX Lookup Tool - Check your DNS MX Records online - MxToolbox

 

We were blacklisted earlier in the year. It turned out to be a laptop that had a virus that was trying to contact a monitored address. The report told us which monitored address was being contacted and we were able to search for that IP on our web filter and trace it back to the compromised laptop. Once the virus was removed there is a one click process to get yourself off the blacklist. As far as I can tell our network was not actively spamming, so your situation may be different. MXToolbox should give you an idea of why you have been blacklisted though.

[win]

If it looks like someone on your domain is sending spam, you should check that your exchange server has an SPF file registered with your ISP. This will prevent hackers pinching your domain name for spam.

[RobD]

I had this issue where I'd unblock and then get blocked again, in the end I blocked port 25 connecting externally everywhere except my Exchange subnet (and a few others).

[andydis]

do you share your external IP with other schools?

 

Enable SMTP logging and review the logs

Edited October 23, 2014 by andydis

[truebluesteve]

I have had this problem a couple of times in the last few years and most recently about 6 months ago. First thing is obviously to find the culprit as trying to remove yourself from blacklists before then is completely pointless. So I would

 

1. Force a password change as you suggested

2. If the spam is still happening, check the message queues in Exchange Server as it will show you if there is a lot of mail going to what appears to be random recipients. Exchange also has message tracking so you can see who has sent what and when.

3. If you have a firewall make sure that only your exchange server can send out on port 25 and if it isn't then check the logs for any activity on that port

 

If you visit spamhaus.org they maintain blocking lists and if you enter your external IP can tell you if your are blacklisted and the reason why. Don't remove yourself from their lists until you are sure you are free of the problem.

 

Good luck - its a nightmare when it happens and can be a huge pain to sort out. Let me know if you need any pointers