Tracking down SPAM

[BassTech]

Received this email this morning from our ISP:

 

Hello,

 

We have discovered that a lot of spam is coming out of your network from the public IP 221.192.101.2.

I can not see where this address NATs to because this is all done locally. We have blocked the IP from sending out. Could you please investigate this issue and let me know when the spamming has stopped so we can unblock this IP.

 

Kind Regards

 

We have our CISCO ASA 5510 which acts as our firewall and also NAT, however the IP 221.192.101.2 does not have a NAT rule set up, the only NAT rules set up are:

 

221.192.101.1

221.192.101.4

221.192.101.6

221.192.101.7

 

so I'm a bit confused as to where this SPAM could be coming from

[ijk]

What is connected to 221.192.101.2, is it an interface on the Cisco device, or another system?

What can connect to 221.192.101.2 from within your network?

What systems within your network can connect to external systems via SMTP?

[BassTech]

221.192.101.2 is our public IP, connected to our smoothwall server & juniper router.

Anything internally can connect to 221.192.101.2

Edit: only our Exchange server can use the SMTP protocol externally.

Edited April 27, 2016 by BassTech

[ijk]

Is this the way these devices are connected?

 

{INTERNET}<>[JUNIPER]<>[CISCO ASA]<>[sMOOTHWALL UTM]<>[iNTERNAL NETWORK (incl. EXCHANGE SERVER)]

[BassTech]

Yes it's set-up exactly like that

[ijk]

Try to telnet into a mail server from a Windows machine. You need to have added the Windows feature 'Telnet client' in order to do that.

The command is:

telnet hostname 25

For example,

telnet smtp.mail.me.com 25

You should additionally test ports 587 and 465

[kd1982]

You might have already tried this but might be worth double-checking with your isp on how they identify spam?

ie. if someone is sending mail out to all parents, in groups of 500 at a time, all with the same subject etc.

It would look like spam to most, when in fact it's not.

[BassTech]

Try to telnet into a mail server from a Windows machine. You need to have added the Windows feature 'Telnet client' in order to do that.

The command is:

telnet hostname 25

For example,

telnet smtp.mail.me.com 25

You should additionally test ports 587 and 465

 

Will give this a go when I get in the office, thanks.

@kd1982 - I'll double check with our ISP as well, RM is our ISP so you could well be right there!

[BassTech]

Try to telnet into a mail server from a Windows machine. You need to have added the Windows feature 'Telnet client' in order to do that.

The command is:

telnet hostname 25

For example,

telnet smtp.mail.me.com 25

You should additionally test ports 587 and 465

 

I've tried this and I can connect to our mail server on pots 25 & 587 but not 465. I've also noticed on our Exchange logs that it's sending spam from [email protected] - The client IP is the local IP of the Exchange server but I can't find out how/where it's coming from

Edited May 10, 2016 by BassTech

[BassTech]

I think we were the victim of a reverse non-delivery report (NDR) attack. I've followed an article from MS to block messages sent to recipients not listed in the global address list. Will see how it goes.