This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

spam being generated in domain

too much spam is being generated by 1 id in a the network. the id is not present in our domain. the thing is all relays have been stopped by us except by mail server. we even tested by shutting down our mail server. the email doesn't contain any ip address ( not shown in log viewer) .. all rules written on firewall to drop emai from that id or subejct line doesn't stop the mail from going through.. switching from mta to legacy or legacy to mta doesn't help. the emails keep on going. l1 snd l2 support has been futile till now. community help all that can save me now.

This thread was automatically locked due to age.

0 rfcat_vk over 5 years ago

Hi,

more than likely means you have an open rule eg source WAN -> ANY to LAN -> ANY.

What is the result if you trace route to the IP address?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 5 years ago

Hello Chandan,

Thank you for contacting the Sophos Community.

Can you forward one of the emails that are SPAM, so we can check the headers?

Also, have you checked that you don't have any DNAT rule with service as ANY?

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Chandan Kumar2 over 5 years ago in reply to rfcat_vk

No. No open relays
Cancel
Vote Up 0 Vote Down

Cancel
0 Chandan Kumar2 over 5 years ago in reply to emmosophos

2020-06-17 07:59:16Emailmessageid="18035" log_type="Anti-Spam" log_component="SMTP" log_subtype="Allowed" status="" fw_rule_id="0" user="" policy_name="None" sender="tv.unnikrishnan@sailbsl.in" recipient="andreamonsagrati@hotmail.it" subject="Re: Hello Dear" message_id="1jikvJ-0005IB-4b" email_size="2059" action="DELIVERED" reason="Email has been delivered to recipient(s)." host="sailbsl.in" domain="" src_ip="" src_country="" dst_ip="" dst_country="" protocol="TCP" src_port="0" dst_port="0" bytes_sent="0" bytes_received="0" quarantine_reason="Other" Copy to clipboard

Also, have you checked that you don't have any DNAT rule with service as ANY --> checked. None
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 5 years ago in reply to Chandan Kumar2

Hello Chandan,

Can you send me by PM the Access ID of your Firewall.

Monitor & Analize >> Diagnostics >> Support Access >> ON >> Access Status >> And copy & paste the Access ID and send it to me.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel
0 Chandan Kumar2 over 5 years ago in reply to emmosophos

DM the details to you. thanks for looking into it
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 5 years ago in reply to Chandan Kumar2

Hello Chandan,

I have sent you a followup DM.

Regards,
Cancel
Vote Up 0 Vote Down

Cancel