Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to find spambot? Got network abuse report from my ISP

    General pfSense Questions
    10
    85
    8.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      MrGlasspoole
      last edited by MrGlasspoole

      But i can see that 88.xxx.xxx.103 that is on top on that report also in softflowd?

      @johnpoz said in How to find spambot? Got network abuse report from my ISP:

      But you did show a bunch of traffic to 25...

      And that is what I (we) trying to figure out? Where does it come from?
      It does not come from the LAN because the ports are blocked...
      Only pfSense is connected to the modem...

      I don't get it 😢

      That IPFIX log is full of mail port entries.
      100 every 15 minutes...
      Are this entries blocked stuff from outside?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Look in your state table... What doe you see for those connections to 25.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • M
          MrGlasspoole
          last edited by

          Diagnostics > States?

          There is nothing with port 25, 587 or the 88.xxx.xxx.xxx IP.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Well are you seeing the connections - you stated that your seeing 100 connections every 15 minutes... Watch it for a while.. that 88.x address not going to be in use any more since your on a different IP now.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • NollipfSenseN
              NollipfSense
              last edited by

              @MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:

              The funny thing is that the day before someone from my ISP was here because bridge mode did not work and there box sometimes did crash/reboot.
              He was the only one with other devices.
              He told me the router did not receive the last firmware automatically and made a reset to factory defaults. After that the router did pull the newest firmware.

              I am really curious about his situation, and somehow I suspect his router especially under the above statement...the firmware could be corrupted at no fault of anyone. If nothing is coming from LAN, it must be the router...does the router has any known vulnerabilities?

              pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
              pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

              1 Reply Last reply Reply Quote 0
              • M
                MrGlasspoole
                last edited by

                I watched "Diagnostics > States" now for 15 minutes and no 88.xxx IP or outgoing mail ports show up.
                For testing i did put 995 into the PRTG filter and fetched my mails.
                "Diagnostics > States" and PRTG shows it:
                retrievemail.gif

                retrievemail3.gif

                So that logging stuff is working.

                And here we have a part of 15 minutes of PRTG (softflowd):
                PRTG-Network-Monitor.gif

                Is all this stuff trying to connect from outside?

                On that abuse website are 36 entries from 11:05 to 11:22am this morning.
                I see nothing in PRTG in this time range.
                Well by nothing i mean something where the "Source IP" is showing something that is not this
                ip-88-xxx-xx-xxx-hsi03.unitymedia...

                I wonder how much realtime that abuse report is?

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Dude is your IP back to 88? And your not looking at real time flows... looks like your looking at total flows and what % of traffic they were..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • M
                    MrGlasspoole
                    last edited by

                    What do you mean by "is your IP back to 88"?
                    The WAN IP in pfSense is that 176....

                    softflowd is showing that 88 IP as you can see.

                    Not looking at real time flows? So where i have to look if not in "Diagnostics > States"?

                    And i ask again because i want to understand it:
                    Is all this stuff i see with softflowd on the pfSense WAN trying to connect from outside?

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      @MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:

                      Is all this stuff i see with softflowd on the pfSense WAN trying to connect from outside?

                      And how would that be??? Do you see your IP in there anywhere? NO!!!

                      The destination for example the out.wanadoos.es (62.36.20.30) Is that you??
                      Is that ip-88-152.35.103 your current IP? NO!!1 then its not you doing anything - that is OLD data!

                      You look at states under diagnostics... Do you see anything connecting to 25?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • M
                        MrGlasspoole
                        last edited by

                        If softflowd is monitoring WAN/LAN, how can this be old data?
                        Here i fetch my mails (just did it 2 minutes ago) and it shows up and all the ip-88 stuff at the same time:
                        ipfx.gif

                        No there is nothing with mail ports in Diagnostics > States

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          @MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:

                          how can this be old data?

                          Because its showing you the TOP flows... Has nothing to do with timestamp

                          your IP Is not 88 - is it??? So how could you think that is current?? Looks like your sorted by dest port..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by stephenw10

                            It's still set to filter for only the last 15mins though...

                            1 Reply Last reply Reply Quote 0
                            • M
                              MrGlasspoole
                              last edited by

                              Yes sorted by port to show my mail fetch from my workstation on top.

                              But you can see on the left the date and time. 17:30 to 17:45

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Run a packet capture on your WAN, filter by 88.152.35.103. Do you see anything?

                                Is the MAC correct? Is it incoming somehow?

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • M
                                  MrGlasspoole
                                  last edited by MrGlasspoole

                                  Sorry Steve. What MAC?
                                  And how do i make the capture? In pfSense?

                                  I never had to deal with this kind of stuff and never did it before.
                                  That whole netflow and logging thing and PRTG is new to me.

                                  Edit
                                  Thanks to YouTube i found it:

                                  18:11:54.688369 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 34
                                  18:11:54.710712 IP 88.152.35.103.37882 > 104.47.10.33.25: tcp 0
                                  18:11:54.712622 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 0
                                  18:11:54.747653 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 32
                                  18:11:54.748718 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 0
                                  18:11:54.754257 IP 88.152.35.103.22 > 185.182.193.169.34202: tcp 476
                                  18:11:54.754967 IP 88.152.35.103.55854 > 104.47.12.33.25: tcp 19
                                  18:11:54.769614 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 0
                                  18:11:54.783064 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 784
                                  18:11:54.788164 IP 88.152.35.103.55854 > 104.47.12.33.25: tcp 0
                                  18:11:54.789740 IP 88.152.35.103.22 > 212.8.249.191.59922: tcp 0
                                  18:11:54.790913 IP 88.152.35.103.47617 > 184.30.210.217.80: tcp 0
                                  18:11:54.801843 IP 88.152.35.103.22 > 185.182.193.169.34202: tcp 244
                                  18:11:54.802527 IP 88.152.35.103.47617 > 184.30.210.217.80: tcp 0
                                  
                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Under diagnostic menu, packet capture..

                                    edit: So that 88.152.35.103 is now pfsense IP?

                                    edit2: Is pfsense VM on some other host... I don't see how your IP keeps changing... When you showed your pfsense wan it was not that IP.

                                    That 104 address is MS
                                    NetRange: 104.40.0.0 - 104.47.255.255
                                    CIDR: 104.40.0.0/13
                                    Organization: Microsoft Corporation (MSFT)

                                    Are you using MS for email? Not sure why you would be talking to MS on 25?? Even if you were using outlook or something it should be sending via ssl port. Most likely say 587

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      MrGlasspoole
                                      last edited by

                                      Its not a VM at the moment. Its a standalone machine until we find out whats going on.

                                      wan1.jpg

                                      And as you can see in the netflow/ipfix log that IP is used when i fetch my mails.
                                      No MS or outlook. Mail provider is Runbox and i use Thunderbird.

                                      My father has a Windows Phone and i believe there is a MS account.
                                      I don't know if this thing is doing something in the background.
                                      And if yes it would show up in the firewall alerts because the ports are blocked?

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Add that host IP as a filter in the packet capture and will show only packets matching that.
                                        Given that's not an IP on the firewall I don't expect to see any but......

                                        Setting the view to 'full' will show the MAC address on any packets with that IP that are captured. You can check it's the correct MAC for any NICs you have.
                                        You can select 'full' view after the pcap has completed, just hit 'view capture' again to see it.

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by johnpoz

                                          So how is it your IP is 176.x.x.x but when you sniffed you saw traffic from an 88.x address? Makes zero sense!!! Clearly some piece of the puzzle is missing here..

                                          BTW - when you posted that spam, it did show iphone as the sender if I recall... Is that link still up with the report? You could click on the details button, and pretty sure it said something about iphone??

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            MrGlasspoole
                                            last edited by MrGlasspoole

                                            Capture:

                                            18:11:54.712622 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 30008, offset 0, flags [DF], proto TCP (6), length 52)
                                                88.152.35.103.53026 > 104.47.14.33.25: Flags [.], cksum 0x08c3 (correct), seq 53, ack 548, win 5840, options [nop,nop,TS val 65650188 ecr 175959191], length 0
                                            18:11:54.747653 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 29672, offset 0, flags [DF], proto TCP (6), length 84)
                                                88.152.35.103.22 > 5.188.87.57.62114: Flags [P.], cksum 0x151b (correct), seq 1:33, ack 13, win 2896, options [nop,nop,TS val 65650191 ecr 1761297416], length 32
                                            18:11:54.748718 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 30009, offset 0, flags [DF], proto TCP (6), length 52)
                                                88.152.35.103.53026 > 104.47.14.33.25: Flags [.], cksum 0x08be (correct), seq 53, ack 549, win 5840, options [nop,nop,TS val 65650192 ecr 175959191], length 0
                                            18:11:54.754257 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 530: (tos 0x0, ttl 64, id 14653, offset 0, flags [DF], proto TCP (6), length 516)
                                                88.152.35.103.22 > 185.182.193.169.34202: Flags [P.], cksum 0x0eeb (correct), seq 1588:2064, ack 749, win 3878, length 476
                                            18:11:54.754967 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 85: (tos 0x0, ttl 64, id 62438, offset 0, flags [DF], proto TCP (6), length 71)
                                                88.152.35.103.55854 > 104.47.12.33.25: Flags [P.], cksum 0x1819 (correct), seq 0:19, ack 118, win 5840, options [nop,nop,TS val 65650192 ecr 175553073], length 19: SMTP, length: 19
                                            	EHLO hottmail.com
                                            18:11:54.769614 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 29673, offset 0, flags [DF], proto TCP (6), length 52)
                                                88.152.35.103.22 > 5.188.87.57.62114: Flags [.], cksum 0x3e18 (correct), seq 33, ack 877, win 2896, options [nop,nop,TS val 65650194 ecr 1761297497], length 0
                                            18:11:54.783064 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 850: (tos 0x0, ttl 64, id 29674, offset 0, flags [DF], proto TCP (6), length 836)
                                                88.152.35.103.22 > 5.188.87.57.62114: Flags [P.], cksum 0x9137 (correct), seq 33:817, ack 877, win 2896, options [nop,nop,TS val 65650195 ecr 1761297497], length 784
                                            18:11:54.788164 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 62439, offset 0, flags [DF], proto TCP (6), length 52)
                                                88.152.35.103.55854 > 104.47.12.33.25: Flags [.], cksum 0x54a3 (correct), seq 19, ack 314, win 5840, options [nop,nop,TS val 65650195 ecr 175553246], length 0
                                            18:11:54.789740 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 51477, offset 0, flags [DF], proto TCP (6), length 40)
                                                88.152.35.103.22 > 212.8.249.191.59922: Flags [.], cksum 0xf381 (correct), seq 1946193243, ack 2318528876, win 2920, length 0
                                            18:11:54.790913 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 1071, offset 0, flags [DF], proto TCP (6), length 60)
                                                88.152.35.103.47617 > 184.30.210.217.80: Flags [S], cksum 0xcb9c (correct), seq 672643643, win 5840, options [mss 1460,sackOK,TS val 65650196 ecr 0,nop,wscale 1], length 0
                                            18:11:54.801843 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 298: (tos 0x0, ttl 64, id 14654, offset 0, flags [DF], proto TCP (6), length 284)
                                                88.152.35.103.22 > 185.182.193.169.34202: Flags [P.], cksum 0x81fe (correct), seq 2064:2308, ack 785, win 3878, length 244
                                            18:11:54.802527 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 1072, offset 0, flags [DF], proto TCP (6), length 52)
                                                88.152.35.103.47617 > 184.30.210.217.80: Flags [.], cksum 0x9a2e (correct), seq 672643644, ack 1508780897, win 2920, options [nop,nop,TS val 65650197 ecr 3260228584], length 0
                                            

                                            Where does 10:c3:7b:45:b4:8c come from?

                                            The board has 2 NIC's and show up in pfSense like this:
                                            WAN NIC 10:c3:7b:45:b4:8a
                                            LAN NIC 10:c3:7b:45:b4:8b

                                            From the DOCSIS modem:
                                            Cable MAC 90:5C:44:3D:1D:07
                                            MAC 90:5C:44:3D:1D:09

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.