How to find spambot? Got network abuse report from my ISP
-
But i can see that 88.xxx.xxx.103 that is on top on that report also in softflowd?
@johnpoz said in How to find spambot? Got network abuse report from my ISP:
But you did show a bunch of traffic to 25...
And that is what I (we) trying to figure out? Where does it come from?
It does not come from the LAN because the ports are blocked...
Only pfSense is connected to the modem...I don't get it
That IPFIX log is full of mail port entries.
100 every 15 minutes...
Are this entries blocked stuff from outside? -
Look in your state table... What doe you see for those connections to 25.
-
Diagnostics > States?
There is nothing with port 25, 587 or the 88.xxx.xxx.xxx IP.
-
Well are you seeing the connections - you stated that your seeing 100 connections every 15 minutes... Watch it for a while.. that 88.x address not going to be in use any more since your on a different IP now.
-
@MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:
The funny thing is that the day before someone from my ISP was here because bridge mode did not work and there box sometimes did crash/reboot.
He was the only one with other devices.
He told me the router did not receive the last firmware automatically and made a reset to factory defaults. After that the router did pull the newest firmware.I am really curious about his situation, and somehow I suspect his router especially under the above statement...the firmware could be corrupted at no fault of anyone. If nothing is coming from LAN, it must be the router...does the router has any known vulnerabilities?
-
I watched "Diagnostics > States" now for 15 minutes and no 88.xxx IP or outgoing mail ports show up.
For testing i did put 995 into the PRTG filter and fetched my mails.
"Diagnostics > States" and PRTG shows it:
So that logging stuff is working.
And here we have a part of 15 minutes of PRTG (softflowd):
Is all this stuff trying to connect from outside?
On that abuse website are 36 entries from 11:05 to 11:22am this morning.
I see nothing in PRTG in this time range.
Well by nothing i mean something where the "Source IP" is showing something that is not this
ip-88-xxx-xx-xxx-hsi03.unitymedia...I wonder how much realtime that abuse report is?
-
Dude is your IP back to 88? And your not looking at real time flows... looks like your looking at total flows and what % of traffic they were..
-
What do you mean by "is your IP back to 88"?
The WAN IP in pfSense is that 176....softflowd is showing that 88 IP as you can see.
Not looking at real time flows? So where i have to look if not in "Diagnostics > States"?
And i ask again because i want to understand it:
Is all this stuff i see with softflowd on the pfSense WAN trying to connect from outside? -
@MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:
Is all this stuff i see with softflowd on the pfSense WAN trying to connect from outside?
And how would that be??? Do you see your IP in there anywhere? NO!!!
The destination for example the out.wanadoos.es (62.36.20.30) Is that you??
Is that ip-88-152.35.103 your current IP? NO!!1 then its not you doing anything - that is OLD data!You look at states under diagnostics... Do you see anything connecting to 25?
-
If softflowd is monitoring WAN/LAN, how can this be old data?
Here i fetch my mails (just did it 2 minutes ago) and it shows up and all the ip-88 stuff at the same time:
No there is nothing with mail ports in Diagnostics > States
-
@MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:
how can this be old data?
Because its showing you the TOP flows... Has nothing to do with timestamp
your IP Is not 88 - is it??? So how could you think that is current?? Looks like your sorted by dest port..
-
It's still set to filter for only the last 15mins though...
-
Yes sorted by port to show my mail fetch from my workstation on top.
But you can see on the left the date and time. 17:30 to 17:45
-
Run a packet capture on your WAN, filter by 88.152.35.103. Do you see anything?
Is the MAC correct? Is it incoming somehow?
Steve
-
Sorry Steve. What MAC?
And how do i make the capture? In pfSense?I never had to deal with this kind of stuff and never did it before.
That whole netflow and logging thing and PRTG is new to me.Edit
Thanks to YouTube i found it:18:11:54.688369 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 34 18:11:54.710712 IP 88.152.35.103.37882 > 104.47.10.33.25: tcp 0 18:11:54.712622 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 0 18:11:54.747653 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 32 18:11:54.748718 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 0 18:11:54.754257 IP 88.152.35.103.22 > 185.182.193.169.34202: tcp 476 18:11:54.754967 IP 88.152.35.103.55854 > 104.47.12.33.25: tcp 19 18:11:54.769614 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 0 18:11:54.783064 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 784 18:11:54.788164 IP 88.152.35.103.55854 > 104.47.12.33.25: tcp 0 18:11:54.789740 IP 88.152.35.103.22 > 212.8.249.191.59922: tcp 0 18:11:54.790913 IP 88.152.35.103.47617 > 184.30.210.217.80: tcp 0 18:11:54.801843 IP 88.152.35.103.22 > 185.182.193.169.34202: tcp 244 18:11:54.802527 IP 88.152.35.103.47617 > 184.30.210.217.80: tcp 0
-
Under diagnostic menu, packet capture..
edit: So that 88.152.35.103 is now pfsense IP?
edit2: Is pfsense VM on some other host... I don't see how your IP keeps changing... When you showed your pfsense wan it was not that IP.
That 104 address is MS
NetRange: 104.40.0.0 - 104.47.255.255
CIDR: 104.40.0.0/13
Organization: Microsoft Corporation (MSFT)Are you using MS for email? Not sure why you would be talking to MS on 25?? Even if you were using outlook or something it should be sending via ssl port. Most likely say 587
-
Its not a VM at the moment. Its a standalone machine until we find out whats going on.
And as you can see in the netflow/ipfix log that IP is used when i fetch my mails.
No MS or outlook. Mail provider is Runbox and i use Thunderbird.My father has a Windows Phone and i believe there is a MS account.
I don't know if this thing is doing something in the background.
And if yes it would show up in the firewall alerts because the ports are blocked? -
Add that host IP as a filter in the packet capture and will show only packets matching that.
Given that's not an IP on the firewall I don't expect to see any but......Setting the view to 'full' will show the MAC address on any packets with that IP that are captured. You can check it's the correct MAC for any NICs you have.
You can select 'full' view after the pcap has completed, just hit 'view capture' again to see it.Steve
-
So how is it your IP is 176.x.x.x but when you sniffed you saw traffic from an 88.x address? Makes zero sense!!! Clearly some piece of the puzzle is missing here..
BTW - when you posted that spam, it did show iphone as the sender if I recall... Is that link still up with the report? You could click on the details button, and pretty sure it said something about iphone??
-
Capture:
18:11:54.712622 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 30008, offset 0, flags [DF], proto TCP (6), length 52) 88.152.35.103.53026 > 104.47.14.33.25: Flags [.], cksum 0x08c3 (correct), seq 53, ack 548, win 5840, options [nop,nop,TS val 65650188 ecr 175959191], length 0 18:11:54.747653 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 29672, offset 0, flags [DF], proto TCP (6), length 84) 88.152.35.103.22 > 5.188.87.57.62114: Flags [P.], cksum 0x151b (correct), seq 1:33, ack 13, win 2896, options [nop,nop,TS val 65650191 ecr 1761297416], length 32 18:11:54.748718 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 30009, offset 0, flags [DF], proto TCP (6), length 52) 88.152.35.103.53026 > 104.47.14.33.25: Flags [.], cksum 0x08be (correct), seq 53, ack 549, win 5840, options [nop,nop,TS val 65650192 ecr 175959191], length 0 18:11:54.754257 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 530: (tos 0x0, ttl 64, id 14653, offset 0, flags [DF], proto TCP (6), length 516) 88.152.35.103.22 > 185.182.193.169.34202: Flags [P.], cksum 0x0eeb (correct), seq 1588:2064, ack 749, win 3878, length 476 18:11:54.754967 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 85: (tos 0x0, ttl 64, id 62438, offset 0, flags [DF], proto TCP (6), length 71) 88.152.35.103.55854 > 104.47.12.33.25: Flags [P.], cksum 0x1819 (correct), seq 0:19, ack 118, win 5840, options [nop,nop,TS val 65650192 ecr 175553073], length 19: SMTP, length: 19 EHLO hottmail.com 18:11:54.769614 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 29673, offset 0, flags [DF], proto TCP (6), length 52) 88.152.35.103.22 > 5.188.87.57.62114: Flags [.], cksum 0x3e18 (correct), seq 33, ack 877, win 2896, options [nop,nop,TS val 65650194 ecr 1761297497], length 0 18:11:54.783064 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 850: (tos 0x0, ttl 64, id 29674, offset 0, flags [DF], proto TCP (6), length 836) 88.152.35.103.22 > 5.188.87.57.62114: Flags [P.], cksum 0x9137 (correct), seq 33:817, ack 877, win 2896, options [nop,nop,TS val 65650195 ecr 1761297497], length 784 18:11:54.788164 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 62439, offset 0, flags [DF], proto TCP (6), length 52) 88.152.35.103.55854 > 104.47.12.33.25: Flags [.], cksum 0x54a3 (correct), seq 19, ack 314, win 5840, options [nop,nop,TS val 65650195 ecr 175553246], length 0 18:11:54.789740 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 64, id 51477, offset 0, flags [DF], proto TCP (6), length 40) 88.152.35.103.22 > 212.8.249.191.59922: Flags [.], cksum 0xf381 (correct), seq 1946193243, ack 2318528876, win 2920, length 0 18:11:54.790913 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 74: (tos 0x0, ttl 64, id 1071, offset 0, flags [DF], proto TCP (6), length 60) 88.152.35.103.47617 > 184.30.210.217.80: Flags [S], cksum 0xcb9c (correct), seq 672643643, win 5840, options [mss 1460,sackOK,TS val 65650196 ecr 0,nop,wscale 1], length 0 18:11:54.801843 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 298: (tos 0x0, ttl 64, id 14654, offset 0, flags [DF], proto TCP (6), length 284) 88.152.35.103.22 > 185.182.193.169.34202: Flags [P.], cksum 0x81fe (correct), seq 2064:2308, ack 785, win 3878, length 244 18:11:54.802527 10:c3:7b:45:b4:8c > 00:01:5c:69:ba:46, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 1072, offset 0, flags [DF], proto TCP (6), length 52) 88.152.35.103.47617 > 184.30.210.217.80: Flags [.], cksum 0x9a2e (correct), seq 672643644, ack 1508780897, win 2920, options [nop,nop,TS val 65650197 ecr 3260228584], length 0
Where does 10:c3:7b:45:b4:8c come from?
The board has 2 NIC's and show up in pfSense like this:
WAN NIC 10:c3:7b:45:b4:8a
LAN NIC 10:c3:7b:45:b4:8bFrom the DOCSIS modem:
Cable MAC 90:5C:44:3D:1D:07
MAC 90:5C:44:3D:1D:09