How to find spambot? Got network abuse report from my ISP
-
Have you considered that you might be relaying spam from an external source, rather than originating the spam on your own network - running an open relay?
Show us a screenshot of your WAN rules.
-
-
There is a whole bunch of traffic to 25 in that listing... But its showing your wan IP..
-
@MrGlasspoole :
What type of network is this: a home network or a business?If home, then NAT is going to mask the local host that is spamming when looking at traffic on the WAN interface. To see that IP, you need to put your tools on the LAN interface and then examine all devices you see initiating connections to an Internet host on ports 25, 465 and 587. A spambot will need to make outbound connections to other mail servers using one of those three ports. The source port is immaterial as it will be an ephemeral port. What matters is the destination port (one of the big 3 mail server ports). Once you find that traffic entering the LAN interface, examine the source IP addresses to find the infection.
If you have a business network with multiple subnets hanging off the firewall, you will follow the same process but just do it for each configured interface.
You could have an infected PC or even an infected IoT device (Smart TV, Smart Home Hub, etc.).
-
@johnpoz said in How to find spambot? Got network abuse report from my ISP:
There is a whole bunch of traffic to 25 in that listing... But its showing your wan IP..
I did set softflowd to the WAN because if i understand it right: If it would be something in my LAN i would see it in the System Log?
@bmeeks said in How to find spambot? Got network abuse report from my ISP:
@MrGlasspoole :
What type of network is this: a home network or a business?If home, then NAT is going to mask the local host that is spamming when looking at traffic on the WAN interface. To see that IP, you need to put your tools on the LAN interface and then examine all devices you see initiating connections to an Internet host on ports 25, 465 and 587.
You could have an infected PC or even an infected IoT device (Smart TV, Smart Home Hub, etc.).Its a home network and as you can see in this threat the mail ports are blocked on the LAN interface and nothing raises an alert in the log.
-
But how you suppose to figure out what is sending it? You need to see both!
Also what are you rules on your floating?
Do you have more than 1 IP? Looks like your public IP is different or you have more than 1, see traffic to x.x.36.95, and then your also showing traffic to 25 from x.x.35.103..
-
There is nothing in floating.
pfSense is showing me a 176.xxx.xxx.xxx address on WAN.
On that abuse site the last reports are 88.xxx.xxx.xxx.I enabled softflowd now also on the LAN.
Is it normal that there is no time on every single entry in that IPFIX thing?For testing i did open the port on LAN and did send a mail and it shows up and has the 176.... address:
-
So what is using that 88.x.x.x IP? Seems like it must be on the firewall...
Check the pfSense routing table in Diag > Routes, do both IPs appear there?
Is the WAN configured as DHCP? Could it just be pulling a new IP from the ISP there?
Steve
-
Sure WAN is DHCP since the ISP router is in bridge mode.
This is what routes is showing:
The last abuse entries. Always new entries:
-
Well that aint your IP...
Neither of them are.. atleast not with pfsense - do you have other devices connected to this isp?
-
Only the pfSense WAN is connected to the ISP router/modem.
And that network abuse report has my customer ID.
That 176.199.143.125 in that report is the old IP.
Now its 176.xxx.xxx.174 that i see on the WAN in pfSense.
Most of the time when you restart the modem you get a new one.Its driving me crazy
-
And how are you sure its not reports from some other guy that had that IP before you got it? ;)
That is part of the problem of changing IPs all the time - you can be held responsible for the sins of the guy that had it before you..
But you did show a bunch of traffic to 25...
-
But i can see that 88.xxx.xxx.103 that is on top on that report also in softflowd?
@johnpoz said in How to find spambot? Got network abuse report from my ISP:
But you did show a bunch of traffic to 25...
And that is what I (we) trying to figure out? Where does it come from?
It does not come from the LAN because the ports are blocked...
Only pfSense is connected to the modem...I don't get it
That IPFIX log is full of mail port entries.
100 every 15 minutes...
Are this entries blocked stuff from outside? -
Look in your state table... What doe you see for those connections to 25.
-
Diagnostics > States?
There is nothing with port 25, 587 or the 88.xxx.xxx.xxx IP.
-
Well are you seeing the connections - you stated that your seeing 100 connections every 15 minutes... Watch it for a while.. that 88.x address not going to be in use any more since your on a different IP now.
-
@MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:
The funny thing is that the day before someone from my ISP was here because bridge mode did not work and there box sometimes did crash/reboot.
He was the only one with other devices.
He told me the router did not receive the last firmware automatically and made a reset to factory defaults. After that the router did pull the newest firmware.I am really curious about his situation, and somehow I suspect his router especially under the above statement...the firmware could be corrupted at no fault of anyone. If nothing is coming from LAN, it must be the router...does the router has any known vulnerabilities?
-
I watched "Diagnostics > States" now for 15 minutes and no 88.xxx IP or outgoing mail ports show up.
For testing i did put 995 into the PRTG filter and fetched my mails.
"Diagnostics > States" and PRTG shows it:
So that logging stuff is working.
And here we have a part of 15 minutes of PRTG (softflowd):
Is all this stuff trying to connect from outside?
On that abuse website are 36 entries from 11:05 to 11:22am this morning.
I see nothing in PRTG in this time range.
Well by nothing i mean something where the "Source IP" is showing something that is not this
ip-88-xxx-xx-xxx-hsi03.unitymedia...I wonder how much realtime that abuse report is?
-
Dude is your IP back to 88? And your not looking at real time flows... looks like your looking at total flows and what % of traffic they were..
-
What do you mean by "is your IP back to 88"?
The WAN IP in pfSense is that 176....softflowd is showing that 88 IP as you can see.
Not looking at real time flows? So where i have to look if not in "Diagnostics > States"?
And i ask again because i want to understand it:
Is all this stuff i see with softflowd on the pfSense WAN trying to connect from outside?
