How to find spambot? Got network abuse report from my ISP
-
Only the pfSense WAN is connected to the ISP router/modem.
And that network abuse report has my customer ID.
That 176.199.143.125 in that report is the old IP.
Now its 176.xxx.xxx.174 that i see on the WAN in pfSense.
Most of the time when you restart the modem you get a new one.Its driving me crazy
-
And how are you sure its not reports from some other guy that had that IP before you got it? ;)
That is part of the problem of changing IPs all the time - you can be held responsible for the sins of the guy that had it before you..
But you did show a bunch of traffic to 25...
-
But i can see that 88.xxx.xxx.103 that is on top on that report also in softflowd?
@johnpoz said in How to find spambot? Got network abuse report from my ISP:
But you did show a bunch of traffic to 25...
And that is what I (we) trying to figure out? Where does it come from?
It does not come from the LAN because the ports are blocked...
Only pfSense is connected to the modem...I don't get it
That IPFIX log is full of mail port entries.
100 every 15 minutes...
Are this entries blocked stuff from outside? -
Look in your state table... What doe you see for those connections to 25.
-
Diagnostics > States?
There is nothing with port 25, 587 or the 88.xxx.xxx.xxx IP.
-
Well are you seeing the connections - you stated that your seeing 100 connections every 15 minutes... Watch it for a while.. that 88.x address not going to be in use any more since your on a different IP now.
-
@MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:
The funny thing is that the day before someone from my ISP was here because bridge mode did not work and there box sometimes did crash/reboot.
He was the only one with other devices.
He told me the router did not receive the last firmware automatically and made a reset to factory defaults. After that the router did pull the newest firmware.I am really curious about his situation, and somehow I suspect his router especially under the above statement...the firmware could be corrupted at no fault of anyone. If nothing is coming from LAN, it must be the router...does the router has any known vulnerabilities?
-
I watched "Diagnostics > States" now for 15 minutes and no 88.xxx IP or outgoing mail ports show up.
For testing i did put 995 into the PRTG filter and fetched my mails.
"Diagnostics > States" and PRTG shows it:
So that logging stuff is working.
And here we have a part of 15 minutes of PRTG (softflowd):
Is all this stuff trying to connect from outside?
On that abuse website are 36 entries from 11:05 to 11:22am this morning.
I see nothing in PRTG in this time range.
Well by nothing i mean something where the "Source IP" is showing something that is not this
ip-88-xxx-xx-xxx-hsi03.unitymedia...I wonder how much realtime that abuse report is?
-
Dude is your IP back to 88? And your not looking at real time flows... looks like your looking at total flows and what % of traffic they were..
-
What do you mean by "is your IP back to 88"?
The WAN IP in pfSense is that 176....softflowd is showing that 88 IP as you can see.
Not looking at real time flows? So where i have to look if not in "Diagnostics > States"?
And i ask again because i want to understand it:
Is all this stuff i see with softflowd on the pfSense WAN trying to connect from outside? -
@MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:
Is all this stuff i see with softflowd on the pfSense WAN trying to connect from outside?
And how would that be??? Do you see your IP in there anywhere? NO!!!
The destination for example the out.wanadoos.es (62.36.20.30) Is that you??
Is that ip-88-152.35.103 your current IP? NO!!1 then its not you doing anything - that is OLD data!You look at states under diagnostics... Do you see anything connecting to 25?
-
If softflowd is monitoring WAN/LAN, how can this be old data?
Here i fetch my mails (just did it 2 minutes ago) and it shows up and all the ip-88 stuff at the same time:
No there is nothing with mail ports in Diagnostics > States
-
@MrGlasspoole said in How to find spambot? Got network abuse report from my ISP:
how can this be old data?
Because its showing you the TOP flows... Has nothing to do with timestamp
your IP Is not 88 - is it??? So how could you think that is current?? Looks like your sorted by dest port..
-
It's still set to filter for only the last 15mins though...
-
Yes sorted by port to show my mail fetch from my workstation on top.
But you can see on the left the date and time. 17:30 to 17:45
-
Run a packet capture on your WAN, filter by 88.152.35.103. Do you see anything?
Is the MAC correct? Is it incoming somehow?
Steve
-
Sorry Steve. What MAC?
And how do i make the capture? In pfSense?I never had to deal with this kind of stuff and never did it before.
That whole netflow and logging thing and PRTG is new to me.Edit
Thanks to YouTube i found it:18:11:54.688369 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 34 18:11:54.710712 IP 88.152.35.103.37882 > 104.47.10.33.25: tcp 0 18:11:54.712622 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 0 18:11:54.747653 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 32 18:11:54.748718 IP 88.152.35.103.53026 > 104.47.14.33.25: tcp 0 18:11:54.754257 IP 88.152.35.103.22 > 185.182.193.169.34202: tcp 476 18:11:54.754967 IP 88.152.35.103.55854 > 104.47.12.33.25: tcp 19 18:11:54.769614 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 0 18:11:54.783064 IP 88.152.35.103.22 > 5.188.87.57.62114: tcp 784 18:11:54.788164 IP 88.152.35.103.55854 > 104.47.12.33.25: tcp 0 18:11:54.789740 IP 88.152.35.103.22 > 212.8.249.191.59922: tcp 0 18:11:54.790913 IP 88.152.35.103.47617 > 184.30.210.217.80: tcp 0 18:11:54.801843 IP 88.152.35.103.22 > 185.182.193.169.34202: tcp 244 18:11:54.802527 IP 88.152.35.103.47617 > 184.30.210.217.80: tcp 0 -
Under diagnostic menu, packet capture..
edit: So that 88.152.35.103 is now pfsense IP?
edit2: Is pfsense VM on some other host... I don't see how your IP keeps changing... When you showed your pfsense wan it was not that IP.
That 104 address is MS
NetRange: 104.40.0.0 - 104.47.255.255
CIDR: 104.40.0.0/13
Organization: Microsoft Corporation (MSFT)Are you using MS for email? Not sure why you would be talking to MS on 25?? Even if you were using outlook or something it should be sending via ssl port. Most likely say 587
-
Its not a VM at the moment. Its a standalone machine until we find out whats going on.
And as you can see in the netflow/ipfix log that IP is used when i fetch my mails.
No MS or outlook. Mail provider is Runbox and i use Thunderbird.My father has a Windows Phone and i believe there is a MS account.
I don't know if this thing is doing something in the background.
And if yes it would show up in the firewall alerts because the ports are blocked? -
Add that host IP as a filter in the packet capture and will show only packets matching that.
Given that's not an IP on the firewall I don't expect to see any but......Setting the view to 'full' will show the MAC address on any packets with that IP that are captured. You can check it's the correct MAC for any NICs you have.
You can select 'full' view after the pcap has completed, just hit 'view capture' again to see it.Steve
