Receiving spam email from spoofed internal sender on Exchange 2010 SP3 with Symantec Mail Gateway
People,
I'm confused and need your help here with the issue of receiving internally spoofed spam address but the IP address is kept on changing from country to country.
The Email is filtered first by Symantec Email Gateway appliance and then forwarded to the Exchange Server. But I'm not sure if this is Exchange Server issue or Symantec problem ?
When I read this blog, it suggest the below powershell script:
Get-ReceiveConnector “My Internet ReceiveConnector” | Get-ADPermission -user “NT AUTHORITY\Anonymous Logon” | where {$_.ExtendedRights -like “ms-exch-smtp-accept-authoritative-domain-sender”} | Remove-ADPermission
So I'm confused which Receive connector should I be running the powershell script against ?
What's the roll back plan if email flow is affected when executing the wrong powershell against incorrect Receive connector ?
Thanks,
ExchangeAntiSpamEmail Servers
Last Comment
arnold
8/22/2022 - Mon
Albert Widjaja
ASKER
Note:
10.1.2.89 --> the load balancer virtual IP and the Windows NLB name email.domain.com
10.1.2.90 --> MAIL01-VM IP address (HT/CAS role)
10.1.2.91 --> MAIL02-VM IP address (HT/CAS role)
arnold
The generation of the email is neither the fault of the gateway nor exchange.
I am not sure I understand what you are looking to accomplish.
If the issue is a configuration question on the Symantec gateway, you could remove a rule if you gave whitelisting your internal addresses.
You could impose a rule on the gateway to reject/sequester any email whose sender is on the internal domain.
Albert Widjaja
ASKER
The problem is that more than half of my users received email from network-scanner@mydomain.com from which the IP address of the sender is kept on changing along with te subject.
It sends malicious MS Word document with Macro in it.
So how to block the mail coming from external IP while the sender is spoofed from my internal domain.com ?
Note:
When I execute this powershell command Get-TransportServer | Get-Queue, there is no email send or receive queue.
Is the ip that connects to your Symantec gateway outside your LAN?
Looking at the message trace on exchange as well as on the email gateway ....
The sender email is not verified only the destination is.
It is likely that if you have an mfc that has scan to email capability and it is using the network-scanner@mydomain.com it means that a scan to email was used once and sent to a user whose system became infected .........
What do you want to do?
If your users and policy is that any email using mydomain.com has to use the outgoing mail server that is separate from the MX, you can impose a rule on the gateway not to accept any email from a sender on the mydomain.com.
Albert Widjaja
ASKER
Hi Arnold,
I've verified with multiple site offices, there is no MFC or scanner devices with the email sender as network-scanner@domain.com.
This spam issue is happening since yesterday and bombards most of my users companywide.
The IP that connects to my Symantec Gateway appliance is the same as the IP VLAN of the Exchange Servers. (same within the same VLAN).
But the email sender IP address which says the sender from network-scanner@domain.com always comes from external public IP address randomly.
What options do you have configured on your gateway?
Do you currently impose restrictions I.e. Spam, virus blocking?.
It looks as though the messages in question are a result of features on Symantec gateway. I.e. Messages determined to be spam, virus laden get marked and sent from network.scanner@domain.com to prevent bounce backs
What logs you have on the gateway?
Look at the last received line deals with gateway connecting to the server that actually delivered the message to the recipient.
Look on that system for the SMTP connector that is listening on port 25 and bound to 10.1.2.89 or 0.0.0.0 meaning it listens on port 25 of every ip the system has.
Albert Widjaja
ASKER
ok, from Exchange Message Tracking log it is coming from this one connector:
Arnold, my expectation is to stop or block this email with malicious attachment from network.scanner@domain.com
if it is spoofed from the internal then it won't be in the Symantec Messaging gateway.
if it is coming from the outside which is more likely, then why it is going through the Symantec Mail Gateway ? --> this is still a mystery.
arnold
Check the configuration of your Symantec gateway as that is where the block gas to be imposed.
By the look of the message detail the information contained there is :
1) the external source server 37.
2) the message went through the email gateway,
3) delivered to the exchange server.
Brightmailtracker I think is the header the Symantec email gateway sets.
Compare the detail of a regularly received email that is external in origin.
arnold
Your question in why it is going through email gateway presumably your configuration is
10.1.2.89 --> the load balancer virtual IP and the Windows NLB name email.domain.com
10.1.2.90 --> MAIL01-VM IP address (HT/CAS role)
10.1.2.91 --> MAIL02-VM IP address (HT/CAS role)