UTM 9 Advanced Threat Protection

That particular IP is from china.  If you're not expecting any inbound traffic from there, just use country blocking.  I enabled country blocking for all countries other than the US.

Hello Jay Jay,

Thank you for your reply.

Okay I will have a look at that.

Like I thought the Sophos Virus Removal Tool did not find anything on the Windows servers.

But does blocking countries also mean incoming mail from those countries will be blocked?

Kind regards

I wouldn't expect it to unless you're running a mail server locally.

Hello Jay Jay,

What do you mean with "run locally"?
The UTM is the spam/virus scanner for the Exchange server running on the same network.
They both run on a dedicated server.

Locally as in not via third party. Since you do have a local mail server, I would expect email from such countries to get blocked.

According to this, https://community.sophos.com/products/unified-threat-management/f/general-discussion/22065/rulz ,

country blocking happens early in the filtering, so I would expect emails from blocked countries to not come through.

You should be able to create a Country Blocking Exception for traffic arriving on the ports that the SMTP Proxy listens for: 25, 465 & 587.

In any case, my guess is that these are computers infected with malware that makes them part of a botnet trying to break into your network.  You can use https://centralops.net/co/DomainDossier.aspx to find the abuse-reporting address for each of those IPs and forward them the email alert with the notation that you're on CEST (UTC +2).  One of my clients got slammed like you have been.  I reported 36 infections in two days and the attack stopped.

Cheers - Bob