UTM 9 Advanced Threat Protection

That particular IP is from china.  If you're not expecting any inbound traffic from there, just use country blocking.  I enabled country blocking for all countries other than the US.

Hello Jay Jay,

Thank you for your reply.

Okay I will have a look at that.

Like I thought the Sophos Virus Removal Tool did not find anything on the Windows servers.

But does blocking countries also mean incoming mail from those countries will be blocked?

Kind regards

Hello Jay Jay,

Thank you for your reply.

Okay I will have a look at that.

Like I thought the Sophos Virus Removal Tool did not find anything on the Windows servers.

But does blocking countries also mean incoming mail from those countries will be blocked?

Kind regards

I wouldn't expect it to unless you're running a mail server locally.

Hello Jay Jay,

What do you mean with "run locally"?
The UTM is the spam/virus scanner for the Exchange server running on the same network.
They both run on a dedicated server.

Locally as in not via third party. Since you do have a local mail server, I would expect email from such countries to get blocked.

According to this, https://community.sophos.com/products/unified-threat-management/f/general-discussion/22065/rulz ,

country blocking happens early in the filtering, so I would expect emails from blocked countries to not come through.

You should be able to create a Country Blocking Exception for traffic arriving on the ports that the SMTP Proxy listens for: 25, 465 & 587.

In any case, my guess is that these are computers infected with malware that makes them part of a botnet trying to break into your network.  You can use https://centralops.net/co/DomainDossier.aspx to find the abuse-reporting address for each of those IPs and forward them the email alert with the notation that you're on CEST (UTC +2).  One of my clients got slammed like you have been.  I reported 36 infections in two days and the attack stopped.

Cheers - Bob