This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM 9 Advanced Threat Protection

Hello all,

Since yesterday I keep receiving these emails:

"Advanced Threat Protection

A threat has been detected in your network
The source IP/host listed below was found to communicate with a potentially malicious site
outside your company.

Details about the alert:

Threat name....: C2/Generic-A
Details........:
http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spywa[..]
Time...........: 2018-05-20 09:42:50
Traffic blocked: yes

Source IP address or host: 218.28.68.126

--
System Uptime      : 18 days 1 hour 3 minutes
System Load        : 18.25
System Version     : Sophos UTM 9.509-3

Please refer to the manual for detailed instructions.

The send limit for this notification has been reached. No further
notifications of this type will be sent during this period."

The strange thing is that the Source IP/host is different all the times and it is not a known IP for me.
I had about 20 emails since yesterday and also the UTM processor % is about 90% since yesterday.

At the moment running Sophos Virus Removal Tool on all the Windows servers but I have the idea it won't find anything.
Anyone have experienced this or can point me in the right direction?

This thread was automatically locked due to age.

Parents

0 Jay Jay over 6 years ago

That particular IP is from china. If you're not expecting any inbound traffic from there, just use country blocking. I enabled country blocking for all countries other than the US.
Cancel
Vote Up 0 Vote Down

Cancel
0 Cris Kolkman over 6 years ago in reply to Jay Jay

Hello Jay Jay,

Thank you for your reply.

Okay I will have a look at that.

Like I thought the Sophos Virus Removal Tool did not find anything on the Windows servers.

But does blocking countries also mean incoming mail from those countries will be blocked?

Kind regards
Cancel
Vote Up 0 Vote Down

Cancel
0 Jay Jay over 6 years ago in reply to Cris Kolkman

I wouldn't expect it to unless you're running a mail server locally.
Cancel
Vote Up 0 Vote Down

Cancel
0 Cris Kolkman over 6 years ago in reply to Jay Jay

Hello Jay Jay,

What do you mean with "run locally"?
The UTM is the spam/virus scanner for the Exchange server running on the same network.
They both run on a dedicated server.
Cancel
Vote Up 0 Vote Down

Cancel
0 Jay Jay over 6 years ago in reply to Cris Kolkman

Locally as in not via third party. Since you do have a local mail server, I would expect email from such countries to get blocked.

According to this, https://community.sophos.com/products/unified-threat-management/f/general-discussion/22065/rulz ,

country blocking happens early in the filtering, so I would expect emails from blocked countries to not come through.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 6 years ago in reply to Cris Kolkman

You should be able to create a Country Blocking Exception for traffic arriving on the ports that the SMTP Proxy listens for: 25, 465 & 587.

In any case, my guess is that these are computers infected with malware that makes them part of a botnet trying to break into your network. You can use https://centralops.net/co/DomainDossier.aspx to find the abuse-reporting address for each of those IPs and forward them the email alert with the notation that you're on CEST (UTC +2). One of my clients got slammed like you have been. I reported 36 infections in two days and the attack stopped.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 6 years ago in reply to Cris Kolkman

You should be able to create a Country Blocking Exception for traffic arriving on the ports that the SMTP Proxy listens for: 25, 465 & 587.

In any case, my guess is that these are computers infected with malware that makes them part of a botnet trying to break into your network. You can use https://centralops.net/co/DomainDossier.aspx to find the abuse-reporting address for each of those IPs and forward them the email alert with the notation that you're on CEST (UTC +2). One of my clients got slammed like you have been. I reported 36 infections in two days and the attack stopped.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data