Lemonde
  • Lemonde
  • Advanced Member Topic Starter
a year ago
What is this message to do with is it a virus?

exchange 2007 the observed forged helo value was keqakku.com

Thank you for contacting Spamhaus CSS Removals,

A device (server, computer, mobile phone, etc), or an app on a device

that is using x.x.x.x. is infected, insecure or compromised. It is

making SMTP connections on port 25 with forged values.

(IP, UTC timestamp, forged HELO value)

2021-02-16 08:20:00 keqakku.com

2021-02-09 07:55:00 keqakku.com

The first detection was (UTC)

The last detection was (UTC)

To stop the abuse immediately, close outbound port 25 on the router or

firewall and restrict port 25 access to known email servers. Note: this

will only prevent the abusive connections from leaving your network.

If the problem is (for example) an infected mobile phone, when it moves

to another insecure network, it will resume its activity without restriction.

To find and eliminate the source of the problem, please see the our FAQs:

Is it a client machine spamming from the LAN?


Sponsor

Want to thank us? Use: Patreon or PayPal or Bitcoins: 12G4A52Znm5s35buKDEmKU2p2vQY69Nsyo

All opinions expressed within these pages are sent in by members of the public or by our staff in their spare time, and as such do not represent any opinion held by sircles.net Ltd or their partners.

andrewt2m
a year ago
Just to say that we blocked SMTP traffic going out except for the email server and scanned all of the PCs.

Didn't find any viruses but the blocking of the SMTP traffic seemed to stop the issue so it could've been a mobile device on the Wi=Fi sending out spam or something...?