Author Topic: Spam emails from Nupoint  (Read 1185 times)

Offline Mitel4life

  • New Member
  • *
  • Posts: 2
  • Country: ca
  • Karma: +0/-0
    • View Profile
Spam emails from Nupoint
« on: November 19, 2018, 04:28:14 PM »
Hello Everyone,

On occasion I will receive a voicemail notification (with audio file attached) in my inbox but no message on my phone.

The message is usually a scam/spam message. (ex: CRA scam message)

For the life of me I cannot figure out how the sender is able to bypass our network security and send this message.

The nupoint is not internet facing and is configured with SMTP email injection restrictions to: Accept only from local networks.

Anyone have any experience with this? Any info or suggestions would be appreciated.

Thanks!


Offline VinceWhirlwind

  • Hero Member
  • *****
  • Posts: 899
  • Country: au
  • Karma: +31/-0
    • View Profile
Re: Spam emails from Nupoint
« Reply #1 on: November 19, 2018, 07:07:46 PM »
Open the email, go to File, Properties, and check the headers.
Was your NuPoint even involved in the path the email took to get to your inbox?

Offline Mitel4life

  • New Member
  • *
  • Posts: 2
  • Country: ca
  • Karma: +0/-0
    • View Profile
Re: Spam emails from Nupoint
« Reply #2 on: November 20, 2018, 07:47:27 AM »
Hey, thanks for the reply.
Yes, the email header was checked and indicates that email send path was:
127.0.0.1 > nupoint > our internal mail server
Not sure whats up with the 127.0.0.1 source (spoofed?)
thanks

Offline Dogbreath

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 396
  • Country: gb
  • Karma: +18/-0
    • View Profile
Re: Spam emails from Nupoint
« Reply #3 on: November 21, 2018, 06:00:21 AM »
The answer will be in the logs somewhere.

If the SMTP service says the email originated from 127.0.0.1, then the spam is not being submitted to the server with SMTP, it's being generated by something locally. So [and this is a bit of a guess] the next most likely source would be the web interface, but you say it's not internet facing?

I've never used NuPoint but if it's anything like any other MSL, web server logs will be in /var/log/httpd/. Have a look in there and see if there are any IP addresses you don't recognise.


 

Sitemap 1 2 3 4 5 6 7 8 9 10