Spam emails from Nupoint

[Mitel4life]

Hello Everyone,

On occasion I will receive a voicemail notification (with audio file attached) in my inbox but no message on my phone.

The message is usually a scam/spam message. (ex: CRA scam message)

For the life of me I cannot figure out how the sender is able to bypass our network security and send this message.

The nupoint is not internet facing and is configured with SMTP email injection restrictions to: Accept only from local networks.

Anyone have any experience with this? Any info or suggestions would be appreciated.

Thanks!

[VinceWhirlwind]

Open the email, go to File, Properties, and check the headers.
Was your NuPoint even involved in the path the email took to get to your inbox?

[Mitel4life]

Hey, thanks for the reply.
Yes, the email header was checked and indicates that email send path was:
127.0.0.1 > nupoint > our internal mail server
Not sure whats up with the 127.0.0.1 source (spoofed?)
thanks

[Dogbreath]

The answer will be in the logs somewhere.

If the SMTP service says the email originated from 127.0.0.1, then the spam is not being submitted to the server with SMTP, it's being generated by something locally. So [and this is a bit of a guess] the next most likely source would be the web interface, but you say it's not internet facing?

I've never used NuPoint but if it's anything like any other MSL, web server logs will be in /var/log/httpd/. Have a look in there and see if there are any IP addresses you don't recognise.