Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A script is currently being run against my exchange server attempting to access resources on port 25 SMTP. This is generating event 4776 within Windows event logs. How can I stop this? Would I need to block this at the firewall or at the exchange server? Do I block incoming or outgoing on port 25 (I don't want users to lose their email capability)? What if I block a specific IP address and it keeps changing? How exactly do I block these attempts and prevent this from happening in the future? As of now, the script being run against port 25 might contain some valid usernames as they are coming up in the event logs, which is preventing some users from logging in. Note: blackberry services are running on the exchange server as well.

share|improve this question

Try to block the IP at firewall level, use DROP not REJECT. Monitor, if he does it again, add that IP too.

They are probably scanning for an open relay or a way to use your mailserver as a relay for spam. Don't panic because these scans are quite common. You can try to look for IDS solutions to automatically block this behavior if it bothers you too much.

Should it be that it is not a break in attempt with spoofed IP's then it is probably a DDoS and you will need to contact your ISP. (If they want to get into your system they will be using real IP's since they want a response)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.