1

I am monitoring the outbound traffic from mail server through IDS and recently I observed there were some traffic sending to Tor Exit nodes from mail server, for example, IP 46.183.85.124. After doing some research on that ip, I did not find anything reported as malicious for IP 46.183.85.124. Does anyone know if there is any malware talking to 46.183.85.124 or any reason this could happen? Thanks.

  • It is possible, but if you post details from your IDS with information on the content and nature of the packets (is it outbound email? is it some other strange port with encrypted traffic) we can better answer your question. – Herringbone Cat May 14 '16 at 18:21
  • 1
    It could be someone using mail2tor, to keep privacy inside your network. mail2tor.com the same way could be a spam sender. – user28177 May 14 '16 at 18:56
  • Thanks. Yes. It is outbound email. All events are from mail server port 25 to random ports, for example, 45356 in 46.183.85.124. Based on the number of events received in last 24 hours (only 10 events) and frequency of the events, I do not think those traffic is sent by spambot, but thanks @nwildner, it is good to know there are some tools available to send emails through Tor. I guess probably some user just used that kind of tool to send email. – Yang Yu May 14 '16 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.