A script is currently being run against my exchange server attempting to access resources on port 25 SMTP. This is generating event 4776 within Windows event logs. How can I stop this? Would I need to block this at the firewall or at the exchange server? Do I block incoming or outgoing on port 25 (I don't want users to lose their email capability)? What if I block a specific IP address and it keeps changing? How exactly do I block these attempts and prevent this from happening in the future? As of now, the script being run against port 25 might contain some valid usernames as they are coming up in the event logs, which is preventing some users from logging in. Note: blackberry services are running on the exchange server as well.


Try to block the IP at firewall level, use DROP not REJECT. Monitor, if he does it again, add that IP too.

They are probably scanning for an open relay or a way to use your mailserver as a relay for spam. Don't panic because these scans are quite common. You can try to look for IDS solutions to automatically block this behavior if it bothers you too much.

Should it be that it is not a break in attempt with spoofed IP's then it is probably a DDoS and you will need to contact your ISP. (If they want to get into your system they will be using real IP's since they want a response)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.