Possible Spam Bot infection in Grommunio 2025.1.2

MattP

A few days ago i ran a system update from 2025.1.1 to 2025.1.2 and now there something spamming 100s of SMTP message out of my system every few seconds.
I'm at the very early stages of trying to find out if or how my systems have got infected, so i only have limited logs and evidence. This is a small home system with just a few users.

Evidence:

I can see loads of outgoing SMTP traffic direct from my Grommunio server to the internet, which ive blocked on my firewall
Running a PCAP dump on the Grommunio servers shows all the spambot traffic originates on the same host. No incoming traffic to the Grommunio server matches the outgoing SMTP traffic, so i'm confident my Grommunio server is not being abused as a relay.
Reverting back to a Veeam backup from a few days ago to version 2025.1.1 clears the issue.

Starting this conversation to see if anyone else has seen the same issue.
I will continue to get more logs and evidence to find out where and how this has happened

MattP

some Firewall logs of the blocked outgoing traffic
10.100.40.31 is my Grommunio server

May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:11 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 May 18 14:25:12 site-b.ffptech.com site-b: [FILTER][Block][LAN/RT/VPN->WAN, 63:16:47 ][@S:R=11:4, 10.100.40.31:53910->69.168.106.65:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4190535139, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:38098->52.101.68.32:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2895393801, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:34226->66.96.140.73:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2049634374, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:42730->208.87.234.190:25][TCP][HLen=20, TLen=60, Flag=S, Seq=782908150, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:48580->52.101.11.19:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3014159614, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:49180->52.101.9.0:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2021301250, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:49508->207.54.87.23:25][TCP][HLen=20, TLen=60, Flag=S, Seq=705770960, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:47820->52.101.11.2:25][TCP][HLen=20, TLen=60, Flag=S, Seq=308323406, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:41026->74.208.5.21:25][TCP][HLen=20, TLen=60, Flag=S, Seq=456318730, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:42644->52.101.41.0:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3269768796, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:56342->34.196.98.39:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1849079843, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:52494->108.166.43.1:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2266436677, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:37428->52.101.42.4:25][TCP][HLen=20, TLen=60, Flag=S, Seq=365055469, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:59974->204.101.223.58:25][TCP][HLen=20, TLen=60, Flag=S, Seq=128553446, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:49718->41.185.250.90:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3242127123, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:58528->52.101.68.8:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1681798174, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:42634->52.101.41.0:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3021369454, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:57588->52.101.8.42:25][TCP][HLen=20, TLen=60, Flag=S, Seq=302412509, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:40652->52.101.9.21:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2645163379, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:53566->23.227.38.65:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2316031814, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:59070->218.102.23.37:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3808316059, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:47018->52.101.190.0:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3298836930, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:39926->52.101.42.13:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3016756041, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:46076->184.106.54.1:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4051591600, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:40098->210.123.92.147:25][TCP][HLen=20, TLen=60, Flag=S, Seq=885371057, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:50350->65.21.218.242:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3249272571, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:49078->34.64.35.97:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1714845303, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:42058->52.101.73.6:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2378742077, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:48236->218.159.114.226:25][TCP][HLen=20, TLen=60, Flag=S, Seq=276266550, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:59980->204.101.223.58:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4250188638, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:49688->68.232.148.156:25][TCP][HLen=20, TLen=60, Flag=S, Seq=940820160, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:49902->52.101.194.15:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1896933413, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:44370->52.101.8.34:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4261547426, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:35510->52.101.194.17:25][TCP][HLen=20, TLen=60, Flag=S, Seq=326031844, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:46868->52.101.40.4:25][TCP][HLen=20, TLen=60, Flag=S, Seq=89970320, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:42120->52.101.10.14:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1176426650, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:60130->52.101.42.13:25][TCP][HLen=20, TLen=60, Flag=S, Seq=552081238, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:60776->85.115.56.190:25][TCP][HLen=20, TLen=60, Flag=S, Seq=522031416, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:54322->52.101.192.1:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3391574695, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:55654->52.101.124.117:25][TCP][HLen=20, TLen=60, Flag=S, Seq=275554504, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:38748->52.101.192.0:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2799013931, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:55472->41.61.250.30:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2129253267, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:48564->52.101.10.1:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4223615608, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:38742->52.101.192.0:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1422773380, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:49098->52.101.157.80:25][TCP][HLen=20, TLen=60, Flag=S, Seq=378974205, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:52628->52.101.9.5:25][TCP][HLen=20, TLen=60, Flag=S, Seq=534285309, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:58212->217.26.49.138:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2446021486, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:48252->193.171.87.211:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4039755363, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:43710->218.102.23.219:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1784639144, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:35416->52.101.68.10:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3687828258, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:53924->69.168.106.65:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1526001902, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:37442->52.101.42.4:25][TCP][HLen=20, TLen=60, Flag=S, Seq=527757864, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:42796->204.101.223.58:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1441039251, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:41554->51.81.171.231:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3684274364, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:37756->52.101.68.36:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2431556532, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:58308->216.71.136.131:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4002623041, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:48398->41.185.249.20:25][TCP][HLen=20, TLen=60, Flag=S, Seq=1529749952, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:37960->52.101.145.2:25][TCP][HLen=20, TLen=60, Flag=S, Seq=3121803515, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:47062->34.97.239.115:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2716029920, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:51756->52.101.145.2:25][TCP][HLen=20, TLen=60, Flag=S, Seq=2637698041, Ack=0, Win=64240]
][@S:R=11:4, 10.100.40.31:37452->52.101.42.4:25][TCP][HLen=20, TLen=60, Flag=S, Seq=4197945131, Ack=0, Win=64240]

MattP

Some postfix logs:

May 18 14:33:07 mail2 postfix/qmgr[1996]: 170EC6A5E57: from=fiset@ffptech.com, size=2247, nrcpt=1 (queue active)
May 18 14:33:07 mail2 postfix/smtp[15367]: connect to crexendo-com.mail.protection.outlook.com[52.101.41.0]:25: Connection timed out
May 18 14:33:07 mail2 postfix/smtp[15367]: connect to crexendo-com.mail.protection.outlook.com[2a01:111:f403:f901::2]:25: Network is unreachable
May 18 14:33:07 mail2 postfix/smtp[15367]: 6A25D162B48B: to=smihaylo@crexendo.com, relay=none, delay=148191, delays=145770/2361/60/0, dsn=4.4.1, status=deferred (connect to crexendo-com.mail.protection.outlook.com[2a01:111:f403:f901::2]:25: Network is unreachable)
May 18 14:33:07 mail2 postfix/qmgr[1996]: 1C1036A6921: from=fiset@ffptech.com, size=2251, nrcpt=1 (queue active)
May 18 14:33:07 mail2 postfix/smtp[15418]: connect to mta7.am0.yahoodns.net[67.195.228.106]:25: Connection timed out
May 18 14:33:07 mail2 postfix/smtp[15557]: connect to buffalocopy-com.mail.protection.outlook.com[52.101.42.16]:25: Connection timed out
May 18 14:33:07 mail2 postfix/smtp[15557]: connect to buffalocopy-com.mail.protection.outlook.com[2a01:111:f403:c801::1]:25: Network is unreachable
May 18 14:33:07 mail2 postfix/smtp[15557]: connect to buffalocopy-com.mail.protection.outlook.com[2a01:111:f403:c946::6]:25: Network is unreachable
May 18 14:33:07 mail2 postfix/smtp[15506]: connect to cornell-edu.mail.protection.outlook.com[52.101.8.36]:25: Connection timed out
May 18 14:33:07 mail2 postfix/smtp[15521]: connect to sapguae-com.mail.protection.outlook.com[52.101.148.3]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15499]: connect to beneficialhealthinsurance-com.mail.protection.outlook.com[52.101.10.14]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15499]: connect to beneficialhealthinsurance-com.mail.protection.outlook.com[2a01:111:f403:f907::]:25: Network is unreachable
May 18 14:33:08 mail2 postfix/smtp[15499]: connect to beneficialhealthinsurance-com.mail.protection.outlook.com[2a01:111:f403:f901::]:25: Network is unreachable
May 18 14:33:08 mail2 postfix/smtp[15499]: 2A39A12B1CFD: to=dominic@beneficialhealthinsurance.com, relay=none, delay=65459, delays=63038/2361/60/0, dsn=4.4.1, status=deferred (connect to beneficialhealthinsurance-com.mail.protection.outlook.com[2a01:111:f403:f901::]:25: Network is unreachable)
May 18 14:33:08 mail2 postfix/smtp[15528]: connect to rigorbiz-pt.mail.protection.outlook.com[52.101.73.1]:25: Connection timed out
May 18 14:33:08 mail2 postfix/qmgr[1996]: 130EF6A9A20: from=fiset@ffptech.com, size=2261, nrcpt=1 (queue active)
May 18 14:33:08 mail2 postfix/smtp[15562]: connect to dhabienterprises-ae.mail.protection.outlook.com[52.101.148.13]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15562]: connect to dhabienterprises-ae.mail.protection.outlook.com[2a01:111:f403:cc30::3]:25: Network is unreachable
May 18 14:33:08 mail2 postfix/smtp[15562]: connect to dhabienterprises-ae.mail.protection.outlook.com[2a01:111:f403:cc30::1]:25: Network is unreachable
May 18 14:33:08 mail2 postfix/smtp[15562]: 2B4931676AC0: to=azhar.leasing@dhabienterprises.ae, relay=none, delay=146778, delays=144357/2361/60/0, dsn=4.4.1, status=deferred (connect to dhabienterprises-ae.mail.protection.outlook.com[2a01:111:f403:cc30::1]:25: Network is unreachable)
May 18 14:33:08 mail2 postfix/qmgr[1996]: 129056A26E0: from=fiset@ffptech.com, size=2253, nrcpt=1 (queue active)
May 18 14:33:08 mail2 postfix/smtp[15501]: connect to eateam-com.e-v1.mx.microsoft[52.101.194.0]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15318]: connect to mx00.ionos.com[74.208.5.3]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15318]: 2C9181122865: to=gerald@logikalconsulting.com, relay=none, delay=106104, delays=103683/2361/60/0, dsn=4.4.1, status=deferred (connect to mx00.ionos.com[74.208.5.3]:25: Connection timed out)
May 18 14:33:08 mail2 postfix/qmgr[1996]: 1E30B6A26E9: from=fiset@ffptech.com, size=2257, nrcpt=1 (queue active)
May 18 14:33:08 mail2 postfix/smtp[15459]: connect to cornell-edu.mail.protection.outlook.com[52.101.8.36]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15489]: connect to mx.csic.es[161.111.10.17]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15489]: 2F8536EB84B: to=a.martinez@csic.es, relay=none, delay=167685, delays=165264/2391/30/0, dsn=4.4.1, status=deferred (connect to mx.csic.es[161.111.10.17]:25: Connection timed out)
May 18 14:33:08 mail2 postfix/qmgr[1996]: 1039A6A9F93: from=fiset@ffptech.com, size=2259, nrcpt=1 (queue active)
May 18 14:33:08 mail2 postfix/smtp[15490]: connect to ariosaco-net.mail.protection.outlook.com[52.101.194.17]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15490]: 42092127691F: to=rariosa@ariosaco.net, relay=none, delay=156732, delays=154311/2361/60/0, dsn=4.4.1, status=deferred (connect to ariosaco-net.mail.protection.outlook.com[52.101.194.17]:25: Connection timed out)
May 18 14:33:08 mail2 postfix/qmgr[1996]: 1A6176A9FBC: from=fiset@ffptech.com, size=2249, nrcpt=1 (queue active)
May 18 14:33:08 mail2 postfix/smtp[15566]: connect to mx1.bancsabadell.c3s2.iphmx.com[139.138.36.74]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15512]: connect to mx002.bluehost.xion.oxcs.net[135.148.130.76]:25: Connection timed out
May 18 14:33:08 mail2 postfix/smtp[15512]: 24105909668: to=banking@skylfinsavings.com, relay=none, delay=94223, delays=91801/2361/60/0, dsn=4.4.1, status=deferred (connect to mx002.bluehost.xion.oxcs.net[135.148.130.76]:25: Connection timed out)

MattP

updated the restored VM to 2025.1.2, no sign of any infection, will keep monitoring.
But this looks like some drive by browser infection possibly affecting the Admin Web page

I did notice after the update that my https://Grommunio:8443 admin page crashed with some NULL exceptions.
Maybe this was the infection happening from my laptop.
Possible Cross-Site scripting vulnerability in the admin UI ?

WalterH

MattP https://Grommunio:8443

I hope, port 8443 is not exposed to the internet.

MattP

no its only internally accessible behind a FW
I am the only person who can access it, so all i can assume is there was something nasty waiting in my browser which managed to exploit the Admin UI
Unfortunately i cant find any definite evidence 🙁

Grommunio restored from Backup, updated to the latest again
Admin laptop bas been flattened and rebuilt

All working fine now 🙂

MattP

The SpamBot infection is back again!
Where are the Admin UI logs located ?
i need to see what has interacted with the Admin UI in the past 12 hours

WalterH

Two logs available:

journalctl -f
tail -f /var/log/nginx/*.log

MattP

Looks like it was a bad configuration.
Until last week i has a NAT direct from my router to the Grommunio appliance, where the Masquerading Rules are set up correctly.
Then i moved the appliance behind a NetScaler load balancer which was simply forwarding the packets from an internal IP address. I hadn't noticed that Postfix in the appliance allows message relay in local networks!

Thanks to this post i was able to work it out 🙂
https://community.grommunio.com/d/1892-open-relay-on-grommunio-appliance/12

Please mark this thread as solved. It was a bad configuration