That doesn't necessarily mean that it is what's happening in your case, but it does appear to show a duplication of this.
First of all, thank you for thinking with me on this. I'm sure you are right and the test is correct.
But it's indeed not happening in my case, as I've got a default exim.conf and if it was the case, the test of either mxroute or me would show the same thing.
Ofcourse to be sure I did doublecheck, just to prevent some malware wouldn't have adjusted my exim.conf file, but I don't have any
warn verify setting present in the exim.conf.
It's not quite the same, as server 2 does not state any "unrouteable address", but that could be caused because the domain is in fact existing on server 2 in my case. It looks indeed fairly the same.
However with this test you made me thinking, and you still might be on to something.
I have encountered some lines in the logfile like this:
Code:
2023-09-03 03:35:13 SMTP call from [205.210.31.157] dropped: too many unrecognized commands (last was "")
Now I do have the "normal" attacks to local and non existing domains on server 1.
And we do have the test from ourselves, that we did not get any link to server 2. No odd things so far.
But when looking at this line, combined with the test that you did, I'm wondering if they found a method somehow, to add some commands in the smtp string (dns or other commands, I don't know) which could cause Exim to indeed use this verify callout, even if not configured in exim.conf.
Because if that is the cause, that would explain a lot of things.
Because it's only that botnet which achieves this issue, all other attacks do not get to server 2.
Could this be the case
@mxroute? It would explain why they achieve this, and we don't with our telnet tests and others also will be blocked as should be.
Edit: Found some more of these notices in the Exim mainlog, from China mainly, now more specific:
Code:
2023-08-31 05:40:30 SMTP call from [36.150.60.24] dropped: too many unrecognized commands (last was "Accept-Encoding: gzip, deflate")
2023-08-31 05:41:48 SMTP call from [205.210.31.4] dropped: too many unrecognized commands (last was "")
2023-08-31 05:42:03 SMTP call from [36.150.60.24] dropped: too many unrecognized commands (last was "Accept-Encoding: gzip, deflate")
2023-08-31 06:15:54 SMTP call from [36.150.60.24] dropped: too many unrecognized commands (last was "Accept-Encoding: gzip, deflate")
2023-08-31 13:35:15 SMTP call from [36.150.60.24] dropped: too many unrecognized commands (last was "Accept-Encoding: gzip, deflate")
2023-08-31 13:35:31 SMTP call from [36.150.60.24] dropped: too many unrecognized commands (last was "Accept-Encoding: gzip, deflate")
2023-08-31 13:37:01 SMTP call from [36.150.60.24] dropped: too many unrecognized commands (last was "Accept-Encoding: gzip, deflate")
2023-09-03 03:35:13 SMTP call from [205.210.31.157] dropped: too many unrecognized commands (last was "")
and one like this on server 2:
Code:
2023-08-27 18:49:03 SMTP call from [183.136.225.42] dropped: too many unrecognized commands (last was "Accept: */*")
And these on server 2:
Code:
2023-09-03 19:40:23 SMTP call from soda.census.shodan.io [71.6.135.131] dropped: too many syntax or protocol errors (last command was "?", NULL)
2023-09-03 19:40:23 SMTP call from soda.census.shodan.io [71.6.135.131] dropped: too many syntax or protocol errors (last command was "<C0>+<C0><AE>
<C0><AC><C0>#<C0> <C0>\b?<9A>?<C4>?<88>?<BE>?E?<9F><C0><A3><C0><9F>?k?9?<9E><C0><A2><C0><9E>?g?3?\026\001??<CF>???\022?\020??\r161.xx.xx.xx?\027???
\001?\001\001<FF>\001?\001??", NULL)
2023-09-03 19:40:24 SMTP call from soda.census.shodan.io [71.6.135.131] dropped: too many syntax or protocol errors (last command was "?\b?\035?\027?\
030?\031?\v?\002\001??#???\020?0?.\bhttp/0.9\bhttp/1.0\006spdy/1\006spdy/2\006spdy/3\003h2c\002hq?\r?\024?\022\004\003\b\004\004\001\005\003\b\005\005
\001\b\006\006\001\002\001?3?&?$?\035? <B4>E<94>+<E9><8F><DD>`<E1><F3>ڬ<CF>i'<F8><92>\032<DA>\022$<97><B2>`<C9><F5>\022<85><9D>\026", NULL)
2023-09-03 19:40:24 SMTP call from soda.census.shodan.io [71.6.135.131] dropped: too many syntax or protocol errors (last command was "?", NULL)
2023-09-03 19:40:24 SMTP call from soda.census.shodan.io [71.6.135.131] dropped: too many syntax or protocol errors (last command was "?", NULL)
2023-09-03 19:40:25 SMTP call from soda.census.shodan.io [71.6.135.131] dropped: too many syntax or protocol errors (last command was "?", NULL)
I really wonder if that is related somehow.
Edit: That one line with code has some \r161.xx.xx.xx which is the secondary ip of server 2, just noticed that.
