Incoming Blocked website on port25

[CWhitehead]

Hi All, I hope someone can help.

I am new to malwarebytes on a corporate network and it has only been installed for about a week.

I have just started receiving lots of emails about Malwarebytes blocking a website.

 

31/08/2017 09:33:56       MICKEY 192.168.50.2       Type: incoming, Port: 25, Process: edgetransport.exe      Blocked web site         191.101.31.249

The machine is  a SBS2011 server running exchange.

The IP that has been blocked has a bad reputation for spam and i do not know if that is relevant.

Should i be concerned?  Is it blocking mails from a server i should actually be receiving and dealing with using an anti spam utility or is this an attempt to login somehow to our exchange backend?

Any help or advice greatly appreciated.

[djacobson]

Hi @CWhitehead, what's happening here is a denial by Malwarebytes to allow a connection to a known IP on a blacklist for hosting malicious content. No emails are being blocked. This was most likely an attempt to get into your backend or port scan you since the port is low and the type is incoming.

[djacobson]

To add, there's nothing you really need to do here unless you want to deny that IP and setup some sort of hard block on a network appliance. Otherwise, Malwarebytes did its job and will continue to block that if it tries again.

[CWhitehead]

Thanks for that,  This is what i assumed but i just could not find any information of that sort of denial.

Thanks for setting my mind at rest and for the excellent product.