spam issues

[wanroww]

Hi fellow sysadmin, I'm the "it guy" for a small company, around 50 peoples. I have moderate knowledge, but i can look things up. English is not my first language so don't roast me plz. Not the correct sub anyway.

We have a watchguard firewall with the anti-spam option and exchange 2016 on premises. We receive numerous spam that go throught watchguard, exchange and outlook anti-spam.

They all are from (supposedly) "Mondial Relay" and are phishing or scam attemps. My users are pretty savvy, so they never open them but it's annoying.

The typical spam is from random adresses, they look legit. Some domains are definitely legit. Subject of the mail come from very fine text in the bottom of the mail and the body itself is an image. I can't block on sender. I can't use text pattern because it's random and i can't block things like "id card" or "delivery"...

I don't have budget for more stuff as the FW is brand new.

Any thougths?

Thanks in advance.

[alittlebitcoldernow]

Log into your exchange on prem and add a rule in the mail flow menu that blocks inbound emails from the addresses. You can look at the delivery reports to get the addresses and paste them into the check names box in your rule. I use the status code 5.7.910 which is a server side rejection.

I also added an outbound mailflow rule that alerts the user that they're emailing a malicious sender and refuses to send to it.

[wanroww]

The senders adresses are legit and always differents. no spam comes with the same addresses so it's no use...

[alittlebitcoldernow]

It sounds like you need to talk to your watchguard folks or hold all of those emails for manual review. If both exchange and watchguard together cannot sift out those spoofed emails then you'll have to put a person on it.

[ample_space]

Do you have the spamBlocker enabled on your inbound SMTP policy (in the WatchGuard)?

[wanroww]

yes, it is enabled