Security vulnerability exploitation attempt source is internal exchange address

[Michelle911 0]

I have two entries in my network protection log where the source is my internal ip for the exchange server - port 25 - user NTAuthority - application frontendtransport. I have run a scan and it is clean. How do I track this down?

[Marcos 5,074]

Please copy and paste the record you are inquiring about from the Network protection log.

[Marcos 5,074]

Please copy and paste the record you are inquiring about from the Network protection log.

[Michelle911 0]

See attached screenshot

[Marcos 5,074]

I assume those IP addresses are not known to you, are they? They are swapped in the log which is a known bug and will be fixed soon.

[Michelle911 0]

No those IP addresses are not known to me. It's alarming to see my machine as the source!

[Marcos 5,074]

6 minutes ago, Michelle911 said:

No those IP addresses are not known to me. It's alarming to see my machine as the source!

As I wrote, your server is not the source and it's just that the IP addresses are swapped in the log for this particular detection. ESET detected and blocked exploitation attempts from those IP addresses.