Are you being used as a relay or are you just being bombarded with a brute force spam attack? Brute force spam attacks usually involve a spammer sending thousands of messages to 'common' names in hope for finding real email addresses (Example: Jim, Jim1, Jim2, Jim3, JimA, JimB, JimC, Steve, Steve1, etc etc all @company.com of course). If it is a brute force spam attack, then your best bet would be to block the IP's of the spammer at your firewall so the spammer can no longer make SMTP connections to your server.
Joe Pochedley Weiler's Law - Nothing is impossible for the man who doesn't have to do it himself. -----Original Message----- From: Chris Scharff [mailto:[EMAIL PROTECTED] Sent: Wednesday, July 30, 2003 11:55 PM To: Exchange Discussions Subject: Re: Major SMTP problem, relay is blocked but still being accessed. Outbound junk from a recipient other than <>? Is your guest account enabled by chance? BTW, your Mx record is invalid, it needs to be an A record, rather than an IP address. On 07/30/03 20:55, "Chris" <[EMAIL PROTECTED]> wrote: > I have an SBS 2000 running Exchange SP3. In the past few days I have > noticed lots of junk mails in the SMTP queue and a huge amount of BadMail. > > Anyway the relay was blocked to begin with, the server is virus free, all > password have been changed, the IP has been changed. > > Right now the server is at 100% processing and loaded with spam being > relayed. What am I missing? I confirmed the relay block procedure from 2 > different sources so I am confident the relay is closed. > > It is unfirewalled, running IIS, no ISA server, 20 users on the network. > > Any ideas would be greatley appreciated. > > Thanks _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
