That is exactly what they are doing. Faking the IP address so it looks like
it is sending internally.
Although when you say:
the way we solved it was by putting in each ip and or subnet as we went
along.. much more tedious..
Could you be more specific?
Thanks for the quick response!!!
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Simon
Sent: Tuesday, February 22, 2000 6:30 PM
To: [EMAIL PROTECTED]
Subject: RE: [IMail Forum] I am getting killed by spammers relaying on
my servers.
we had that very same problem.. it seemed that messages were only able
to be sent to our internal network & virtual hosts, but from one of the
spam 'authorities' we were sent an example of how the 'spammers' managed
to get by, the first two attempts at using our mailserver as a relay were
denied, then the 3rd time, it faked our IP so that it looked like it was
coming thru our internal network - this was using imail 5.08 or something.
the way we solved it was by putting in each ip and or subnet as we went
along.. much more tedious.. with what shuld have been the same result using
relay mail for local hosts only.
simon
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Scott Bishop
> Sent: Wednesday, 23 February 2000 10:54
> To: [EMAIL PROTECTED]
> Subject: [IMail Forum] I am getting killed by spammers relaying on my
> servers.
>
>
> I have several options selected
>
>
> smtp security
> relay mail for internal addresses only (on my network)
> allow remote mail to local groups is checked.
> check valid sender is checked
> aut deny possible hack attempts is checked.
> disable smtp vrfy command is checked.
>
> people are still able to relay mail from my server without authenticating.
> Im about 1 day away from my UPPER ISP providor filtering mail to
> my servers
> cause I cant stop the spam! I have even denied access to the offenders
> causing the spam, and emailed the proper authorites. But new spam servers
> pop up everyday relaying through my secured smtp server (secured hah)
>
>
> Ive been at this for 5 days. Can I get any suggestions??
>
>
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
