[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW-1] Exchange server being used for spam?



John,

Ummm...  Are you sure these folks aren't just sending you mail?  Normally
you get (nearly) all of your inbound mail from other mail servers.  The
sender posts the mail on their local mail server, which then sends it to
the target mailserver - all via SMTP.

While I don't know much about Exchange, an easy way to check if someone's
relaying through your mail server is to inspect the logs - if your mail
server is accepting any mail from outside IP addresses that are not
addressed to your domain, then there's a potential problem.

-Robert

At 12:51 PM 11/6/01 -0800, you wrote:
>I think my Exchange Server is still being used for spamming again. I turned
>off mail relaying from following the steps in this article.  However, when I
>look through my FW logs, I see outside IP's accessing the mail server using
>the smtp service. I did a reverse lookup on some of the IP's and they return
>this:
>
>The IP number 205.188.157.37 resolves to the hostname imo-d05.mx.aol.com
>The IP number 211.21.211.179 resolves to the hostname email.mhcn.net
>The IP number 216.136.225.197 resolves to the hostname gpg3.bc.sc5.yahoo.com
>The IP number 209.167.79.88 resolves to the hostname
>uuout8smtp8.uu.flonetwork.com
>The IP number 207.217.120.12 resolves to the hostname
>harrier.mail.pas.earthlink.net
>
>They all look to be from ISP's or mail servers. Which leads me to believe
>they are spammers. Anyone know how to stop this?
>
>Thanks your help would be greatly appreciated,
>
>John
>
>===============================================
>To unsubscribe from this mailing list,
>please see the instructions at
>http://www.checkpoint.com/services/mailing.html
>===============================================
>

===============================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
===============================================