&;$/&$)&/$)&$? Spammers

[The_Librarian]

What is terrible is when one has been de-blacklisted and a week later ones machine starts sending out spam again.

Then it takes weeks to resolve and one has to beg them to delist one. Horrible experience, libs does your Exchange server make use of a smart host or does it deliver mail using mx records?

We don't make use of smart hosts. Deliver direct to the Internet. But I want to change that - get ASSP to filter both incoming and outgoing mail (if possible) to ensure that we don't pump out spam by accident.

And yes, it's a horrible experience.

The one ClearOs box I set up for a client do make use of smarthosts to deliver mail, but since that box runs fetchmail to retrieve their mails from their ISP, I don't need to worry about it sending out spam. Port 25 ob that box is closed tho.

[The_Librarian]

Two weeks later and no more spammings. Yay.

I rebuilt our main Smoothwall as its IP block feature wasn't working - probably the HDD on its way out as it was a three-year old install.

I did a little Google on that IP, and found this :

http://www.bizimbal.com/odb/details.html?id=1069700

Quite interesting little busybody... seems he does a little bit here - a little bit there to stay under the radar.

I wonder if other people (Linoman etc) have the same spammer/IP as visitor...

[j4ck455]

I rebuilt our main Smoothwall as its IP block feature wasn't working - probably the HDD on its way out as it was a three-year old install.

PATA/IDE HDD?

I've had quite a few HDDs die on me over the years in IPCop/SWEx boxes.

I suspect one might have better luck with an SSD HDD now that the prices are coming down.

[The_Librarian]

PATA/IDE HDD?

I've had quite a few HDDs die on me over the years in IPCop/SWEx boxes.

I suspect one might have better luck with an SSD HDD now that the prices are coming down.

Yup, PATA

Been thinking to get one big box, RAID it, install proxmox with supported 4-port NIC and run smoothwall virtualized....



On the topic - been quiet on the spam-injecting front. Yay.

[The_Librarian]

Just checked our IP via mxtoolbox.com

All is green, not one single blacklist.

Time for a celebration, methinks

[The_Librarian]

I have reason to believe that this poxy spammer is now exploiting vulnerable PC's in order to "offload" his junk onto other servers.

Got a lovely lot of spam queues (18000+) this morning

Blacklisted IP 65.97.167.206 on firewall level.

Bah.

High time to look at ASSP. All other things gonna be shelved until I implemented it 100%.

[The_Librarian]

ASSP installed and implemented. So glad. Spam is definitely down a bit. Greylisting works wonders

This might also be a recently-discovered vulnerability in Exchange 2003 itself...

Should be interesting to hear if other Exchange 2003 admins also got the same issue or not.

[PsyWulf]

Nope,Mail Marshal and Postini are handling my pre-filtering

[The_Librarian]

twas a compromised account




A big boo-hiss for M$ programmers who don't include the IP address when you do SMTP logging

At least it's sorted out now.