skyhigh pop3 traffic

[naeem]

background:

25 email accounts. Most, if not all emails are reports and short text emails. Yes guys to send/receive pictures and very rarely exceed 3 or 4 megs per attachment. I think about 10 or 20 emails like these a day.

only use Webhost (hetzner) to receive email. Sending mail is via our adsl isp (afrihost)

If i combined all 25 accounts, I'd say on average we receive about 500 emails a day. 90% of these are under 100kb's. The rest are proof of payments, spam, pdf's, and the odd photo attachments.


Now the kicker. traffic reports say we used up 90gigs of data in 10 days. Any idea why/how would could have racked up such a high amount?

 

[shakes1]

Virus?

I had an issue where the same thing was happening on a clients machine. Showed traffic on port 25, but we were on Exchange and there was no active POP accounts.

Can't remember what the name of the virus was, but it was something like a spambot. MBAM sorted it out.

 

[naeem]

Virus could be, but we would pick up the traffic on our adsl usage? daily adsl usage is about 1.5gigs a day (this is combined up and download)

90gigs over 10 days is about 9gigs a day. We would have wiped through our 50gig cap in no time.

 

[PsyWulf]

Well you use an external host,could it be a compromised pop3 account(s) being abused for outgoing?

 

[shakes1]

I'm not sure, but SMTP traffic could be counted against your cap. If this is the case, than it will be eating away...

Compromised account is a possiblity. Can you perhaps get some kind of report from your ISP?

 

[naeem]

yup they'll give it to me tomorrow.

But i think i found the problem.

We use a helpdesk script (kayako) pulls emails via pop3, and you reply via web interface. Anyway, there was about 10 emails, each with 8 to 12meg attachments (f'n chinese supplier spam)

Kayako kept timing out during the download, so it keep retrying over and over.



However, will only know for sure when i see the logs tomorrow.