Link to home
Create AccountLog in
Avatar of rmwahab
rmwahabFlag for United Arab Emirates

asked on

How to decrease spams before reaching my network

Hi, we have Barracuda spam & Virus firewall 400, we have noticed that we are being attacked recently with huge numbers of spams from outside, for example yesterday from 5:00 PM till 2:00 AM, we have been attacked by huge number of spams.

My question, why this is happening, is this normal and how to decrease this.

My concern if the Barracuda will fail someday to protect our mail server.
Avatar of als315
als315
Flag of Russian Federation image

You had to look to logs of firewall, if you like to know reason. Some rule may be not enabled in your firewall. May be one your whitelisted senders was infected?
Settings of Spam filter always should balance between false positives and Spam.  Spammers are always trying to find ways to break spam filters. When they have succeeded, we have a lot of spam first days.
Avatar of rmwahab

ASKER

Till now Barracuda is doing the job, but I wanted to know the reason for being attacked.

The pattern shows a specific domain.

and how to prevent this from being happen.

Best regards,
Is this domain from your usual senders list?
Is sender IP address same for all mails?
Avatar of rmwahab

ASKER

No it is not from our usual senders list.

the Sender IP address is the same for all the mails.
It seems to normal sender being infected. You can add sender IP to blacklist on your firewall.
For this case of SPAM you can block it only on the content base, which is relatively difficult.
Avatar of rmwahab

ASKER

We are currently blocking them, but can we do anything to prevent them from being sent to us??
ASKER CERTIFIED SOLUTION
Avatar of als315
als315
Flag of Russian Federation image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
Avatar of Kirti_Singh
Kirti_Singh

Are you using any smtp service (Exchange server or Mail server) and check if your Exchange server is open for relay

are you using IMAP/POP profile to access Exchange server from internet ?
Avatar of rmwahab

ASKER

Yes we are using SMTP service (Exchange Server 2007) and it is NOT open for relay.

Yes we are using POP profile to access the server from Internet.

This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.