• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 540
  • Last Modified:

Exchange seems a "Spambomber" - but how?

Hi!

Just in a few seconds tons of messages in my queues, outgoing messages. All test "open mail relay", are okay ...

Exchange 2003 on SBS2003 ...

SMTPlog:

190.190.146.63, IFX, 02.04.2011, 23:19:34, SMTPSVC1, HEISING, 192.168.16.5, 16, 8, 305, 250, 0, EHLO, -,  IFX,
190.190.146.63, IFX, 02.04.2011, 23:19:34, SMTPSVC1, HEISING, 192.168.16.5, 31, 43, 56, 250, 0, MAIL, -,  FROM:<NO-USEs-ESTA-CUENTA@USUARIO.COM>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 29, 32, 250, 0, RCPT, -,  TO:<flujan@mailcity.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 31, 34, 250, 0, RCPT, -,  TO:<flujan@topmail.com.ar>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 29, 32, 250, 0, RCPT, -,  TO:<fluke@latinmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 27, 30, 250, 0, RCPT, -,  TO:<fluke@mixmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flukeman@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 32, 35, 250, 0, RCPT, -,  TO:<flukestime@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flukthor@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 31, 34, 250, 0, RCPT, -,  TO:<flukycapo@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<flumedcook@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 36, 39, 250, 0, RCPT, -,  TO:<flumont_colega@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluna20835@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 30, 33, 250, 0, RCPT, -,  TO:<fluna@mailexcite.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<flunac@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<flunal@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 30, 33, 250, 0, RCPT, -,  TO:<flunazzi@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluo@latinmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 30, 33, 250, 0, RCPT, -,  TO:<fluor_29@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 32, 35, 250, 0, RCPT, -,  TO:<fluorita.cba@iname.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluoritejo@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 34, 37, 250, 0, RCPT, -,  TO:<fluoteatro@latinmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flup@mixmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluque@mixmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 29, 32, 250, 0, RCPT, -,  TO:<fluque@radar.com.ar>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluqui@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flurge99@aol.com>,


How can "IFX" place the messages in my queue?

Greetings, Kai
0
kv0s
Asked:
kv0s
  • 2
  • 2
1 Solution
 
kenmerryCommented:
Hi, I would close exchange down while you find the problem, if that is possible? Can you advise what firewalls you may be using. Have you changed all your passwords?
0
 
connectexCommented:
Do you have the guest account enabled?
0
 
kv0sAuthor Commented:
Hm. Afterwards a open relay check again ... and OPEN! :(
0
 
connectexCommented:
How are you checking for an open relay? Also have you forced the users to change their passwords? One bad password could be allowing the relay to happen.

-Matt-
0
 
kv0sAuthor Commented:
It was a open relay.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now