Link to home
Start Free TrialLog in
Avatar of kv0s
kv0sFlag for Germany

asked on

Exchange seems a "Spambomber" - but how?

Hi!

Just in a few seconds tons of messages in my queues, outgoing messages. All test "open mail relay", are okay ...

Exchange 2003 on SBS2003 ...

SMTPlog:

190.190.146.63, IFX, 02.04.2011, 23:19:34, SMTPSVC1, HEISING, 192.168.16.5, 16, 8, 305, 250, 0, EHLO, -,  IFX,
190.190.146.63, IFX, 02.04.2011, 23:19:34, SMTPSVC1, HEISING, 192.168.16.5, 31, 43, 56, 250, 0, MAIL, -,  FROM:<NO-USEs-ESTA-CUENTA@USUARIO.COM>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 29, 32, 250, 0, RCPT, -,  TO:<flujan@mailcity.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 31, 34, 250, 0, RCPT, -,  TO:<flujan@topmail.com.ar>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 29, 32, 250, 0, RCPT, -,  TO:<fluke@latinmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 27, 30, 250, 0, RCPT, -,  TO:<fluke@mixmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flukeman@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 32, 35, 250, 0, RCPT, -,  TO:<flukestime@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flukthor@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:35, SMTPSVC1, HEISING, 192.168.16.5, 0, 31, 34, 250, 0, RCPT, -,  TO:<flukycapo@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<flumedcook@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 36, 39, 250, 0, RCPT, -,  TO:<flumont_colega@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluna20835@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 30, 33, 250, 0, RCPT, -,  TO:<fluna@mailexcite.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<flunac@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<flunal@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 30, 33, 250, 0, RCPT, -,  TO:<flunazzi@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluo@latinmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:36, SMTPSVC1, HEISING, 192.168.16.5, 0, 30, 33, 250, 0, RCPT, -,  TO:<fluor_29@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 32, 35, 250, 0, RCPT, -,  TO:<fluorita.cba@iname.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluoritejo@aol.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 34, 37, 250, 0, RCPT, -,  TO:<fluoteatro@latinmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flup@mixmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluque@mixmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 29, 32, 250, 0, RCPT, -,  TO:<fluque@radar.com.ar>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 28, 31, 250, 0, RCPT, -,  TO:<fluqui@hotmail.com>,
190.190.146.63, IFX, 02.04.2011, 23:19:37, SMTPSVC1, HEISING, 192.168.16.5, 0, 26, 29, 250, 0, RCPT, -,  TO:<flurge99@aol.com>,


How can "IFX" place the messages in my queue?

Greetings, Kai
Avatar of kenmerry
kenmerry
Flag of United Kingdom of Great Britain and Northern Ireland image

Hi, I would close exchange down while you find the problem, if that is possible? Can you advise what firewalls you may be using. Have you changed all your passwords?
Do you have the guest account enabled?
Avatar of kv0s

ASKER

Hm. Afterwards a open relay check again ... and OPEN! :(
ASKER CERTIFIED SOLUTION
Avatar of connectex
connectex
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of kv0s

ASKER

It was a open relay.