Exchange 2010

Hi there,

I have a big problem in my enterprise.
We receive many spams on mailbox or diffusion lists.

I tried to test my server with openrelay, it's good.
I tried to find the source of those attacks :

50 attacks in only one minute from the same "bot"??
Seems to be external.

On our Forefront Exchange protection 2010, i got this:
Antispam block them, but sometimes, spams can bypass our antispam.
(Antispam is well configured.)

I can't blacklist those spams with theirs keywords or content... they use words that are commonly used in our enterprise.

Can you help me to find the source of this spam, maybe internal?
CLR BenjaminAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Murali ReddyExchange ExpertCommented:
You will get it from  the IP source (sender IP and Host) of the message header or Exchange Tracking logs or get it from the forfront Message details section and blocklist accordingly.

CLR BenjaminAuthor Commented:
Yes I know : sgvss.jpg
Come from external source...
How to block them?
Could it be computers in our internal network the causes of those spams?

Spams never comes from the same IP...
Murali ReddyExchange ExpertCommented:
If it is from your internal network, I doubt the message would go to forfront or any higeine system.
Virus Depot: Cyber Crime Becomes Big Business

The rising threat of malware-as-a-service is not one to be overlooked. Malware-as-a-service is growing and easily purchased from a full-service cyber-criminal store in a “Virus Depot” fashion. View our webinar recording to learn how to best defend against these attacks!

CLR BenjaminAuthor Commented:
Ok, thanks for your answer. How to block them... add baracuda?
Problem on our TMG, or rules?
Murali ReddyExchange ExpertCommented:
Add them to the blocklist, on whatever the external higiene system you are using to filter out your emails.

Rules will still allow the emails to come into your network, I wont suggets that.
CLR BenjaminAuthor Commented:
But...  spams are always different, email address, IP, subject, attached file is always different.
Every day news spams will come up...
Murali ReddyExchange ExpertCommented:
That depends on how good the spam engines updating to the latest defenitions. Check with your higiene solution provider or alter you spam rules little vigorous.
Simon Butler (Sembee)ConsultantCommented:
Everyone has a spam problem - you are not unique in that fact.
If you are seeing external IP addresses in the logs then it is coming from outside.

Keyword blocking etc is a waste of time, as is trying to block the IP address itself manually. You are need to face up to the fact that what you currently have is simply not up to the job of blocking spam based on your email profile. Every product is different, some will work well, others not so well. I would be looking to evaluate other products to see if they are more effective.

TMG is not a spam filter - you need a specific product to do the job, or outsource it to an external provider.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.