iis smtp nntp: Hello,

I have noticed over the last few weeks that my Queue gets filled up with a
couple hundred emails every day and night. I know I am not sending that
many emails nor my wife and we are the only ones with POP3 accounts. I
believe someone is using my Windows Server 2003 Pop3 to send spam. I have
restricted relay to only my IP Addresses. How can I prevent this from
happening? I just checked my Queue again and there was an email for viagra.
augh.

Is there a way to find out what IP Address is sending the messages so I
could block it?

Please Help,

Chuck

Thank you Jeff for your assistance,

I am using Anonymous Authentication. I am not sure how to require
authentication for relay. However, there is a checkbox that says allow all
computers which successfully authenticate to relay regardless of the list
above.

I have messed around with the POP3 Mail Server a lot (and still know very
little about it) and have noticed that if I make changes to my Connection
Control that I am not able to receive emails from any of my associates. I
have only added ip to the block list. I went through alot of the Queue
Emails and was able to pull some IP Addresses from them. If they are not
comming from my IP Address, is that worse than coming from my IP Address?

Below is an example of one of the details of the email:


Received: from 143921536 ([83.54.144.84]) by moon with Microsoft
SMTPSVC(6.0.3790.211);
Mon, 3 Jul 2006 02:20:57 -0700
Received: from midamerica.com (143308016 [143785208])
by 84.Red-83-54-144.dynamicIP.rima-tde.net (Qmailv1) with ESMTP id
C81D87501A
for Mark@myserver.com; Mon, 03 Jul 2006 04:18:26 -0400
Date: Mon, 03 Jul 2006 04:18:26 -0400
From: MidAmerica Bank <pw-conf@midamerica.com>
X-Mailer: The Bat! (v2.00.8) Personal
X-Priority: 3

Does this tell us anything?


Thanks,

Chuck


[quoted text, click to view]

Unfortunately the IP address sending the message is yours. It's
possible you have a trojan on the system, have you checked? It's also
probable you're still not secure in your SMTP/POP. Do you require
authentication (relay only for authenticated)?

Jeff

On Mon, 10 Jul 2006 03:22:00 -0700, "Charles A. Lackman"
[quoted text, click to view]

Unfortunately the IP address sending the message is yours. It's
possible you have a trojan on the system, have you checked? It's also
probable you're still not secure in your SMTP/POP. Do you require
authentication (relay only for authenticated)?

On Mon, 10 Jul 2006 03:59:12 -0700, "Charles A. Lackman"
[quoted text, click to view]

Check that, don't have any IP addresses in the allowed section.

[quoted text, click to view]

Well, technically email filling the queue is better than email
bouncing through your system, it's more in the annoyting category than
the disasterous one. But the IP's could be spoofed, so it's still not
that good a help.

[quoted text, click to view]

Is "mark@myserver.com" the actual address or one you changed to
protect the innocent? If the mail is headed to an account on your
system that does not exist, that's a slightly different issue. It
means your server is merely getting bombed with mail that's properly
delivered but there's no recipient. Unfortunately, with the base
SMTP/POP there aren't any spam filtering options to bounce or black
hole mail destined for non-existent users. You might find a third
party spam tool that works (I've never looked) or a third party mail
server that has this ability.

An alternative is a script that deletes any files in the queue over
xxx days old. Schedule it to run daily and the queue size may stay
manageable.

Jeff



[quoted text, click to view]