SPAM Sux

One of our clients recived an e-mail that they were hosting unsoliceted bulk e-mail. they said that the originating ip was the ip of the outside of the proxy. Now how the heck do i go about figuring out what workstation it is?

Topo of network
all win98se workstations
1 novell 5.0 fileserver
1 novell bordermanager server (firewall, proxy)
2500 cisco router on the outside of the firewall

there is no exchange server or groupwise server on the network.

any help would be much appreciated.

Thanks guys/gals

Proxy logs. Using POP3, SMTP, what? All should have activity logs and the such. shouldn't be too difficult.

Then again you may have an open-relay on your box. If that's the reason then anyone can use it, which is a bad thing. ORBS won't like you too much.

I think KorpDeath is on the right track. Check how your handling SMTP relaying on your BorderManager Server.


Cheers:

Thanks guys!

I like spam... its yummy...
I like spam burgers...
spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger spam burger..

Just say it repeatedly... you'll like it too....

You know where the worst spam comes from? Antionline.org email account. I signed up for it 2 weeks ago and made sure to deselect everything that said I would get junk mail, but within 24 hours I had 38 pieces of junk mail, on an email address that had never got junk mail before. I then went through all this trouble removing myself from all those mailing lists, but the next day i recieved just as much. So I just blocked all the email addresses. Today I only recieved one piece of junk mail, but that still is too much.

use sam spade from a remote location it has a relay checking feature

Has anyone tried McAfee's AntiSpam tool? I know it's quite costly, but is it worth it?

We have installed SpamAssassin on our mail server and allow our customers to turn it on if they want to. I use it and man has it worked. Dropped my spam from about 50-100/day to 1 or 2 that get through.

SpamAssasin - http://spamassassin.taint.org/

I heard of it. You may want to provide some more information on it, for others. I know I would like to hear about your experiences.

well, what it does is looks at your incoming email and looks for common elements that are usually found in spam. If the message scores higher that a set threshold it is marked as spam by rewriting the subject line to include ****SPAM*** and you can then set a email filter to move or delete it. You could make it automatically delete it but we chose not to do that because sometimes (although not too often) legitimate email gets flaged as spam. For example, it flages the antionline mailer message as spam. In those cases it supports sometihing called a white list. You can tell it to accept certain email addresses even though it scores as spam. AND the opposite is also true you can set email addressed to alsways be marked as spam even if they do not score as spam by adding them to a black list.

So far this has been the best solution to our spam problems. We used to use real time black hole lists but we have found them too unreliable and completely out of our control. This has been a much better solution for us.

Dave

I work a small ISP and we have been using spam assassin for about 2 mos. So far it works great except for one thing. Maybe you can point me to some info on it (we have searched google, the documentation available on the spam assassin web site, and several newsgroups).
Some of our customers don't like have their messages tagged (go figure, the used to complain about getting spam), and when we turn them off (all_spam_to [email protected]) it still tags messages when their e-mail address isn't in the To: or Cc: parts of the header (I'm not an expert on e-mail, and I'm not quite sure how that works but it happens).

The only solution that I think might work is to grep for their e-mail address and not run spam assassin at all if its found, but we were hoping for a more graceful solution. Oh yeah, were using it with qmail + vpopmail.

Out of curiosity, what are you using to let the customers turn it on or off themselves -- is it an in house solution or one freely available?

Thanks for any info you can give.