Spam Question - Server Side

StormLiong

<div class="IPBDescription">How the heck do they do it???</div> I had posted previously that a server I ran had some spam troubles (causing very severe server performance).

Since then I've shut down all local mail server activitiies and for all web mail services (ie sending mail from the website itself) now I'm using an external service.

So today (amid a flood of request from ASP users who wanted the local mail server back...silly ASP users) I went and installed Mercury SMTP server.

The moment (the very second) I started it up, it reports receiving a send request from some weird email address and sending it. In other words some spammer was already using the server as a relay.

I am like "what the heck". Do these spammers constantly check my server 24/7? Luckily it was coming from one IP address (http://www.dnsstuff.com/tools/ip4r.ch?ip=222.101.168.55) which was a known Korea spam server. So blocked that down and locked down the security for only localhost to be allowed to send.

ALthough I am stil gettin reports of other spam IP addresses trying to send mail through my server (though it fails). Most of it like <a href='http://www.dnsstuff.com/tools/ip4r.ch?ip=219.248.147.164' target='_blank'>http://www.dnsstuff.com/tools/ip4r.ch?ip=219.248.147.164</a> all Korea spam servers.

Any thoughts? What else should I do? I dunno if legal action is worth it.

jumpingjoda

Maybe you can require authorisation (username/password) before you let someone use it.

Drfuzzy

Find someone who knows how to hack, and have them haxorize/ping flood their server ^_^

StormLiong

<!--QuoteBegin-jumpingjoda+Oct 17 2004, 09:52 AM--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td><b>QUOTE</b> (jumpingjoda @ Oct 17 2004, 09:52 AM)</td></tr><tr><td id='QUOTE'><!--QuoteEBegin--> Maybe you can require authorisation (username/password) before you let someone use it. <!--QuoteEnd--> </td></tr></table><div class='postcolor'> <!--QuoteEEnd-->
Well because the mail server is primarily for web mail usage (ie for sending emails from the website), the authorisation requirement (username/password) would impede it I feel.

Shockeh

StormLiong - For your information working at an ISP, we'll happily disconnect you entirely for being an Open Relay, as should any reputable conenction provider. It is your responsibility to ensure that server cannot be used for spamming, usually with the following :

1. Only accept mail from your own domain. Why would someone @viagra.com need to send mail through you legitimately?

2. If it's webmail, don't allow SMTP connections at all, or require them to be authenticated.

3. Preferably, only accept SMTP connections from specified IP addresses, although this can be hard if you're providing a webmail service.

- Shockwave

StormLiong

Ah thanks shockwave. I totally forgetten about the open relays and found out how to close it with Mercury here (http://www.mistral.co.uk/support/howto/general/relay.asp#mercury)

It still boggles me that spammers are constantly scanning every server around. Makes me really wan to sue their **** off.