Recommended Posts

Hello

I am Facing some problem with Exchange 2003 being listed sometimes on some Spam checking sites even the Network is secured with Fortinet + Symantec Antiviruses

the Problem is that Fortinet scanns coming mails but not the out mails for spam

the Server is the only one can access the Smtp

is there any free tools or tools with good price to scan the outgoing mails and solve that issue ?

Thank You

Link to comment
https://www.neowin.net/forum/topic/873020-scan-outgoing-mails-for-spam/
Share on other sites

Its rare that a client infection actually uses it email client to send email.. Off the top of the head I can not think of one that does this.. Normally a client infection will send attempt to directly send email, it doesn't go through the email client on the box to send the mail. This is too easy to track!!

I find it highly unlikely that your clients being infected and sending email through your exchange server is the problem to be honest. But if thats the case I would hope that your goal would be to clean the infected machines vs scanning for outgoing spam.

To be honest is more likely that your server is an open relay than your clients being infected - and thats how its getting placed on spam lists. Or if you server is sharing an IP with clients - then sure you IP could be listed due to a clients infection.

Could you explain a bit more about this statement

"the Server is the only one can access the Smtp"

How does email work in your setup.. So your client talk to your server to send mail, the server sends it directly to the other domains, or do you forward your mail to a isp smtp server? So which IP is getting blocked and what mail list?

put a sniffer on your network between your internet gateway and your switch where it connects. find out everything that is communicating on port 25 and monitor the blacklist sites to see when it happened last. don't have them take you off until you have verified where the spam is coming from. pretty easy to determine if you have an exchange server and someone else is sending on port 25 (no one should be other than the exchange server). I would consider GFI's mail essentials or a barracuda spam firewall at your next renewal date and dump your current spam solution (I would go with the barracuda hardware appliance vs a piece of software that you have to load on another device or on your exchange server).

Hello

I am Facing some problem with Exchange 2003 being listed sometimes on some Spam checking sites even the Network is secured with Fortinet + Symantec Antiviruses

the Problem is that Fortinet scanns coming mails but not the out mails for spam

the Server is the only one can access the Smtp

is there any free tools or tools with good price to scan the outgoing mails and solve that issue ?

Thank You

You should be able to contact the offending websites and get them to validate that the e-mail being sent is actually valid.

So you want him to email the sites blacklisting him and tell them his not sending spam? So they will remove him from the blacklist.

The problem is -- maybe he is ;)

edit: let me reword that -- if he is blacklisted its not "maybe" he is -- it pretty freaking likely that spam is being sent from his IP. If it was not, then he would not be on a blacklist ;)

So you want him to email the sites blacklisting him and tell them his not sending spam? So they will remove him from the blacklist.

The problem is -- maybe he is ;)

edit: let me reword that -- if he is blacklisted its not "maybe" he is -- it pretty freaking likely that spam is being sent from his IP. If it was not, then he would not be on a blacklist ;)

Yeah Mr. Know It All. It was just a suggestion. Which is why I suggested contacting the other ISP's.

Exchange 2003 in the default config gets abused for NDR backscatter. Make sure you've turned on recipient filtering, filter recipients that aren't in the directory, and turn on tarpitting to prevent directory harvest attacks. Disabling attachments for NDRs is nice as well, but not as important once you aren't generating them for external recipients.

"contacting the other ISP's. "

Again -- What?? :blink: Dude you seem not to have even the faintest idea on what the poster is even talking about.

So you suggest he contact the what hundreds, maybe 1000's of domains using said blacklist(s) And tell them to let his email in anyway even though its blacklisted for sending spam ;)

Its rare that a client infection actually uses it email client to send email.. Off the top of the head I can not think of one that does this.. Normally a client infection will send attempt to directly send email, it doesn't go through the email client on the box to send the mail. This is too easy to track!!

I find it highly unlikely that your clients being infected and sending email through your exchange server is the problem to be honest. But if thats the case I would hope that your goal would be to clean the infected machines vs scanning for outgoing spam.

To be honest is more likely that your server is an open relay than your clients being infected - and thats how its getting placed on spam lists. Or if you server is sharing an IP with clients - then sure you IP could be listed due to a clients infection.

Could you explain a bit more about this statement

"the Server is the only one can access the Smtp"

How does email work in your setup.. So your client talk to your server to send mail, the server sends it directly to the other domains, or do you forward your mail to a isp smtp server? So which IP is getting blocked and what mail list?

Well , I contacted the Fortinet company and we checked the device

it needed some update and it does scan both incoming and outgoing mails and the filter is on and shouldnt send or receive any

I meant that the Port SMTP isnt allowed for the Clients

only the Mail server

and no , it is not an open relay

Today I found thousands of undelivered messages sent to ebay.org and some others ( Spam Chinese mostly :s ) from inbox of Administrator ( seems Backscatter ! )

some for long time and some for no known reason !

The Server is secured using GFI mail essentials + Symantec AV + Malwarebytes

All are updated and scanning gives no warnings !

What to do !?

Now listed on http://dnsbl.invaluement.com/ivmsip/ !

they dont reply to my emails !

what to do ?

my vote is still the sniffer on the network to verify where the issue is coming from. The undeliverables could just be from another computer on your network trying to email out as administrator and you recieving the undeliverables in your administrator account.

Find out what computer is sending the spam and take care of it.

Internet router---------hub---------switch

....................................|

....................................|------computer with sniffer program scanning the traffic between your main switch and the internet

....................................=just placement since the neowin forum doesn't like spaces

Backscatter -- you sure? Can you post up some example emails that are sitting in your admin box.

Your best bet to prevent backscatter is not send NDRs, and your exchange server should also be set to not accept any mail in the first place that is not to one of listed users.. So instead of accepting the mail and than not being able to deliver it - so you send a NDR. Give them a reject right at start.

So you disable NDRs and also turn on recipient filtering so that you only accept mail for valid email address in your domain any vs anything@yourdomain

This MS article goes over these filtering. But you can also disable sending NDRs all together. You might also want to look into using a blacklist of your own so you do not accept mail from spammers ;) And then you could prob turn NDRs back on.

http://support.microsoft.com/kb/909005

In Exchange Server 2003 or in Exchange 2000 Server, the Exchange Server queues are filled with many non-delivery reports from the postmaster account because of a reverse non-delivery report attack

NDRs does not always mean backscatter -- If I am using your exchange server as an open relay and feeding it mail to send, then sure lots of mail is not going to be deliverable. You need to verify the source of your issue before you can fix it. Just because you have mail in the admin box since does not mean its actually back scatter spam that is being used against you.

We have a FortiGate as our firewall/NIS/VPN/main-connector solution, and we have it configured to only allow SMTP-out from one IP address on our network. That IP address would be our Exchange server.

We ended up needing to implement that after a situation similar to what you're experiencing.

Do you have any internal MX records? I know we had to set one up for our SharePoint server. Plus there could be other systems on your network that have an SMTP engine installed (it is a simple IIS compnent, after all); someone on your network could have an engine loaded which is relaying messages, which are hitting the gateway. Allowing SMTP from one address on the FortiGate would be a great start. Then run a domain-wide virus-sweep to find & neutralize the zombie.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • The quantum search for Time's origin had an equally mind-boggling conclusion by Sayan Sen Image by Steve Johnson via Pexels A theoretical study from researchers at the University of Surrey suggested that the direction of time may not be fundamentally fixed in certain quantum systems. The work, published in Scientific Reports, examined how the “arrow of time” could emerge from microscopic physics and found that time-reversal symmetry can remain intact even in models used to describe processes such as energy loss and thermalisation. The arrow of time refers to the observed one-way direction from past to future in everyday life. In macroscopic processes, this is easy to see. Spilled milk spreads across a table and does not gather back into a glass, and heat flows from hotter objects to colder ones. These processes shape the common sense idea that time moves in a single direction. However, at the level of fundamental physics, many equations do not prefer a direction of time. Time-reversal symmetry means that the same physical laws can describe a system whether time moves forward or backward. This has made it difficult to explain why irreversible behaviour appears in the large-scale world even when the underlying rules do not require it. Dr Andrea Rocco, Associate Professor in Physics and Mathematical Biology at the University of Surrey, described this contrast: "One way to explain this is when you look at a process like spilt milk spreading across a table, it's clear that time is moving forward. But if you were to play that in reverse, like a movie, you'd immediately know something was wrong – it would be hard to believe milk could just gather back into a glass. However, there are processes, such as the motion of a pendulum, that look just as believable in reverse. The puzzle is that, at the most fundamental level, the laws of physics resemble the pendulum; they do not account for irreversible processes. Our findings suggest that while our common experience tells us that time only moves one way, we are just unaware that the opposite direction would have been equally possible." The study focused on open quantum systems, which are quantum systems that interact with a surrounding environment. This environment, often described as a heat bath, can exchange energy and information with the system. The researchers used this framework to study how a direction of time might appear even when the underlying physics does not enforce one. A key part of the analysis involved the Markov approximation. This is a simplification used in many models where the system is assumed not to retain memory of its past states. The idea is that changes depend only on the current state, not on earlier history. This is commonly used when studying thermalisation, which is the process where a system settles into equilibrium with its environment. The study also used concepts such as master equations, including the Lindblad and Pauli equations, which describe how probabilities of different quantum states change over time. Another related model discussed was quantum Brownian motion, which describes the random-like movement of a quantum particle interacting continuously with its environment. In these descriptions, a “memory kernel” can appear, which is a mathematical term that accounts for how past states influence current behaviour. The researchers found that applying the Markov approximation did not break time-reversal symmetry. Even when the system interacted with an effectively infinite heat bath, the resulting equations of motion remained symmetric in time. This meant that the same mathematical description could, in principle, run forward or backward in time without contradiction. The study further showed that standard frameworks used in open quantum systems, including quantum Brownian motion and master equations like the Lindblad and Pauli forms, could be written in a time-symmetric way. These equations are typically used to describe processes that look irreversible, such as dissipation and thermalisation, but the results suggested they can also be interpreted as allowing evolution in both time directions. Thomas Guff, Research Fellow in Quantum Thermodynamics, said: "The surprising part of this project was that even after making the standard simplifying assumption to our equations describing open quantum systems, the equations still behaved the same way whether the system was moving forwards or backwards in time. When we carefully worked through the maths, we found that this behaviour had to be the case because a key part of the equation, the "memory kernel," is symmetrical in time. We also found a small but important detail which is usually overlooked – a time discontinuous factor emerged that kept the time-symmetry property intact. It’s unusual to see such a mathematical mechanism in a physics equation because it's not continuous, and it was very surprising to see it appear so naturally." The researchers also noted that deriving a one-way arrow of time from time-reversal symmetric microscopic dynamics remains an open problem across fields such as thermodynamics, statistical mechanics, particle physics, and cosmology. Their results suggested that some standard descriptions of irreversible behaviour in open quantum systems may be better understood using a time-symmetric formulation of Markovianity. According to the study, processes such as thermalisation, which are usually treated as irreversible, could in theory be described in a way that allows evolution in either time direction under the same rules. This does not imply that time reversal occurs in everyday life, but rather that the underlying equations do not strictly enforce a single direction. Overall, the findings suggested that the perceived direction of time may emerge from how physical systems are modelled and approximated, rather than from a fundamental asymmetry in the laws themselves. The researchers noted that this perspective could have implications for ongoing work in quantum mechanics, thermodynamics, and cosmology on the origin of time’s arrow. Source: University of Surrey, Nature This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing
    • A bit premature... 100% Marketing. Bizarre.
    • A $300 price hike is insane! No one is going to want to pay that much!
    • Since the 1st one flopped, there is really no reason to make another one. It's just losing money left and right.
  • Recent Achievements

    • Reacting Well
      BizSAR earned a badge
      Reacting Well
    • First Post
      AndreaB earned a badge
      First Post
    • Week One Done
      Huge Trailer earned a badge
      Week One Done
    • Week One Done
      Classifyskilleducation earned a badge
      Week One Done
    • One Month Later
      eurospharma62 earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      579
    2. 2
      +Edouard
      182
    3. 3
      PsYcHoKiLLa
      74
    4. 4
      Michael Scrip
      71
    5. 5
      neufuse
      64
  • Tell a friend

    Love Neowin? Tell a friend!