| Flooded with spam in the last 24 hours [message #130783] |
Mon, 11 July 2016 17:03  |
McIrish
Messages: 256
Registered: October 2011
|
|
|
|
Are any of you being flooded with spam recently? All the spam has a subject of "Mail Delivery Subsystem". They sort of appear to be non-delivery reports but I know for sure we are not an open relay. This is happening to a handful of users in the domain. We have the latest Kerio Connect and we are running the new anti-spam module from BitDefender.
Anyone got any ideas? We are getting hundreds per hour.
|
|
|
|
|
|
| Re: Flooded with spam in the last 24 hours [message #130786 is a reply to message #130785] |
Mon, 11 July 2016 18:48  |
McIrish
Messages: 256
Registered: October 2011
|
|
|
|
Thanks Pavel,
We are using SPF. I also have the SPF filter set to add 2 to the spam score.
I just had the users who are having this problem change their domain password. One person said it helped and another said it didn't fix the problem. So, I'm still trying to figure out what is happening.
|
|
|
|
|
|
|
|
| Re: Flooded with spam in the last 24 hours [message #130823 is a reply to message #130812] |
Tue, 12 July 2016 17:54 |
McIrish
Messages: 256
Registered: October 2011
|
|
|
|
Unfortunately, I can't post any headers. I had setup a public folder for the effected users to copy the NDRs to. I used that yesterday to determine what was going on. Somehow, that public folder is empty now, which seems to be an issue all on its own. hmmmm
I had the users change passwords and I cleared the mail queue and cleared our server from being blacklisted. So far, no more problems. I'm still not quite sure how these particular users had their email user name and password stolen. The only common denominator between all those users was that they all have an iPhone and installed a recent IOS update. I wonder if after that update the next connection to the mail server was not secure and a hacker grabbed them by monitoring traffic at our public address. It's all speculation at this point. At least I got the problem to stop. It does worry me that this could happen.
|
|
|
|
Members
Search
Help
Register
Login
Home
