Spoofing Attack   

One of the mailbox on E 2003 server is under spoofing attack. Someone is 
sending out spam using this mailbox email address and this user is getting 
hundreds of NDRs from other servers. How can I stop or drop these in coming 
NDRs?

date: Tue, 25 Mar 2008 11:27:01 -0700   author:   Sam

Re: Spoofing Attack   

NDR's from other server, so where exactly is the NDR coming from?  Have you 
checked the Internet Headers?  Is Recipient Filtering enabled on your 
Exchange 2003 Server?

-- 
John Oliver, Jr
MCSE, MCT, CCNA
Exchange MVP 2008
Microsoft Certified Partner


"Sam"  wrote in message 
news:CDE4B9F7-895A-46E2-BDE8-C9A7AD9C3FE8@microsoft.com...
> One of the mailbox on E 2003 server is under spoofing attack. Someone is
> sending out spam using this mailbox email address and this user is getting
> hundreds of NDRs from other servers. How can I stop or drop these in 
> coming
> NDRs?

date: Tue, 25 Mar 2008 18:52:07 -0400   author:   John Oliver, Jr. [MVP]

Re: Spoofing Attack   

It's coming from different servers. Recipient Filtering is checked and 
enabled in SMTP VS.

"John Oliver, Jr. [MVP]" wrote:

> NDR's from other server, so where exactly is the NDR coming from?  Have you 
> checked the Internet Headers?  Is Recipient Filtering enabled on your 
> Exchange 2003 Server?
> 
> -- 
> John Oliver, Jr
> MCSE, MCT, CCNA
> Exchange MVP 2008
> Microsoft Certified Partner
> 
> 
> "Sam"  wrote in message 
> news:CDE4B9F7-895A-46E2-BDE8-C9A7AD9C3FE8@microsoft.com...
> > One of the mailbox on E 2003 server is under spoofing attack. Someone is
> > sending out spam using this mailbox email address and this user is getting
> > hundreds of NDRs from other servers. How can I stop or drop these in 
> > coming
> > NDRs? 
> 
> 
>

date: Wed, 26 Mar 2008 08:47:04 -0700   author:   Sam

Re: Spoofing Attack   

Only real solution here is to get an appliance or service to perform an SPF 
lookup on the NDR and then either drop it or delete it.  Another solution 
you could use is changing the users email address.  If the user's address 
has been spoofed by a Spammer you could also try to figure out where these 
messages are coming from and try to shut it down.
-- 
John Oliver, Jr
MCSE, MCT, CCNA
Exchange MVP 2008
Microsoft Certified Partner

"Sam"  wrote in message 
news:5095BDD2-5992-4DFD-ACF6-3287B26C4706@microsoft.com...
> It's coming from different servers. Recipient Filtering is checked and
> enabled in SMTP VS.
>
> "John Oliver, Jr. [MVP]" wrote:
>
>> NDR's from other server, so where exactly is the NDR coming from?  Have 
>> you
>> checked the Internet Headers?  Is Recipient Filtering enabled on your
>> Exchange 2003 Server?
>>
>> -- 
>> John Oliver, Jr
>> MCSE, MCT, CCNA
>> Exchange MVP 2008
>> Microsoft Certified Partner
>>
>>
>> "Sam"  wrote in message
>> news:CDE4B9F7-895A-46E2-BDE8-C9A7AD9C3FE8@microsoft.com...
>> > One of the mailbox on E 2003 server is under spoofing attack. Someone 
>> > is
>> > sending out spam using this mailbox email address and this user is 
>> > getting
>> > hundreds of NDRs from other servers. How can I stop or drop these in
>> > coming
>> > NDRs?
>>
>>
>>

date: Wed, 26 Mar 2008 22:02:36 -0400   author:   John Oliver, Jr. [MVP]