Spam, Dead-Mail, Tracing, HELP!

[CharlieIT]

I have a Lotus Notes 5.08 server. I have verified (through a third party) that the server is not an open relay. I have hardened the server as much as I can in 5.08 against spam (configuring outbound and inbound restrictions).

However, the server console shows literally hundreds of messages coming in per minute and being denied. The utilization on a Compaq dual PIII 750 processor server (with 1GB RAM) is nearly 100% all the time (we have less than 100 users). On average, I have over 5,000 dead mails waiting PER DAY! I should also mention that I have Norton AntiVirus for Lotus Notes running on the server, and it automatically updates the latest virus definitions each night.

I would like to upgrade to the latest version of Domino, but because we have a large amount of applications running on the server which would require additional development, the upgrade will most likely not happen for quite some time.

I am willing to concede that the thousands of denied messages are simply part of living in a spam infested world, and that we need the new version of Notes which was specifically designed to help combat against this. However, before I throw up my hands and deal with this problem until I can upgrade, I want to be sure that there isn't some infected computer on my network actually sending all of this stuff to my mail server.

Is there any way within the Domino server, Lotus Notes, or even outside of Lotus Notes to determine where all of these messages are originating from?

Any suggestions you provide will be greatly appreciated.

 

[Packet7]

Hello,

There are several ways to approach this, but I have always used a sniffer (i.e. WildPackets). I simply capture all SMTP traffic during a period of time (usually a few hours), look at the logs and find the spammers, and then block the IPs on our Firewall. That way Domino doesn't even process the SMTP Helo. Some might disagree with this approach, but it has always worked for me in the past.

Keep in mind that we no longer have these issues since moving to R6. But, I have used this for during a few DOS attacks too.

Hope this helps.

Rgds,

John