[isalist] IP Address Blocking

http://www.ISAserver.org
-------------------------------------------------------

This morning I woke up to find my exchange server on the receiving end
of a spam attack.
I've narrowed it down to a few sets of ip addresses namely 168.95.6.xxx
168.95.5.xxx and 168.95.4.xxx.

I created 3 address sets with those in mind and then went to my incoming
smtp rule and put them on the exception list. So in theory I should get
email from everyone but those sets, right? The spam is still coming in
and I look at the logs and still see those ip addresses

Is this the correct way to do this? And why isn't it working?
Let me know what you think. I have ISA 2004 running on 2003.

Thanks,
Dan

Daniel A. Crain
Systems Administrator
Dean, Ringers, Morgan & Lawton, P.A.
201 East Pine Street, Suite 1200
Orlando, FL 32801
Phone: 407-422-4310
DanC@xxxxxxxxxxxx
 

NOTE: The information contained in this message may be privileged and 
confidential and protected from disclosure. If the reader of this message is 
not the intended recipient, or an employee or agent responsible for delivering 
this message to the intended recipient, you are hereby notified that any 
dissemination, distribution or copying of this communication is strictly 
prohibited. If you have received this message in error, please notify Dan Crain 
at DanC@xxxxxxxxxxxx immediately by replying to the message and deleting it 
from your computer. Thank you.


------------------------------------------------------
List Archives: http://www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials: http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx

Other related posts: