would have to agree. mailessentials. Here is a report from our MailEssentials... Date range : 7/1/2003 to 7/31/2003 Day Total Processed Total Spam Keyword Checking Header Checking Blacklist Spam Percentage 7/1/2003 1807 1016 448 199 369 56% 7/2/2003 1801 1033 442 136 455 57% 7/3/2003 1687 793 239 90 464 47% 7/4/2003 801 370 0 0 370 46% 7/5/2003 686 345 0 0 345 50% 7/6/2003 681 365 0 0 365 54% 7/7/2003 1742 895 329 97 469 51% 7/8/2003 2083 1176 475 172 529 56% 7/9/2003 1978 1106 450 140 516 56% 7/10/2003 2017 1137 453 155 529 56% 7/11/2003 1820 986 374 124 488 54% 7/12/2003 892 710 212 80 418 80% 7/13/2003 752 616 188 74 354 82% 7/14/2003 1834 987 321 121 545 54% 7/15/2003 2033 1092 352 116 624 54% 7/16/2003 2020 1169 310 125 734 58% 7/17/2003 2010 1148 260 105 783 57% 7/18/2003 1934 1074 290 83 701 56% 7/19/2003 1016 836 152 70 614 82% 7/20/2003 912 781 134 56 591 86% 7/21/2003 1761 1089 260 76 753 62% 7/22/2003 1997 1193 290 87 816 60% 7/23/2003 2085 1220 298 95 827 59% 7/24/2003 2064 1236 291 110 835 60% 7/25/2003 1868 1151 247 83 821 62% 7/26/2003 1030 853 150 73 630 83% 7/27/2003 912 778 111 47 620 85% 7/28/2003 1937 1156 242 79 835 60% 7/29/2003 2039 1183 259 96 828 58% 7/30/2003 2009 1216 281 121 814 61% 7/31/2003 2108 1251 289 109 853 59% Total Processed Total Spam Keyword Checking Header Checking Blacklist Spam Percentage 50316 29961 8147 2919 18895 60% -----Original Message----- From: Tiago de Aviz [ mailto:Tiago@xxxxxxxxxxxxxxx] Sent: Thursday, September 11, 2003 9:12 AM To: [ExchangeList] Subject: [exchangelist] RES: Spam issue Exch2k http://www.MSExchange.org/ GFI MailEssentials, dude. Tiago de Aviz SoftSell (41) 340-2363 www.softsell.com.br -----Mensagem original----- De: Paul Aitchison [ mailto:pdaitch@xxxxxxxxxxxxxxx] Enviada em: quinta-feira, 11 de setembro de 2003 09:12 Para: [ExchangeList] Assunto: [exchangelist] Spam issue Exch2k http://www.MSExchange.org/ Hi guys, One of our clients was spammed quite heavily a few days ago. The problem seems to be that the emails were sent directly to them so their Exchange box was accepting them but it was close to 30,000 emails being sent to them and subsequently filling the queues with NDR's and so on. From our perspective I can't work out a way to stop an attack like this. The mail was addressed to the client but was being sent from many email addresses so we couldn't simply use ISA to block them or Exchange. The client is only a 512k ADSL connection so the emails swamped them and brought the server to its knees. Any ideas what can be done to prevent an attack like this in the future? Cheers paul ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: tiago@xxxxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp Exchange FAQ: http://www.msexchange.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: Leading Network Software Directory: http://www.serverfiles.com No.1 ISA Server Resource Site: http://www.isaserver.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: jrobill@xxxxxxxxxxxxx To unsubscribe send a blank email to $subst('Email.Unsub') Message sent 11/9/2003 from Jeffrey Robillard to [ExchangeList]