Good point, could be generated internally by either your Barracuda or exchange and might not actually be SPAM. Could be some sort of system administrator messages. ________________________________ From: Taylor, George [mailto:gtaylor@xxxxxxxx] Sent: Thursday, January 05, 2006 2:16 PM To: [ExchangeList] Subject: [exchangelist] RE: Some Advice Please Sensitivity: Private http://www.MSExchange.org/ What was your config before setting up this box? I'm not familiar with the Barracuda, so don't know if it's possible, but could it be configured wrong and these are actually being generated by the box itself? Before installing the box was your Exchange servers getting these emails and delivering them? Were users complaining? If you've been getting them on a constant basis I think I'd look at finding the ISPs were they are coming from and inquiring, cuz this is large. I'm just guessing but with only 250 mailboxes your probably running over 80% spam, which is a little high. With ~4500 mailboxes we tend to run right around 60% spam out of 350K - 500K emails per month. George Taylor Systems Programmer Regional Health Inc. ________________________________ From: Rich Gallo [mailto:RGallo@xxxxxxxxxxxxxxxxx] Sent: Thursday, January 05, 2006 11:47 AM To: [ExchangeList] Subject: [exchangelist] RE: Some Advice Please Sensitivity: Private http://www.MSExchange.org/ Exactly, the number is huge. It's up to 95K now! Yeah, I also checked IP addresses and there doesn't seem to be any commonality between them but I'll keep checking. Pulling my hair out indeed. ________________________________ From: Evan Mann [mailto:emann@xxxxxxxxxxxxxxxxxxxxx] Sent: Thursday, January 05, 2006 1:15 PM To: [ExchangeList] Subject: [exchangelist] RE: Some Advice Please Sensitivity: Private http://www.MSExchange.org/ The Barracuda device is SPAM filter, as well as virus protection, spyware, and content filtering. He want's to know if he is specifically being attacked. 80k e-mails for 250 e-mail addresses in 15 hours is huge. Being that they are all blank seems a little odd. Not your typical spam I'd say, and I've not heard of this happening to anyone. I have noticed a very small number of e-mails lately they had blank subject AND sender. First time I noticed them so it's something new. But not in that volume. ________________________________ From: Mike Dufoe [mailto:dufoem@xxxxxxxxxxx] Sent: Thursday, January 05, 2006 12:57 PM To: [ExchangeList] Subject: [exchangelist] RE: Some Advice Please Sensitivity: Private http://www.MSExchange.org/ Are you running any type of Spam software on your network? If not, I'd start off by purchasing one. We use GFI and are quite impressed by it as it works with AD. Mike Dufoe System Administrator ETI Canada Inc. ________________________________ From: Rich Gallo [mailto:RGallo@xxxxxxxxxxxxxxxxx] Sent: Thursday, January 05, 2006 12:40 PM To: [ExchangeList] Subject: [exchangelist] Some Advice Please Sensitivity: Private http://www.MSExchange.org/ We recently got a Barracuda Box (which is great by the way), and are using it as our SMTP smart host relay for incoming and outgoing mail from and to the outside world, respectively. We are getting hit with a HUGE amount of messages that are just empty (no TO:, no SUBJECT:, no FROM:, nothing) To give you an idea of just how many we are getting, we have 250 users and since I set up the new spam box last night (15 hours ago), we have received over 80,000 messages! Most of which were blocked... My question is - Is this some sort of continued attack our domain is under? If so, what steps can I take to help fix, or slow down, this problem? ANY Advice at all would be greatly appreciated as this stuff is killing us!!! ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: dufoem@xxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to info@xxxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: emann@xxxxxxxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to info@xxxxxxxxxxxxxx -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.13/221 - Release Date: 1/4/2006 ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: rgallo@xxxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to info@xxxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: gtaylor@xxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to info@xxxxxxxxxxxxxx -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.13/221 - Release Date: 1/4/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.13/221 - Release Date: 1/4/2006 ***Note: The information contained in this message, including any attachments, may be privileged, confidential, and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the Sender immediately by a "reply to sender only" message and destroy all electronic or paper copies of the communication, including any attachments. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Exchange Newsletters: http://www.msexchange.org/pages/newsletter.asp ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this MSExchange.org Discussion List as: chongja@xxxxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=exchangelist Report abuse to info@xxxxxxxxxxxxxx