Recommendations for handling Directory Harvesting spam on Exchange 2003

exchangeexchange-2003spam

Our Exchange server is getting slammed with anywhere between 450,000 and 700,000 spam messages per day. We receive about 1700 legitimate messages in the same time frame.

Roughly 75% of the spam is directory harvesting. We currently have GFI MailEssentials installed. To it's credit, it's doing a very good job, but the sheer volume of spam that we're receiving, and the number of connections that our exchange server is making is preventing legitimate email from being delivered in a timely manner.

GFI is set up to check for directory harvesting at the SMTP level, which I presume intercepts the mail before it hits the Exchange services , or goes through SMSE. This "module" is ordered at the top of the list, so (hopefully) dealing with the harvesting is consuming a minimum amount of server resources and bandwidth.

My question is, is there anything I can do to prevent our Exchange server's connection pool from being eaten up by these spam hosts? We had to limit the number of concurrent connections being made by Exchange, because it was consuming all of our bandwidth.

Thanks, in advance.

Best Answer

I would use a combination of Recipient Filtering, and SMTP Tar-pitting. This is explained in more detail here:

http://www.exchangeinbox.com/article.aspx?i=49

As a summary, Exchange rejects connections to addresses that don't exist. However this allows spam harvesters to check a large number of addresses quickly against your server.

By enabling tar-pitting, you add a delay to the response your server gives, which reduces the amount of connections a harvester makes to your server.

Related Topic