At work, we are currently being email bombed accidently by the looks of it. We are recieving about 8 emails a minute from the same sender/email address. This started on saturday and the call centre came into work this morning to be greeted by 16,000 email messages from the sender.

I have now used surfcontrol to block email from the sender before it even hits the exchange server, and so far from about 9am this morning have blocked 5000 email messages from the same person.

The big problem is its causing a backlog on our email system as legitimate emails struggle to make it through in between the junk.

I guess all I can do is let surfcontrol do its stuff, and hope it ends soon. The sender seems to be ****@rye-house.co.uk . replace **** with persons name.

message to [email protected] and hope someone monitors the account?

Yep - that's about the only thing you can do. You can blacklist that address but beyond deleting as soon as you detect them there isn't a great deal else you can do - only other solution is to use a 3rd party to drop that source email into a black hole.

Good luck and I hope you can get this resolved soon :(

Could you not report the address to its ISP, it may be virus infected.

Try using some info from here

Domain Name:

rye-house.co.uk

Registrant:

Roger White

Registrant's Address:

THE REGISTRANT IS AN INDIVIDUAL WHO HAS ELECTED TO

HAVE THEIR ADDRESS OMITTED FROM THE WHOIS DATABASE

Registrant's Agent:

Fasthosts Internet Limited [Tag = FASTHOSTS]

URL: http://www.fasthosts.co.uk

Relevant Dates:

Registered on: 20-Jul-2004

Renewal Date: 20-Jul-2006

Registration Status:

Registered until renewal date.

Name servers listed in order:

ns1.livedns.co.uk 213.171.192.250

ns2.livedns.co.uk 213.171.193.250

WHOIS database last updated at 20:20:00 14-Feb-2005

or -

http://www.dnsstuff.com/tools/tracert.ch?ip=rye-house.co.uk+

or -

Country: UNITED KINGDOM

Looking up 213.171.219.229 at whois.ripe.net.

% This is the RIPE Whois query server #2.

% The objects are in RPSL format.

%

% Rights restricted by copyright.

% See http://www.ripe.net/db/copyright.html

inetnum: 213.171.218.0 - 213.171.219.255

netname: FASTHOSTS-UK-NETWORK

descr: UK's largest web hosting company

descr: based in Gloucester, England

country: GB

admin-c: MW8691-RIPE

tech-c: DS445-RIPE

status: ASSIGNED PA

mnt-by: AS15418-MNT

remarks: report abuse to *****@fasthosts.co.uk

remarks: All reports via other channels will be ignored.

changed: *********@fasthosts.co.uk 20030805

source: RIPE

route: 213.171.192.0/19

descr: FasthostInternet Ltd

origin: AS15418

mnt-by: AS15418-MNT

changed: ***@fasthosts.co.uk 20020113

source: RIPE

route: 213.171.192.0/19

descr: FasthostInternet Ltd

origin: AS2856

mnt-by: BTNET-MNT

mnt-routes: AS15418-MNT

changed: **********@bt.com 20020807

source: RIPE

person: Mark Wood

address: Fasthosts Internet Limited

address: Suite 7, Discovery Court

address: 154 Southgate Street

address: Gloucester, GL1 2EX

phone: +44 1452 541251

fax-no: +44 1452 541633

nic-hdl: MW8691-RIPE

mnt-by: AS15418-MNT

changed: ***@fasthosts.co.uk 20021128

source: RIPE

person: Darren Sloper

address: Fasthosts Internet Limited

address: Suite 7, Discovery Court

address: 154 Southgate Street

address: Gloucester, GL1 2EX

phone: +44 1452 541251

fax-no: +44 1452 541633

nic-hdl: DS445-RIPE

mnt-by: AS15418-MNT

changed: ***@fasthosts.co.uk 20020724

source: RIPE

I'd say it virus protected alright. Let surfcontrol do its job and it should calm down in the next day or two. If not then try to get the offender's ip address and report them to your isp.

I'm assuming you've taken a look at http://www.rye-house.co.uk/

and found this contact info

Telephone: 01992 460895

Fax: 01992 468812

Email: [email protected]

Address: Motorsport World Limited

Rye House Kart Raceway

Rye Road, Rye House

Hoddesdon, Hertfordshire

EN110EH

Hi: Change your e mail address!

Probably stopped now, being 3 years ago and all

Probably stopped now, being 3 years ago and all

Probably stopped now, being 3 years ago and all

8 times 60 times 24 times 365 (was there a leap year ?) times 3 = :eek:

I thought Manny was quiet - must be hard talking from under that deluge

I must have missed this thread originally, but our solution in such a situation is to null route the sending host(s). That way we don't have to bother going to the expense of examining the SMTP traffic at all.