My zimbra server was just added to the microsoft spam list - Help!

[smcbutler]

I just received the following message:

<xxx.xxx.xxx>: host mail.global.sprint.com[xx.xx.xx.xx] said: 550
5.7.1 Service unavailable; Client host [yy.yy.yy.yy] blocked using
Blocklist 1, mail from IP banned; To request removal from this list please
forward this message to delist@messaging.microsoft.com. (in reply to RCPT
TO command)

i suspect somebody has infiltrated a machine and is sending out spam. is there a logfile report i can run to see how many emails are being sent and to what IP addresses?

thx

[phoenix]

Originally Posted by smcbutler

I just received the following message:

<xxx.xxx.xxx>: host mail.global.sprint.com[xx.xx.xx.xx] said: 550
5.7.1 Service unavailable; Client host [yy.yy.yy.yy] blocked using
Blocklist 1, mail from IP banned; To request removal from this list please
forward this message to delist@messaging.microsoft.com. (in reply to RCPT
TO command)

i suspect somebody has infiltrated a machine and is sending out spam. is there a logfile report i can run to see how many emails are being sent and to what IP addresses?

You can look in the log files for details, the daily report to the admin should contain details of high usage address in or out. There are several threads in the forums that cover what to do if you think you've been 'hacked' (your users might also have weak passwords, you can change that in the admin UI), I'd suggest you have a read of those for some further tips.