In internet server jargon, a mail bomb attack (aka mail FLOOD attack) is using automation to send so many emails to a server that it effectively is off line trying to deal with them. We were getting hundreds of emails PER MINUTE. This is a form of internet vandalism often used by spammers attempting to find a server they can use to relay their spam and conceal their true origin.

Our software was set up to reject all requests for relays. Instead of stopping the email sending, the spammer or their automation stepped up the rate at which the spam was being sent. I had to request the server farm to manually reboot the server then quickly, Bob and I logged in to seize control of the email program and turn it off. This meant that the server was no longer spending time examining the email being received to see if it was legitimate but was just ignoring it.

The problem was more complex than this simple telling; it took half an hour to figure out that the server was actually down and not offline for some other reason; another hour to determine that was a mail bomb attack; a half hour to get the reboot request processed; another hour to try various remedies, including fighting off the system which kept turning the mail server back on, another half an hour to implement a solution and a final hour of testing to be sure it actually worked. All told, about one productive day's work wasted.

And it took both of us to do it, one person couldn't work fast enough to keep the system going while doing effective work.

Hugs,
Erin

= Give everyone the benefit of the doubt because certainty is a fragile thing that can be shattered by one overlooked fact.