Strange "Internal Users" report

[vincent_54_ironport]

Hi,

I have an IronPort C100 ESA with an exchange server and one inside domaine (like @toto.com). When I look at the "Internal Users" report at the right side (Top Users by Clean Outgoing Messages), there are some addresses that do not belong to my toto.com domain.

Does anyone has a clue for this?

Thanks,

Vincent

[jaigill]

Is it possible that you have a compromised host on your network. You can grep the mail logs to verify that these messages were injected by your internal mail server.

[vincent_54_ironport]

Hi,

I just peformed a "findevent" and found that those stats are linked to mails forwarded to an external address on my exchange server.

thanks