Even though Serv-U was used as an FTP server, it seems that no one was passing files at the time, so I didn't care about it. Later, I accidentally opened the "System Log" and found many error logs that could not be sent by emails. Open the mailroot directory and find that nearly 10000 emails are accumulated under the queue, and the number of emails increases and decreases. So I realized that some outsiders sent spam on the SMTP server under my IIS, immediately stopped the SMTP service, deleted the emails in the queue, left one or two emails, and then studied them slowly.
Because some WebProgramTo use the mail function, you have configured the SMTP server over there. In fact, it is mainly to set "relay restriction" (relay restriction) to allow all, while other configurations are basically not modified. Then it is sent to"Connection Control"(Connection Control)By default, all machines are allowed to use the SMTP server., Set it to"Only the list below"(Only the following lists are allowed) and add the local IP address. In this way, only the local machine can be used!
A computer exposed to the Internet must be installed with a firewall (or patch) and configured with various services to prevent attacks or exploitation.