mailbombing

[pppplus]

Hi

From yesterday, I receive a lot of messages, to one of my domain.
It's several thousand by hour.

header of a mail :

1VbnBU-0006of-TC-H
mail 8 12
<[email protected]>
1383206452 0
-helo_name gmail.com
-host_address 85.26.235.240.27007
-interface_address 94.23.246.189.25
-received_protocol esmtp
-body_linecount 21
-max_received_linelength 118
-deliver_firsttime
-host_lookup_failed
XX
1
[email protected]

210P Received: from [85.26.235.240] (helo=gmail.com)
	by serveur7.3go.fr with esmtp (Exim 4.76)
	(envelope-from <[email protected]>)
	id 1VbnBU-0006of-TC
	for [email protected]; Thu, 31 Oct 2013 09:00:54 +0100
219P Received: from apache by retbbatbbebjdjfeb.nobleenergyinc.com with local (Exim 4.67)
	(envelope-from <<[email protected]>>)
	id GCL58R-U72WME-92
	for <[email protected]>; Thu, 31 Oct 2013 14:11:34 +0600
032T To: <[email protected]>
080  Subject: Environmental organization aggressively recruiting partners worldwide.
088  X-PHP-Script: retbbatbbebjdjfeb.cascade.oostrozebeke.com/sendmail.php for 85.26.235.240
034F From: <[email protected]>
038  X-Sender: <[email protected]>
014  X-Mailer: PHP
014  X-Priority: 1
045  Content-Type: text/plain; charset="us-ascii"
066I Message-Id: <[email protected]>
038  Date: Thu, 31 Oct 2013 14:11:34 +0600
065  X-Antivirus: avast! (VPS 120430-0, 30.04.2012), Outbound message
026  X-Antivirus-Status: Clean
073  X-Antivirus-Scanner: Clean mail though you should still use an Antivirus

There are a lot of senders, ips....
All these emails are send to various [email protected] that do not exist.

Is there a way to avoid it ?


My rules are in directadmin are : catch-all => ignore
So I suppose all these emails are simply deleted.

BUT I receive a lot of warning for user mail (about 150 each time there is a mailbombing)
AND I see some (about 10-20) answers sent by gmail (because it's always gmail adresses to answer), for non-existing addresses.

Other informations :
subject is always like : Environmental Company or Environmental enterprise
messages ask to reply to adress like : [email protected] (xxxx change in each email)

Thanks for your help.

 

[nobaloney]

Set catchall to fail, and the mail won't be accepted onto the server.

Jeff

 

[pppplus]

Thanks !
Simple...

I thunk it was better to "ignore". But I've just seen in english version, that fail is recommmanded (it's not written in my french translation).

 

[nobaloney]

Glad to learn it fixed it for you. You might want to notify the vendor of your French skin translation that it's important enough to include in the skin.

Jeff

 

[pppplus]

It's my own translations, which are on this forum.
I will update them, in a few days.

 

[nobaloney]

Great! Thanks for your contribution to the community.

Jeff