SPAMMER Problem

[netdynamix]

Hi,

For some reason my mail queue is FULL FULL FULL of yahoo.com and aol.com address which seem to be directed to randomly generated users... thousands of mails in fact.

My server has now been banned from mailing most major networks. I tried to investigate where these messages were coming from and to my surprise, there was no received IP address (as below):

2009-04-22 06:15:17 Received from <> R=1Lv6mG-0007I5-Uz U=mail P=local S=1703 T="Warning: message 1Lv6mG-0007I5-Uz delayed 72 hours"
2009-04-22 06:15:18 SMTP error from remote mail server after end of data: host mailin-03.mx.aol.com [64.12.138.153]: 421-: (DYN:T1) http://postmaster.info.aol.com/errors/421dynt1.html\n421 SERVICE NOT AVAILABLE
2009-04-22 06:15:18 SMTP error from remote mail server after end of data: host mailin-03.mx.aol.com [205.188.252.17]: 421-: (DYN:T1) http://postmaster.info.aol.com/errors/421dynt1.html\n421 SERVICE NOT AVAILABLE
2009-04-22 06:15:19 SMTP error from remote mail server after end of data: host mailin-03.mx.aol.com [205.188.109.56]: 421-: (DYN:T1) http://postmaster.info.aol.com/errors/421dynt1.html\n421 SERVICE NOT AVAILABLE
2009-04-22 06:15:19 SMTP error from remote mail server after end of data: host mailin-04.mx.aol.com [205.188.159.216]: 421-: (DYN:T1) http://postmaster.info.aol.com/errors/421dynt1.html\n421 SERVICE NOT AVAILABLE
2009-04-22 06:15:20 SMTP error from remote mail server after end of data: host mailin-04.mx.aol.com [64.12.138.88]: 421-: (DYN:T1) http://postmaster.info.aol.com/errors/421dynt1.html\n421 SERVICE NOT AVAILABLE
2009-04-22 06:15:20 [email protected] R=lookuphost T=remote_smtp defer (-46): SMTP error from remote mail server after end of data: host mailin-04.mx.aol.com [64.12.138.88]: 421-: (DYN:T1) http://postmaster.info.aol.com/errors/421dynt1.html\n421 SERVICE NOT AVAILABLE


The strange thing is that my DA installation is vanilla, which has SMTP authentication by default... what can I do??? Any ideas would help loads. Thanks,

Chris

 

[scsi]

You dont have any of those domains in the /etc/virtual/whitelist* files do you? You should turn off catchall also if you dont already.

 

[Rich-Boy]

How to limit the number of emails sent by each user (prevent spammer);
http://help.directadmin.com/item.php?id=81

Some useful exim commands (e.g. to free up the mail queue);
http://help.directadmin.com/item.php?id=112

 

[floyd]

How to limit the number of emails sent by each user (prevent spammer);
http://help.directadmin.com/item.php?id=81

Does this also count the recipients in CC and BCC? What if you had a limit of 200 and a user sent out 2 emails each containing 200 CC addresses or even TO addresses? Would they get blocked at that point or does this only count as 2 emails?

 

[DirectAdmin Support]

Hello,

I just tested it and it adds one count per sent email. So if you had 100 CC's in the email, it wil count 100 sends. This is becausei it counts at smtp send time.. which would be repeated for each user.

Note that I believe exim does have a setting somewhere to limit the number of CC values an email can use

John