I hate 'em too.
>I'm beggining to find this kind of "attack" into my logs:
>
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] MAIL From:
><<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]>
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] RCPT
>To:<<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]>
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] ERR mail.fis.com invalid user
><<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] RCPT
>To:<<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]>
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] ERR mail.fis.com invalid user
><<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] RCPT
>To:<<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]>
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] ERR mail.fis.com invalid user
><<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] RCPT
>To:<<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]>
>05:27 04:22 SMTPD(0904026E) [216.53.218.171] ERR mail.fis.com invalid user
><<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]
This is called a "Dictionary attack". It actually isn't spam being
sent/received. They are trying lots of usernames at your domain that they
think are likely to exist. They are harvesting E-mail addresses from your
site.
>Is there any way to avoid this? I heard about limiting the number of
>persons in the TO: clause. Does this work good? how should I setup that?
>What happen if someone do this? will be rejected?
You can restrict the number of recipients (to 20, for example), which would
slow down the attacker. However, it may also be an inconvenience for some
of your users who like to forward E-mail to everyone they know. The E-mail
wouldn't be rejected, they would just have to connect again to get more
addresses, slowing them down slightly.
The other option is to use a "nobody" alias that would receive all the
E-mails. This way the spammer wouldn't be able to tell the legitimate
addresses from the bogus ones.
-Scott
Declude: Anti-spam and Anti-virus solutions for IMail. http://www.declude.com
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
