Exim ERROR - unknown user

[linuxgirl]

Hello,

Recently we are facing exim issues,here we could able to send mail but we are not getting mails in INBOX.When we did check for logs and seems it is a global issue on server.Please check the logs below and update us for the solution -

-----------------------
2009-02-07 18:35:44 H=(36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36] Warning: Sender rate 2.0 / 1h
2009-02-07 18:35:44 H=(36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36] F=<waterbedda848@jessalway.com> rejected RCPT <insurance@domain.com>: unknown user
2009-02-07 18:35:44 H=(36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36] F=<waterbedda848@jessalway.com> rejected RCPT <jbyea@domain.com>: unknown user
2009-02-07 18:35:44 H=(36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36] F=<waterbedda848@jessalway.com> rejected RCPT <insurance@domain.com>: unknown user
2009-02-07 18:35:44 H=(36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36] F=<waterbedda848@jessalway.com> rejected RCPT <jbyea@domain.com>: unknown user
2009-02-07 18:35:44 H=(36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36] F=<waterbedda848@jessalway.com> rejected RCPT <insurance@domain.com>: unknown user
2009-02-07 18:35:44 H=(36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36] F=<waterbedda848@jessalway.com> rejected RCPT <jbyea@domain.com>: unknown user
2009-02-07 18:35:44 unexpected disconnection while reading SMTP command from (36.148.227.124.broad.nn.gx.dynamic.163data.com.cn) [124.227.148.36]
------------------------------------------------------------

[rhenderson]

That looks look like it is saying that, insurance@domain.com and jbyea@domain.com are receiving emails from a server in China and those addresses do not exist, i.e. user not found.

[linuxgirl]

Hello,

Email insurance@domain.com is hosted on our server and it is present on server and also configured correctly.

[rhenderson]

But it appears the above email sender might be launching a dictionary attack which cPanel has built in a safeguard in exim to stop this kind of attack.