I found thousands of this error in the Exim_Mainlog.
It's a single server, single domain, 200 plus email accounts and we can receive more than 6000 events each day, based on Mail Delivery Report. Only 5% of them translate into emails (including spam emails), the rests are dropped during SMTP connection.
I found that most IP addresses are from Russia so I blocked them together with some more IP addresses from various countries.
I picked those with high volume. Quite easy, the range of IP addresses are not so big, even if they are, its still within the range so I could use CIDR to block them. With additional domain tld block like .top, .cc, etc., the number dropped to around 2000 each day. Total IPs being blocked are still below 100.
Now left with those IP that are coming from China - our user based. They come in various IP addresses and it amazed me that, today, I gathered 1,600 events with more than 1,200 unique IP addresses in just 6 days (I only filtered those with Sender verify failed). I find it's not practical to block them one by one.
If you look at this log, both senders and recipients don't exist
What is this? and who ever did this, what could be the reason?
Is this normal for a domain to receive this kind of volume?
Are those IPs spoofed?
Many thanks for reading and let me know your thoughts.
It's a single server, single domain, 200 plus email accounts and we can receive more than 6000 events each day, based on Mail Delivery Report. Only 5% of them translate into emails (including spam emails), the rests are dropped during SMTP connection.
I found that most IP addresses are from Russia so I blocked them together with some more IP addresses from various countries.
I picked those with high volume. Quite easy, the range of IP addresses are not so big, even if they are, its still within the range so I could use CIDR to block them. With additional domain tld block like .top, .cc, etc., the number dropped to around 2000 each day. Total IPs being blocked are still below 100.
Now left with those IP that are coming from China - our user based. They come in various IP addresses and it amazed me that, today, I gathered 1,600 events with more than 1,200 unique IP addresses in just 6 days (I only filtered those with Sender verify failed). I find it's not practical to block them one by one.
If you look at this log, both senders and recipients don't exist
What is this? and who ever did this, what could be the reason?
Is this normal for a domain to receive this kind of volume?
Are those IPs spoofed?
Many thanks for reading and let me know your thoughts.
