Geeting Same Spam on few a/c's

[mohit]

hi,
few a/c's are being spammed everyday and mails sent to is almost same as of other domains.

i've checked exim, its updated, and these mails come from different box, and i've not allowed user"nobody" to relay mails from a yr. ago.

could any one suggest on this.

mails recd. by domains are for:-
uucp@mydomain. cxx
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
(mydomain.cxx = my real domain)

thanx in advance.
mohit

 

[Snowman30]

Ive notcied a couple of servers doign the same thing

anyone know a way to stop them?

 

[RickG]

These are typical dictionary attacks where the spammer is hoping to find a valid address.

1) Make sure you have all account default addresses set to :fail: , not :blackhole:

2) Install ConfigServer's Dictionary Attack ACL from
http://www.configserver.com/free/eximdeny.html

 

[Snowman30]

Thats whats got me worried im seeing this on 2 servers that Chirpy's done the full works on

its only just popped up in the past couple of days...

 

[Snowman30]

Ive started getting hit with this crap yet again

does anyone have a way to prevent it?