mailnull the highest mail sender?

I have been in the same boat for a bit with even the same email from domain you use in your example. Let me run this list by ya..

handclass.com
hateresearch.net
healthmeat.com
healthygoodies.com
heartlessons.com
hearttesting.net
heatherbrown.net
helphotels.net
highyellow.com
higod.net
historyexplorer.net
hogworld.net
homealtars.com
homeimage.net
hostdomino.com
hostdomino.net
hotguitars.net
housefront.net
huggerperformance.net
huntinglabs.net
hypnotismtherapy.com


I have tried like hell to figure this one out, how they are actually entering the queue, but to no avail. The one you posted has a bounce in it which I've definately seen but have also watched them enter the queue and get ready to send as if they origionated on the server except they are missing some parts and it seems to be forged headers with exim filling in the rest. If I tail -f var/log/exim_mainlog and watch it, they enter in 4 or 5 at a time every few seconds with U=nobody P=local and I'd almost say that there's an exploited script except I've grepped just about everything I can(not running phpsuexec, btw) and nothing comes up. And, no process appears to be running on the server at the time these are entering to indicate a script is inputting them.

Anyway, I got fed up with it yesterday and did a basic exim rewrite which altered the to: based on filtering from the above list to the site which was being advertised Perhaps a shitty thing to do but I got a very fast reply to an email I sent them concerning this 'affiliate' of theirs asking me to stop clogging up their mail server;hehe They also apparently terminated his affiliate account with this particular site and when verifying the page he was advertising to, it appears so. dunno...a bit of justice in that. I'm now simply just failing them immediately with a filter in /etc/antivirus.exim so they never enter the queue which is easy enough and buys time to figure this one out.

Wish I was actually help but you're not alone with this clown, anyway

 

btw; it was a script on the server in my case and I bet it is in yours, too. If you or anyone else is seeing a lot of bounced mail with any of the above email addresses I listed, feel free to PM me. I don't know if it's kosher here to post the customer contact info this one signed up with nor the ip's used to connect to the script. I got 'lucky' on the hunt this morning

 

I PM'ed you some of the info like customer contact(have found that this is one used in more than one place) and how to do a crude rewrite so all of the bounces go somewhere else. The rewrite is kind of vigilante justice, though, so be careful with it;hehe

The best way is probably to reject them instantly so that they aren't going anywhere including the queue, open up /etc/antivirus.exim and find a filter that is already created that you can just expanded on. You should see it near the top # These messages are now being sent with a <> envelope sender,...
I made the filter look like this..

Code:

if $header_from: contains "@sexyfun.com"
or $header_from: contains "@handclass.com"
or $header_from: contains "@hateresearch.net"
or $header_from: contains "@healthmeat.com"
or $header_from: contains "@healthygoodies.com"
or $header_from: contains "@heartlessons.com"
or $header_from: contains "@hearttesting.net"
or $header_from: contains "@heatherbrown.net"
or $header_from: contains "@helphotels.net"
or $header_from: contains "@highyellow.com"
or $header_from: contains "@higod.net"
or $header_from: contains "@historyexplorer.net"
or $header_from: contains "@hogworld.net"
or $header_from: contains "@homealtars.com"
or $header_from: contains "@homeimage.net"
or $header_from: contains "@hostdomino.com"
or $header_from: contains "@hostdomino.net"
or $header_from: contains "@hotguitars.net"
or $header_from: contains "@housefront.net"
or $header_from: contains "@huggerperformance.net"
or $header_from: contains "@huntinglabs.net"
or $header_from: contains "@hypnotismtherapy.com"
then
#  fail text "This message has been rejected since it has\n\
#            the signature of a known virus in the header."
  seen finish
endif
if error_message and $header_from: contains "Mailer-Daemon@"
then
  # looks like a real error message - just ignore it
  finish
endif

There might be a better way to do it but it rejects all mail with those email address in the from: instantly. I commented out the fail text because since the mail was to be rejected completely, there's no point in writing anything in the header You may want to make sure you are using /etc/antivirus.exim as you system wide filter by going to the 'exim configuration editor' in WHM and you should see System filter file (leave blank to disable): with /etc/antivirus.exim there.

Anyway, I'm curious if this guys actually on your server.

good luck