Getting a lot of grief from russia/china where they keep hitting an invalid email address. my log rotate is getting a good cardio wortkout ATM from these clowns.
Is there a simple means to grep for access to like “[email protected]” grab IP and auto add them to block list if not there already?!
hoping i can do some cron script every half hour and such to stop this mess. I got one specific domain that is in the top million and has been as low as 340k. i block a few countries via the cdn level but they do direct access too as its trivial to get info on mx servers and such.
Yes, you can create a script to do that but if you don’t have customers/users from x country, you can block the entire country using ipset as @nu01 suggested.
Still happening - i think they must be using a large botnet of proxies or something because as soon as i block them, they redirect via another random IP.
Is there and easy way to remove all the emails sent to [email protected] from the mailq?!
These ipsets are updated daily, and hestia has firewall also auto refreshing your list.
I do the same to my server. Have added around 10+ such lists and my own list of 10K+ blocks, including email spammers.
However no way to auto block as no direct way to identify/determine it as a spammer IP.
Guess only delete / expunge the mail queue/lot. Also, run a blocklist of email spammers to have them blocked at gate itself by server spamassassin kind of service.
Maybe I’m misunderstanding the problem, but if the account [email protected] doesn’t exist and example.com is a local mail domain, there shouldn’t be any messages in Exim’s mail queue. The message should be rejected during the SMTP connection.
If example.com is your server’s hostname and you did add it in Hestia as a mail domain, then the emails should be rejected during the SMTP connection because the nobody account does not exist.
If example.com is your server’s hostname and you did not add it in Hestia as a mail domain, the emails should still be rejected because that domain is not considered a local domain managed by Exim… or I missed something.
What I don’t understand is how these emails ended up in Exim’s queue.
It would make sense if you had a catch-all account for example.com, if your mail server is misconfigured and acting as an open relay, or if someone is using valid login credentials to send those emails.