Re: [EXIM] Been used as "from" address for spam

Top Page
Delete this message
Reply to this message
Author: Matthew Frost
Date:  
To: Eelco Vriezekolk, exim-users
Subject: Re: [EXIM] Been used as "from" address for spam
On Sun, Sep 20, 1998 at 03:45:32PM +0200, Eelco Vriezekolk wrote:
> This morning, someone sent out a spam using one of "my" addresses
> as the From-address. Naturally, plenty of the addresses being
> spammed to did not exist anymore, and I got a small avalanche of
> "mail undeliverable" messages.


I had the same thing happen to me a couple of weeks back. It's very nasty.

> Is there any way to prevent this?


Not that I could see at the time - I just had to ride it out. I did
however temporarily alias the address the spammer had used so I could
pick up some of the bounces (all from aol.com) to find out where it
was coming from.

I can't see anything in Exim that could help you in this case, apart
from throttling the number of connections but you're still going to
get hits eventually. In my case my backup relay took the messages and
ended up with shedloads of frozen messages that it couldn't return to "<>".

I just had to keep ringing PSInet's abuse department to get the
accounts cancelled that were being used to spam (they were still on
line at this point).

And once that's done, you'll get the people who did receive the spam
complaining to the spam address or postmaster@ - at least exim can be
configured as an autoresponder.....

Regards, Matthew

-- 
Matthew Frost                                         http://www.frost.org/
                                                   email: matthew@???
"My feet, my arms and my ears.  And, your feet."   dfax:   +44 870 160 0853


--
*** Exim information can be found at http://www.exim.org/ ***