This patch may be useful to some sites. It enables you to detect sorted
dictionary attacks and take action as you see fit in ACLs.
e.g (in the DATA ACL):
deny message = dictionary attack detected
condition = ${if and { \
{>{$rcpt_fail_count}{3}} \
{>{$recipients_lex_trend_num}{5}} \
} \
{yes}{no}}
The patch is available as a diff against Exim 4.30 from
http://www.olliecook.net/projects/eximpatches/exim-4.30-dictionary-attack.patch
Cheers,
Ollie
--
Oliver Cook Systems Administrator, Claranet UK
ollie@??? +44 20 7903 3065