Re: [exim] identifying compromised accounts

Top Page
This message is part of the following thread:
M+\the complete thread tree sorted by date
MMMPatrick von der Hagen at <-
..MKen Simpson at ->
Delete this message
Reply to this message
Author: Jeremy Harris
Date:  
To: exim-users
Subject: Re: [exim] identifying compromised accounts
On 07/11/14 19:13, Patrick von der Hagen wrote:
> Hi all,
>
> I've been having issues with compromised accounts used to send spam via
> authenticated connections to my servers. Don't ask me how those people
> lost their passwords, but they did.

You can play with ratelimit entries to spot an unusual increase in
send rate, per account.

You can watch for rate of rejects, rather than bounces (please don't
say you accept-then-bounce!)

You can charge your customers real money in cleanup fees.
--
Cheers,
Jeremy



This message was posted to the following mailing lists:
Exim-users
Mailing List Info | Nearby Messages		<-[exim] identifying compromised accountsRe: [exim] identifying compromised accounts->
Tahini and Hummus and Cumin Development Archives administrated by cumin AdminsLurker (version 2.3)