Re: [exim] identifying compromised accounts

Góra strony
Delete this message
Reply to this message
Autor: Jeremy Harris
Data:  
Dla: exim-users
Temat: Re: [exim] identifying compromised accounts
On 07/11/14 19:13, Patrick von der Hagen wrote:
> Hi all,
>
> I've been having issues with compromised accounts used to send spam via
> authenticated connections to my servers. Don't ask me how those people
> lost their passwords, but they did.


You can play with ratelimit entries to spot an unusual increase in
send rate, per account.

You can watch for rate of rejects, rather than bounces (please don't
say you accept-then-bounce!)

You can charge your customers real money in cleanup fees.
--
Cheers,
Jeremy