Author: Dennis Davis Date: To: Randy Bush via Exim-users Subject: Re: [exim] detecting overly frequent smtp from real user
On Tue, 6 Aug 2019, Randy Bush via Exim-users wrote:
> From: Randy Bush via Exim-users <exim-users@???>
> To: exim users <exim-users@???>
> Date: Tue, 06 Aug 2019 11:37:14 -0700
> Subject: [exim] detecting overly frequent smtp from real user
> Reply-To: Randy Bush <randy@???>
>
> had a legit user user with weak password. someone cracked it and
> used it to drive a lot of spam by smtping in with plain auth.
>
> anyone have scripting to raise alerts if there is inbound smtp
> from a legit user above some threshold?
