In Progress CPANEL-42825 - Random address mass mailing

[coolcom]

Greetings...

Can anyone who is experiencing or has experienced this, comment on it and share your experience? Over the last few weeks our mail servers have been getting mail bombed with large amounts of email to random (non-existant) addresses at some of the domains we host. I am not referring to alphabet login attacks... these are just attempts to send email to random addresses.

There is no problem rejecting the emails (Sender verification, some TLD rejections etc.)... but I'm curious whether others are experiencing this recently? Has this practice suddenly increased, or have we just been included?

I'm also open to suggestions on how to best relieve our mail servers of some of the pressure of having to deal with all these rejections. The sending mail server IP's are all over the place.... Russia, China, Bolivia, India, US.. so compromised mail servers from around the globe....no sense even trying to add IP's to a block list. Possibly a use of AI... don't know.

I've experimentally set some of our mail servers to only receive email from Canada, US (and a few countries that process email over in Europe for Microsoft etc.) by using the "Filter Incoming Emails By Country" in WHM>Email to see how that works.

The filter incoming emails by domain works (*.ru for example), but the server mail log still lists all of these... whereas using the country rejection prevents them from even arriving apparently as there is no record of them in the logs at all.

I'm not sure why "Exim Configuration Manager>ACL Options>Dictionary attack protection" does not stop the incoming after 4 failed recipients... I thought that it would. There are usually about 100 attempts before they move to another domain.

So any advice, suggestions or sharing of current or past experiences welcomed.

Thanks

 

[cPRex]

Hey there! This sounds normal to me, and it does seem to have picked up recently. I also recommend ensuring that cPanel >> Default Address is configured in a way to either reject those or send them to an account you filter.

 

[coolcom]

Hey there! This sounds normal to me, and it does seem to have picked up recently. I also recommend ensuring that cPanel >> Default Address is configured in a way to either reject those or send them to an account you filter.

Thanks for the reply. Yes, default is set to reject.

Would you be able to help me understand why the senders are able to mail up to 100 addresses before they move on to the next domain? I thought the Exim Configuration Manager>ACL Options>Dictionary attack protection... would stop that, but perhaps I am not understanding it correctly.

I have tried using Maximum message recipients (soft limit) and Maximum message recipients before disconnect (hard limit), but I believe that only limits the amount of addresses an email can have in the To:, Cc: and Bcc: fields. If the spammers are sending individual emails, this will have no effect... correct?

 

[cPRex]

I don't understand either as that setting defaults to 4 failed attempts and then it should be blocking that sender:

Block dictionary attacks by dropping and ratelimiting hosts with more than 4 failed recipients

Yes, if the spammers are sending individual emails the Max recipient settings would not apply.

If you don't see the dictionary attack setting performing as you expect, it might be best to create a ticket with our team so we can take a look, as we'd need to examine the Exim logs on the machine to see why that isn't triggering.

 

[coolcom]

I don't understand either as that setting defaults to 4 failed attempts and then it should be blocking that sender:

Block dictionary attacks by dropping and ratelimiting hosts with more than 4 failed recipients

Yes, if the spammers are sending individual emails the Max recipient settings would not apply.

If you don't see the dictionary attack setting performing as you expect, it might be best to create a ticket with our team so we can take a look, as we'd need to examine the Exim logs on the machine to see why that isn't triggering.

Thanks.... Ticket has been submitted.

 

[cPRex]

Can you post the number here so I can follow along?

 

[coolcom]

Can you post the number here so I can follow along?

Certainly... #95118856

It appears that "...an open internal case that might be adding to this issue. Specifically, it seems that when the default email address is set to "fail" incoming mails for non-existent addresses, the senders are not properly getting scanned or added to blacklists. This in turn prevents future emails from being rejected."

 

[cPRex]

Thanks for that - the case is CPANEL-42825 and I'll be sure to post updates once I hear more!