I have noticed this on a couple of accounts. One domain will be flooded with e-mails to nonexistant e-mail accounts on that domain. This is on a CPanel server, running Exim version 4.44. I have installed the Dictionary Attack ACL from configserver.com, but that does not seem to help. The connections all seem to be from different IPs. You can tail the exim_mainlog and grep for the said domain and just see all of the connections coming in. Its almost like there are thousands of servers infected with something and they are all synched to send mail to this one domain. Has anyone else experienced this problem? Is there anything that can be done to alleviate this?
