1

Already searched some Hours about this Problem - but no good Solution in sight - so maybe someone here can help me on this.

We offer Webhosting / Mail Services. Lately the amount of Hacked E-Mail Accounts of our Customers is raising (Virus, Trojan, ...) - their SMTP Account Data is stolen and our Mail-System is abused by sending Spam through SMTP-Verificated Accounts ... Which, of course, is a big Problem for our IP-Reputation ...

How can we detect such hacked Accounts faster than waiting for Abuse Records? (Sendmail, Postfix) Are there Tools for behavioural Detection on Accounts? Or some other Services? Or what would be the right approach for such problems?

Hope someone here can hint me in the right direction.

1
  • 1
    As mentioned by HBrujin below, one of approach is rate limitting. For postfix, there are postfwd and policyd to monitor email per account.
    – masegaloeh
    Nov 26, 2014 at 2:21

1 Answer 1

4

One solution is increased monitoring e.g. raise alerts when the number of messages from individual ip-address/user account suddenly increases. That may be followed by rate limiting.

The other is egress filtering on the SMTP servers you provide to your customers, similar to how you do spam filtering on incoming e-mail.

2
  • We host tenthousands of Mail Accounts - I'm not aware of any solution that could monitor that based on Accounts? :-/
    – Hellkeeper
    Nov 25, 2014 at 13:02
  • 2
    Many SMTP servers have native support for rate limiting as a mitigating measure. In addition you can send your logs to a remote host for merging, parsing and reporting, i.e. a mechanism like fail2ban or import them in splunk and generate reports
    – HBruijn
    Nov 25, 2014 at 13:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .