This is a problem I had to deal with several times in the past. These "attacks" originate from bots which, in turn, utilize compromised email accounts in many legitimate email servers. Then, all these legit SMTP services try to send the emails to your own server.
The recipient's address seems to be random. At this point, I am not sure what they try to do, discover legitimate email addresses or just try to choke and cause problems to the destination server. I tend to believe that they try to discover valid email addresses.
The fact that almost all the email addresses are invalid, usually makes your server to respond with a 550 error code. Despite this fatal error code, many of the originating servers keep trying to resend it, thus adding more unnecessary traffic.
Unfortunately, there is no way to block all this traffic, because you have to accept the connection from the originating server and at least check some of the envelope headers in order to decide whether to accept the message for further processing or not. So, the only thing you can do is to configure your email server to:
- reject all emails, whose recipient address is not legit, before they enter your spam and virus filter chains. This will help to avoid unnecessary cpu utilization.
- setting a rejection code for unknown recipients other than the usual, eg 554 instead of 550, sometimes may prevent the originating server from retrying to send the emails.
Well, I wrote this in a fast pace. The general idea is that there is nothing you can do to prevent this traffic.
