I get hundreds of spam from phpmailer script. how can i block

[Mirsady]

Hello,

I get hundreds of spam from phpmailer script. and every IP adress or sender mail adres or sender domain is always different
but the only common points are the following information mail header

Code: Select all

X-PHP-Originating-Script: 310:class-phpmailer.php
Date: Tue, 30 Jan 2018 14:41:00 +0530
[b]X-Mailer: PHPMailer 5.2.22 (https://github.com/PHPMailer/PHPMailer)[/b]
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

how can i block if mail header contain X-Mailer: PHPMailer for the entire server and domains.

[twun]

I am getting the same attack, would be interested in a good solution to block this before it hits the spam filter as the server is being overwhelmed currently.

[Seppy]

Hi,
did you activate greylist?

[twun]

best solution i have so far is to create a Filter that checks Message Header for *https://github.com/PHPMailer/PHPMailer* and delete them. I have set the inbuilt mailenable filter to run before hitting my MTA spam filter so that i can clear out targeted attacks like this with out wasting resources on the MTA spam filter.