fighting dictionary attacks?

Josh Trutwin <[email protected]>
Newsgroups gmane.comp.sysutils.bgware
Message-ID <[email protected]>
I have a nice setup with mailfront / qmail that implements real/good
rcptto SMTP level rejection with the generous help from the experts on
this list.  It's greatly cut back on the amount of crap that goes
through my scanners (AV/SA) that is destined to never be delivered
anyway.  

The only problem is now a couple domains in particular are getting
blasted with dictionary attacks.  I'm curious if anyone has
recommendations for fighting this or do you just put up with it?  I'd
like to block these a-holes right at the start of the SMTP
conversation without attempting ANY delivery, even if they manage to
have a single valid recipient in their message.

For example, grepping through the logs shows me that [email protected]
seems to be a popular attempt at a valid address, from various IP's. 
Are there any tools that would allow me to tell qmail to drop any SMTP
conversation that contains a recipient of [email protected] (or
whatever)?

I guess what I'm most interested in is qmail/mailfront dishing out one
"553 Go to Hell you SOB"  vs. 100's (1000's!) of "553 Sorry, recipient
address not valid".

/var/log/qmail/smtpd> grep keinan * | grep -v <<list of valid
addressed removed for privacy reasons>> | wc -l
  15497

That particular domain is worst hit, but there are a few others...

/var/log/qmail/smtpd> grep "553 Sorry, recipient address not valid" *
| wc -l                                                               
               18240

(that's grepping through only 2 day's worth of logs)

Thx,

Josh
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.