machine gun
Barb Dijker <[email protected]>
| Newsgroups | gmane.mail.spam.greylist.user |
|---|---|
| Message-ID | <[email protected]> |
We are starting to see more machine gun spammers. For example, yesterday youngexplorerscatalog.net attempted to send a message to a single recipient once per second until greylisting allowed the message. I'm thinking about a hook to set a threshold for promoting a mail server to automatic temporary BL. I've been doing this manually when we get hammered. But it is happening too often anymore. Has anyone done this already? Suggestions? A quick peruse of the database shows a small handful of legitimate mail that appears to be using the machine gun approach, e.g., mail (really) from ebay that was blocked 80 or 90 times before being passed once. Blackberry.com does it pretty regularly. An att.net outgoing server hit almost once a second. This sort of thing is killer to the server with just the connection overhead. Our delay is only 4 minutes. So if a triple has been blocked more than 48 times, it is trying more frequently than once ever 5 seconds. That seems excessive. Barb Dijker x100 Netrack, 3080 Valmont Rd Ste 200, Boulder CO 80301 +1.303.938.0188, toll free +1.888.9Netrack, fax +1.303.938.0177 www.netrack.net