Re: machine gun
Matt Prigge <[email protected]>
| Newsgroups | gmane.mail.spam.greylist.user |
|---|---|
| Message-ID | <[email protected]> |
Are the connections concurrent or sequential? There may be a way to introduce some delay into the SMTP conversation that would effectively slow things down and save you from getting entirely obliterated. Maybe something as simple as introducing a 15s delay in between the From: and To: on tripples that have been denied (and not accepted) more than X times (tunable of course). I don't imagine that would be hard to add to the code, but, depending upon what you're seeing, it may or may not help. The spammers are likely using threaded delivery engines, so that may not help there - the legit ones really shouldn't be trying to deliver the same message more than once at a time though. :-) - Matt On 1/20/06, Barb Dijker <[email protected]> wrote: > We are starting to see more machine gun spammers. For example, > yesterday youngexplorerscatalog.net attempted to send a message to a > single recipient once per second until greylisting allowed the message. > > I'm thinking about a hook to set a threshold for promoting a mail > server to automatic temporary BL. I've been doing this manually when > we get hammered. But it is happening too often anymore. Has anyone > done this already? Suggestions? > > A quick peruse of the database shows a small handful of legitimate > mail that appears to be using the machine gun approach, e.g., mail > (really) from ebay that was blocked 80 or 90 times before being > passed once. Blackberry.com does it pretty regularly. An att.net > outgoing server hit almost once a second. This sort of thing is > killer to the server with just the connection overhead. Our delay is > only 4 minutes. So if a triple has been blocked more than 48 times, > it is trying more frequently than once ever 5 seconds. That seems > excessive. > > Barb Dijker x100 > Netrack, 3080 Valmont Rd Ste 200, Boulder CO 80301 > +1.303.938.0188, toll free +1.888.9Netrack, fax +1.303.938.0177 > www.netrack.net > > > > _______________________________________________ > Greylist-users mailing list > [email protected] > http://lists.puremagic.com/cgi-bin/mailman/listinfo/greylist-users >