On 17 October 2011 19:43, Stan Hoeppner <s...@hardwarefreak.com> wrote: > On 10/17/2011 10:50 AM, Simon Brereton wrote: > >> Does your approach for sending to abuse work for Roadrunner? I have >> 1000 pings a day from a host on RR cable and when I tried to email >> abb...@rr.com, the connection timed out and the mail sits in the queue >> for 5 days before timing out. > > Simon if you're having zombie problems and you're not yet using > postscreen (2.8 or later required), I suggest you give my FQrDNS based > PCRE table zombie/residential blocker a spin. It's super simple to > setup. Instructions are included as comments in the top of the PCRE file: > > http://www.hardwarefreak.com/fqrdns.pcre > > You didn't provide the connection info for the rr.com woodpecker, so I > can't verify if I'm blocking it. The table is currently blocking 7 rDNS > patterns in rr.com, most if not all of it. If it doesn't block your > particular rr.com woodpecker please provide the connection info and I'll > write another expression to kill it, or modify an existing one.
Thanks Stan. I'll check that out. I am using postfix-policyd on 2.7.1 atm. My woodpecker is unfortunately pecking on dovecot - so fail2ban takes care of him every 4 failures.... Oct 17 05:26:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 05:26:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 05:47:00 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 05:47:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 05:47:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 05:48:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 05:48:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 06:09:01 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 06:09:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 06:09:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Oct 17 06:10:58 mail dovecot: imap-login: Disconnected (no auth attempts): rip=74.66.25.222, lip=83.170.64.86, TLS handshaking: Disconnected Thanks to all for the help/perspective. Simon
