On Mar 8, 2016, at 9:15 AM, Robert Chalmers <rob...@chalmers.com.au> wrote: > I can put them in a postfix blacklist. And possible write a script to update > the list on a daily basis as more are added.
Are you using postscreen? If not, you should. You’ll see dogs like: Mar 8 09:35:20 mail postfix/postscreen[78466]: CONNECT from [196.207.111.150]:55638 to [65.121.55.42]:25 Mar 8 09:35:21 mail postfix/postscreen[78466]: PREGREET 22 after 0.87 from [196.207.111.150]:55638: HELO 196.207.111.150\r\n Mar 8 09:35:21 mail postfix/postscreen[78466]: DNSBL rank 9 for [196.207.111.150]:55638 Mar 8 09:35:22 mail postfix/postscreen[78466]: NOQUEUE: reject: RCPT from [196.207.111.150]:55638: 450 4.7.1 Service unavailable; client [196.207.111.150] blocked using zen.spamhaus.org; from=<>, to=<*munged*>, proto=SMTP, helo=<196.207.111.150> Mar 8 09:35:23 mail postfix/postscreen[78466]: HANGUP after 1.7 from [196.207.111.150]:55638 in tests after SMTP handshake If you want to blacklist them, you should look at something like sshguard. -- Behind every great man there's a woman with a vibrator -- Hawkeye Pierce
