Re: botnet dos

2008-10-14 Thread mouss
Randy a écrit : > mouss wrote: >> Ned Slider a écrit : >> >>> Randy wrote: >>> Ken A wrote: > Randy wrote: > > Are you sure it's not spam bounces (joe job)? > This is more common than a spam attack > Ken > > Yeah we get those in spurts

Re: botnet dos

2008-10-14 Thread Benny Pedersen
On Tue, October 14, 2008 21:16, Ned Slider wrote: > least then you could save a bunch of hits against Spamhaus and reject > the mail as early as possible in the smtp process. in main.cf smtpd_client_restriction = reject_unlisted_recipient reject_rbl_client ... -- Benny Pedersen Need more we

Re: botnet dos

2008-10-14 Thread Randy
mouss wrote: Ned Slider a écrit : Randy wrote: Ken A wrote: Randy wrote: Are you sure it's not spam bounces (joe job)? This is more common than a spam attack Ken Yeah we get those in spurts, but this appears to not be the case. We are getting thousands of connects fr

Re: botnet dos

2008-10-14 Thread John Hardin
On Tue, 14 Oct 2008, Randy wrote: John Hardin wrote: On Tue, 14 Oct 2008, Randy wrote: > It appears to be a spambot ( botnet ) , and it really isn't enough > traffic to cause DDOS so I really should change the topic header. The > traffic may be 4 - 10 emails per day for this emai

Re: botnet dos

2008-10-14 Thread Randy
John Hardin wrote: On Tue, 14 Oct 2008, Randy wrote: It appears to be a spambot ( botnet ) , and it really isn't enough traffic to cause DDOS so I really should change the topic header. The traffic may be 4 - 10 emails per day for this email address. To a _single_ invalid address? If

Re: botnet dos

2008-10-14 Thread mouss
Ned Slider a écrit : > Randy wrote: >> Ken A wrote: >>> Randy wrote: >>> >>> Are you sure it's not spam bounces (joe job)? >>> This is more common than a spam attack >>> Ken >>> >> Yeah we get those in spurts, but this appears to not be the case. We >> are getting thousands of connects from non MX

Re: botnet dos

2008-10-14 Thread John Hardin
On Tue, 14 Oct 2008, Randy wrote: It appears to be a spambot ( botnet ) , and it really isn't enough traffic to cause DDOS so I really should change the topic header. The traffic may be 4 - 10 emails per day for this email address. To a _single_ invalid address? If it were me I'd acce

Re: botnet dos

2008-10-14 Thread Ned Slider
Randy wrote: Ken A wrote: Randy wrote: Are you sure it's not spam bounces (joe job)? This is more common than a spam attack Ken Yeah we get those in spurts, but this appears to not be the case. We are getting thousands of connects from non MX hosts and many are blocked at the smtp layer by o

Re: botnet dos

2008-10-14 Thread Randy
Ken A wrote: Randy wrote: Martin Gregorie wrote: Why would a botnet waste resources by sending tens of thousands of spam to a single e-mail address? Is it really a spambot or could it be a DDOS attack? Martin It is both but not actually. :) It appears to be a spambot ( botnet

Re: botnet dos

2008-10-14 Thread Rob McEwen
Randy wrote: > We are being spammed by a botnet to a single email address which makes > it difficult to block. Spamhaus catches about 1/2 of them, but the > rest are blocked via postfix becuase this is an old account and does > not have a mailbox. Are you sure this isn't backscatter where the botn

Re: botnet dos

2008-10-14 Thread Ken A
Randy wrote: Martin Gregorie wrote: Why would a botnet waste resources by sending tens of thousands of spam to a single e-mail address? Is it really a spambot or could it be a DDOS attack? Martin It is both but not actually. :) It appears to be a spambot ( botnet ) , and it rea

Re: botnet dos

2008-10-14 Thread Randy
Martin Gregorie wrote: Why would a botnet waste resources by sending tens of thousands of spam to a single e-mail address? Is it really a spambot or could it be a DDOS attack? Martin It is both but not actually. :) It appears to be a spambot ( botnet ) , and it really isn't enou

Re: botnet dos

2008-10-14 Thread Martin Gregorie
> Why would a botnet waste resources by sending tens of thousands of spam > to a single e-mail address? > Is it really a spambot or could it be a DDOS attack? Martin