Todd, Can I get a copy of the script you are using? Sounds useful. Drew ---------- Original Message ---------------------------------- From: "Todd Ryan" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Fri, 2 Feb 2001 08:11:45 -0500 Yeah, we're getting it too. Every morning I run a script to parse my imail logs and search for large numbers of invalid addresses. It's not too hard to spot the harvesters. Then I block the IP addresses using the smtp access table. I wish there was an easier way to stop them but they keep coming from different addresses in the same Class B. I can't block an entire Class B. It looks like they send about 18-20 tries per session then go away for a few hours then come back. They're probably hitting a large list of smtp servers a few at a time to as not to be spotted. We're relaying for local users only (we have hundreds of non-local, non-static IP's that we need to relay for). And we're an all NT shop so we can't run IMGate. Anyone have any other solutions? I've been accumulating a their IP's for about 5 days now and so far have blocked 14 different address in this range and a few others outside it. --Todd. ----- Original Message ----- From: +ACI-Mike+ACI- +ADw-mikek+AEA-netdotcom.com+AD4- To: +ACI-Imail Support+ACI- +ADw-IMail+AF8-Forum+AEA- list.ipswitch.com+AD4- Sent: Wednesday, January 31, 2001 12:08 PM Subject: +AFs-IMail Forum+AF0- Massive spamming +AD4- Has anyone noticed massive spam dictionary attacks originating from IP +AD4- blocks that reverse to a domain name of popsite.net? +AD4- +AD4- ARIN says the IPs are assigned to Starnet Inc. in Palatine, IL USA +AD4- +AD4- Mike +AD4- +AD4- +AD4- +AD4- Please visit http://www.ipswitch.com/support/mailing- lists.html +AD4- to be removed from this list. +AD4- +AD4- An Archive of this list is available at: +AD4- http://www.mail-archive.com/imail+AF8-forum+ACU- 40list.ipswitch.com/ +AD4- Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ ___________________________________________________________________ Save Money! get your own domain and emails hosted at Drewspring.com Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
