>We're getting bombarded with requests to
><mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] This is to the tune
>of hundreds per hour... several thousand per day. You'd think by now they
>would have figured out that we don't even have any lists on our server for
>them to get.
you�d think by now that you would have figured out what abuse looks like :))
> This happened about a month ago and we banned their IP address. Now
> we're getting it again, but this time from a bunch of different servers
> at Excite.com.
I'm currently helping an IMGate user fight an attack that�s been going on
for 3 weeks. Since I got involved last week to put in IMGate, there�s been
about 1 million rejected messages. it continues....
>I created rules so that if the To, From, and Sender fields contain
>imailsrv@ they would be deleted, but it doesn't appear to be working.
>Maybe there's simply a bunch leftover in the spool that haven't finished
>yet. And yes, I stopped and restarted SMTP after applying the rule. Vesion
>7.03.
>
>I think the original sender is caught in a loop. Our IMail returns a
>message to <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] giving the
>usual IMail error message for the listserver. Then we get a response back
>from <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] saying their
>mailbox is full. Since the original sender doesn't get a response, they're
>probably sending their request again and the loop starts all over.
abuse is like that. :)) Here�s just Tue�s stats, from IMGate mail log :
Grand Totals
------------
messages
211390 received
67807 delivered
2 forwarded
1354 deferred (8867 deferrals)
37026 bounced !!!!!!
299537 rejected !!!!!!
410296k bytes received
495837k bytes delivered
19680 senders
2533 sending hosts/domains
49580 recipients
102 recipient hosts/domains
smtpd
169606 connections !!!!!
6743 hosts/domains !!!!!
47 avg. connect time (seconds)
2223:18:23 total connect time
Per-Hour Traffic Summary
time received delivered deferred bounced rejected
--------------------------------------------------------------------
0000-0100 6064 1962 286 649 10885
0100-0200 5923 2108 296 630 9232
0200-0300 6038 1322 383 556 11029
0300-0400 5569 987 195 628 10964
0400-0500 9407 1359 249 504 14953
0500-0600 11544 1690 232 650 16183
0600-0700 13963 2265 151 512 17251
0700-0800 12682 2162 326 489 16305
0800-0900 11058 1564 212 341 15081
0900-1000 10186 2974 285 269 14769
1000-1100 10229 2376 162 413 15177
1100-1200 10288 3696 289 1505 13067
1200-1300 8758 2573 268 2800 12934
1300-1400 7096 3364 374 4766 9059
1400-1500 10272 4490 411 4521 12514
1500-1600 8715 4727 349 1762 10447
1600-1700 9146 5078 598 4029 9815
1700-1800 8598 4050 435 3963 11057
1800-1900 7866 4789 657 4149 9307
1900-2000 6907 2580 455 1148 12998
2000-2100 5928 3180 602 786 10383
2100-2200 6096 2844 469 570 11107
2200-2300 9128 3259 539 458 12242
2300-2400 9929 2408 644 928 12778
Len
http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND 8.2.4 for NT4 & W2K
http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
