Theory of spam prevention and fast-fail aside, I was thinking about adding a mailet to James that would look for DOS attempts, for example...

I keep messages that go to domains we handle, but do not match a local account, for 3 days. Querying mysql to count the number of recipients by remote addr, I see the following:

207.244.55.27           413
207.244.59.59           246
210.245.154.6           196
207.244.59.61           178
207.244.59.54           176
207.244.55.28           176
207.244.59.58           167
207.244.59.55           123
207.244.59.44           108
218.232.130.27          100
207.244.59.43           69
207.244.59.60           69
202.114.154.253         69
218.61.18.25            68
200.179.172.134         50

So basically I have a zombie from a dial-up account in Tennessee. Rather than retroactively running mysql queries to calculate these stats, it seems like I could have a mailet that looked at the C or B class of messages and record who are abusers. Another mailet could look for abusers and either probably dump those emails directly into the bit-bucket.

None of this sounds that hard to do, but I was wondering if anybody else was doing the same, interesting in it, had suggestions on how to do it, or comments on what they would like this to do.

--
Serge Knystautas
Lokitech >> software . strategy . design >> http://www.lokitech.com
p. 301.656.5501
e. [EMAIL PROTECTED]

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Reply via email to