At 10:03 AM -0400 8/13/07, Charles Mangin wrote:
i've got an email client. let's call them FOO.COM (domain replaced
to protect the innocent-ish)
they used to be hosted somewhere else. i don't know what their setup
was, but i suspect there was some sort of "catch-all" address for
the domain. as a result, they now get a fairly constant stream of
badly addressed spams that might have, at one time, been delivered
somewhere. here's just *one minute's worth* culled from my logs:
now, this has been going on for some time. six months or so. when i
first took over, i thought i was getting DOSd based on the spike in
the number of connections on the server. at the time, it was SIMS.
now i've moved them on to exim.
since i took over hosting, all of these dictionary-style spams have
been going nowhere, being rejected out of hand with "<<< 550
Unrouteable address". i know i can't do anything more than ignore
them and hope they will move on to some other target but... sheesh.
six months? with nothing to show for it? you'd think there'd be some
sort of list purging in all that time.
It looks all too familar. Happens here all the time, including on
domains which have never had a catch all address.
Remember that they're typically not using their own firepower -
they've commandeered someone else's machine(s) to do the dirty work,
so they don't care if they're wasting bandwidth trying every name
that's ever existed, for months without end.
I'm sitting behind ASSP (assp.sourceforge.net) which allows me to
specify the allowed recpients so my SIMS doesn't get hit directly,
but it's still annoying to have them constantly knocking at the gate.
--
Bill Christensen
<http://greenbuilder.com/contact/>
Green Building Professionals Directory: <http://directory.greenbuilder.com>
Sustainable Building Calendar: <http://www.greenbuilder.com/calendar/>
Green Real Estate: <http://www.greenbuilder.com/realestate/>
Straw Bale Registry: <http://sbregistry.greenbuilder.com/>
Books/videos/software: <http://bookstore.greenbuilder.com/>
#############################################################
This message is sent to you because you are subscribed to
the mailing list <[email protected]>.
To unsubscribe, E-mail to: <[EMAIL PROTECTED]>
To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]>
To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]>
Send administrative queries to <[EMAIL PROTECTED]>
