The effect of spammers [was Re: [NMLUG] posts delayed]

[kevin at rosenberg.net (Kevin Rosenberg)]

Kevin Rosenberg wrote:
> $ grep -c "User unknown" mail.log.0
> 224415

I decided to attack the problem of the rumplestiltskin attacks
differently. Initially, I stated looks at the logs and blocking the IP
addresses of the attackers. After adding a few hundreds entries
manually, it seems like the rate of attacks didn't change. So, I wrote
a script to automate the process.

Currently, I'm blocking 2600 IP addresses that have submitted multiple
unknown RCPT. Despite that, I'm still getting 3-4 unknown RCPT's per
second. New IP addresses pop up as soon as I disable some IP
addresses. Wow, that's a lot of zombied/spam systems.

I've set my automated script to run every 5 minutes. Perhaps over
time, the either the attacks will slow down because I've blocked
enough IP addresses or my routing will slow down with tens (hundreds?)
of thousands of blocked IP addresses in my route table.

-- 
Kevin Rosenberg
kevin@rosenberg.net