[Greylist-users] machine gun

[Barb Dijker]

We are starting to see more machine gun spammers.  For example,  
yesterday youngexplorerscatalog.net attempted to send a message to a  
single recipient once per second until greylisting allowed the message.

I'm thinking about a hook to set a threshold for promoting a mail  
server to automatic temporary BL.  I've been doing this manually when  
we get hammered.  But it is happening too often anymore.  Has anyone  
done this already?  Suggestions?

A quick peruse of the database shows a small handful of legitimate  
mail that appears to be using the machine gun approach, e.g.,  mail  
(really) from ebay that was blocked 80 or 90 times before being  
passed once.  Blackberry.com does it pretty regularly.  An att.net  
outgoing server hit almost once a second.  This sort of thing is  
killer to the server with just the connection overhead.  Our delay is  
only 4 minutes.  So if a triple has been blocked more than 48 times,  
it is trying more frequently than once ever 5 seconds.  That seems  
excessive.

Barb Dijker x100
Netrack, 3080 Valmont Rd Ste 200, Boulder CO 80301
+1.303.938.0188, toll free +1.888.9Netrack, fax +1.303.938.0177
www.netrack.net