[Greylist-users] machine gun

[Matt Prigge]

Are the connections concurrent or sequential? There may be a way to
introduce some delay into the SMTP conversation that would effectively
slow things down and save you from getting entirely obliterated. Maybe
something as simple as introducing a 15s delay in between the From:
and To: on tripples that have been denied (and not accepted) more than
X times (tunable of course). I don't imagine that would be hard to add
to the code, but, depending upon what you're seeing, it may or may not
help. The spammers are likely using threaded delivery engines, so that
may not help there - the legit ones really shouldn't be trying to
deliver the same message more than once at a time though. :-)

- Matt

On 1/20/06, Barb Dijker <barb at netrack.net> wrote:
> We are starting to see more machine gun spammers.  For example,
> yesterday youngexplorerscatalog.net attempted to send a message to a
> single recipient once per second until greylisting allowed the message.
>
> I'm thinking about a hook to set a threshold for promoting a mail
> server to automatic temporary BL.  I've been doing this manually when
> we get hammered.  But it is happening too often anymore.  Has anyone
> done this already?  Suggestions?
>
> A quick peruse of the database shows a small handful of legitimate
> mail that appears to be using the machine gun approach, e.g.,  mail
> (really) from ebay that was blocked 80 or 90 times before being
> passed once.  Blackberry.com does it pretty regularly.  An att.net
> outgoing server hit almost once a second.  This sort of thing is
> killer to the server with just the connection overhead.  Our delay is
> only 4 minutes.  So if a triple has been blocked more than 48 times,
> it is trying more frequently than once ever 5 seconds.  That seems
> excessive.
>
> Barb Dijker x100
> Netrack, 3080 Valmont Rd Ste 200, Boulder CO 80301
> +1.303.938.0188, toll free +1.888.9Netrack, fax +1.303.938.0177
> www.netrack.net
>
>
>
> _______________________________________________
> Greylist-users mailing list
> Greylist-users at lists.puremagic.com
> http://lists.puremagic.com/cgi-bin/mailman/listinfo/greylist-users
>