Re: [cobalt-developers] undeliverable mails from john@...

["Gary unixservice.com" <scdevlist@xxxxxxxxxxx>]

Jen, et. al.

I usually just listen in, but I do massive amounts of sendmail work for
several ISP's...so here are my 2 cents worth. And have this installed on a
Raq550...

An antispam system that includes this type of
automated relay blocking based on the spammer activity "signature" you
describe can be found here

http://unixservice.com/mysqlSendmail

Involves heavy duty raq modification...but what doesn't?

Gary.

----- Original Message -----
From: "Jens-Peter Otto" <jp.otto@xxxxxxxxxxxxxxx>
To: <cobalt-developers@xxxxxxxxxxxxxxx>
Sent: Thursday, January 16, 2003 6:28 AM
Subject: [cobalt-developers] undeliverable mails from john@...


>
> In the last few days I've got tons of mail for "No such user here". This
is what I find in the log:
>
> Jan 15 03:44:29 www sendmail[8547]: h0F2iSG08547:
<30afL22101E114383f5d@xxxxxxxxxxxxxx>... No such user here
> [30 similar entries]
> Jan 15 03:44:29 www sendmail[8547]: h0F2iSG08547: <wolf@xxxxxxxxxxxxxx>...
No such user here
> Jan 15 03:44:32 www sendmail[8547]: h0F2iSG08547: from=<john@xxxxxxxxxx>,
size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MTA, relay=[62.2.240.67]
> [...]
> Jan 15 05:43:35 www sendmail[15286]: h0F4hZG15286:
<captain@xxxxxxxxxxxxxx>... No such user here
> [30 similar entries]
> Jan 15 05:43:36 www sendmail[15286]: h0F4hZG15286: <phi@xxxxxxxxxxxxxx>...
No such user here
> Jan 15 05:43:39 www sendmail[15286]: h0F4hZG15286:
from=<john@xxxxxxxxxxxxxxxx>, size=0, class=0, nrcpts=0, proto=E
> SMTP, daemon=MTA, relay=host234-33.pool21757.interbusiness.it
[217.57.33.234]
>
> It seems this "john" tries about every 2 hours to reach 30 randomly
selected usernames.
>
> Can I do anything about it? Since he uses different servers and username
each time I can't block those. could sendmail maybe detect this and suppress
the answers?
>
> Jens-Peter
>
> _______________________________________________
> cobalt-developers mailing list
> cobalt-developers@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-developers
>