RE: [cobalt-users] CPU heavily loaded, low on memory, smtp server not responding

["E.B. Dreger" <eddy+public+spam@xxxxxxxxxxxxxxxxx>]

> Date: Wed, 23 Jan 2002 11:01:36 +1100
> From: Michael Mckenna <michael@xxxxxxxxxxxxxxx>

> This is not true.  If you are listed as authoritative for a zone you don't
> have, you will get a different error message.
> The Lame Server message means that your system queried someone else's DNS
> and got a bad response. (Meaning the other system [not yours] may have been
> listed authoritative for a zone it didn't have)

Yes, my my was backwards.

> I don't want to jump to conclusions, but the sudden high load and heaps of
> DNS traffic suggest that your system just sent (or attempted to send) a load
> of spam.
> 
> For each recipient of the spam your system will make a DNS query to find
> their mailserver.
> Knowing a spammers typical mail list, a lot of the addresses are bad which
> results in a ton of "Lame Server" and "Bad Referral" messages.

It would also explain the high loadavg if they were carpetbombing
FormMail.pl -- lots of DNS, lots of Apache instances, lots of
mail.

What does your mail log show?


Eddy

---------------------------------------------------------------------------
Brotsman & Dreger, Inc. - EverQuick Internet Division
Phone: +1 (316) 794-8922 Wichita/(Inter)national
Phone: +1 (785) 865-5885 Lawrence
---------------------------------------------------------------------------

Date: Mon, 21 May 2001 11:23:58 +0000 (GMT)
From: A Trap <blacklist@xxxxxxxxx>
To: blacklist@xxxxxxxxx
Subject: Please ignore this portion of my mail signature.

These last few lines are a trap for address-harvesting spambots.  Do NOT
send mail to <blacklist@xxxxxxxxx>, or you are likely to be blocked.