Comments on: Under attack

By: ryanc

ryanc — Wed, 03 Jun 2009 19:49:37 +0000

This is a perfect example of why a greytrap (like OpenBSD’s spamd) is good to sit in front of your actual MTA.

By: RubenV

RubenV — Wed, 03 Jun 2009 11:42:11 +0000

Oh, thanks for pointing out bkor! Turns out, I still had soft_bounce enabled from when I was testing my new spam setup a few weeks ago.

Yanko: That makes sense. The internet is such a pile of dirt :-)

By: Yanko

Yanko — Wed, 03 Jun 2009 07:54:51 +0000

These are most likely bounces for spam some botnet is sending with random@yourdomain return addresses. Thus the hosts you are banning are likely legitimate, but relatively unprotected mail servers.
“Attack” is probably not an accurate description. Its just a regular fare for botnets with huge lists of domains to crap over. Usually at random.

By: bkor

bkor — Wed, 03 Jun 2009 05:52:01 +0000

At least properly reject them… stuff like:

unknown_local_recipient_reject_code = 550
unknown_address_reject_code = 550
unknown_client_reject_code = 550