Another attack to fight off

[Peter Peters]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

DAve wrote on 28-2-2008 23:03:
> Vlad Mazek wrote:
>> It's escalating too :( which is why I'm trying to do the split queue
>> thing but MailScanner has a big bold FIXME where it parses for
>> incoming directories..
>>
>> On 2/28/08, *Daniel Straka* <dstraka at caspercollege.edu
>> <mailto:dstraka at caspercollege.edu>> wrote:
>>
>>     I'm seeing Vlad's problem too, only 100% (2x) more than last week,
>>     it's unnerving...
> 
> Just out of curiosity I checked one server and grabbed these stats.
> Nothing more scientific than a grep of the mail logs for " from=<> "
> 
> Todays total so far, followed by the last eight days.
> 19,485
> 18,818
> 28,619
> 5,461
> 1,658
> 994
> 1,140
> 1,097
> 810
> 1,546
> 
> yea, I would say it is a problem now.

I checked my logs and I don't really see something different.
3679
4089
4598
4981
4494
4074
3730
5418
3927
2808

I scratched my head for a moment because of that last number but then I
remembered we rolled in two extra servers next to the old 3. The last
couple of weeks the amount of spam has sky rocketed, but where it came
from is uncertain. We have had our incoming queue grow during the day
the last couple of weeks.

There is one little thing I noticed. Normally a spambot only delivers 10
to 15 messages each certain period of time. It seems they are acting
faster lately. Sometime reaching 30 to 40 during the same amount of time.

- --
Peter Peters, Teamleider Unix/Linux-Beheer
ICT-Servicecentrum
Universiteit Twente, Postbus 217, 7500 AE Enschede
Telefoon 053 489 2301, Fax 053 489 2383,
P.G.M.Peters at utwente.nl, http://www.utwente.nl/icts
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHyCENelLo80lrIdIRAiGkAKCWJF2Sa0/q1gMm7cxoUeoX/pU35ACfSw+G
JDmI3QlAhrMrErf6k1z25sA=
=o9GW
-----END PGP SIGNATURE-----