Re: Spamming virus

[Matti Aarnio <mea@nic.funet.fi>]

On Thu, Aug 07, 2003 at 04:08:09PM +0400, Eugene Crosser wrote:
> Gentlemen,
> 
> did anyone notice a new spamming technology that appeared about a week
> ago, when you suddenly get the same spam message from hundreds different
> machines around the world, apparently infected home PCs on cable, DSL
> and dialup connections?  Any information / known protection?

Same one from hundreds of different systems ?
That is odd..  Denial-of-service type behaviour, I would say.

Having connection quotas (number of connections) limited by network-
classes might help -- from our customers: N, from elsewere: M

There is no code at present to make that happen.  Moving smtp connection
policy initialization and address testing into the accept() server program
could give you this classification capability.  When the classifier then
notes that there are way too many connections from a given class of
network(s) (like outside our own clients), present-like limitter algorithms
can kick the excessive connection(s) away.

> It nearly killed our system before I made a quick and dirty hack to
> block those...
> 
> Eugene

-- 
/Matti Aarnio	<mea@nic.funet.fi>
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to majordomo@nic.funet.fi