All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Łukasz Hejnak" <sziftgroup@wp.pl>
To: netfilter@lists.netfilter.org
Subject: A crazy spam mailserver
Date: Tue, 07 Jun 2005 16:17:47 +0200	[thread overview]
Message-ID: <42A5AC8B.5010401@wp.pl> (raw)

Hello everyone.
Today at around 12 AM local (10:00 GMT) I started recieving spam from a 
particular host. Nothing strange about it, except the fact
that all of the mail is coming to my home mailserver that I got up just 
a few days ago, and just for home usage/testing/learning.
And the bugger doesn't seem to give up, in the last four hours I got 
around 50 SPAM messages - all the same.
The sender is NAVER-MAILER@naver.com and so far I just took steps to 
block the spam - so the most straight forward thing that came to my mind 
was to do a -DROP. The sender used a few different IP adresses, but most 
of I was able to identify in the form of 1.2.3.0/24, so it all got up to 
a list of five IP's, and so far I went with a script like this

BAD_IP_LIST="1.2.3.0/24 4.5.6.0/24 7.8.9.0/24"
for IP in $BAD_IP_LIST
	{
	iptables -A INPUT -s $IP -DROP
	}

My question is: Is there a better way to act upon such a case?
because I'm not convinced to think that just doing a -DROP like the 
above is the best idea.
For instance I may be blocking some other ip's, that could be innocent.
Or, not sure about this one though, is it possible I could be just 
blocking some spoffed IP's?

With Regards
£ukasz Hejnak

"Greg: It's a little known fact, but e-mail servers were the tenth 
plague that God visited upon the egyptians. All tat angel of death and 
passover stuff is pure crap."


                 reply	other threads:[~2005-06-07 14:17 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=42A5AC8B.5010401@wp.pl \
    --to=sziftgroup@wp.pl \
    --cc=netfilter@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.