Linux Netfilter discussions
 help / color / mirror / Atom feed
From: "Łukasz Hejnak" <sziftgroup@wp.pl>
To: netfilter@lists.netfilter.org
Subject: A crazy spam mailserver
Date: Tue, 07 Jun 2005 16:17:47 +0200	[thread overview]
Message-ID: <42A5AC8B.5010401@wp.pl> (raw)

Hello everyone.
Today at around 12 AM local (10:00 GMT) I started recieving spam from a 
particular host. Nothing strange about it, except the fact
that all of the mail is coming to my home mailserver that I got up just 
a few days ago, and just for home usage/testing/learning.
And the bugger doesn't seem to give up, in the last four hours I got 
around 50 SPAM messages - all the same.
The sender is NAVER-MAILER@naver.com and so far I just took steps to 
block the spam - so the most straight forward thing that came to my mind 
was to do a -DROP. The sender used a few different IP adresses, but most 
of I was able to identify in the form of 1.2.3.0/24, so it all got up to 
a list of five IP's, and so far I went with a script like this

BAD_IP_LIST="1.2.3.0/24 4.5.6.0/24 7.8.9.0/24"
for IP in $BAD_IP_LIST
	{
	iptables -A INPUT -s $IP -DROP
	}

My question is: Is there a better way to act upon such a case?
because I'm not convinced to think that just doing a -DROP like the 
above is the best idea.
For instance I may be blocking some other ip's, that could be innocent.
Or, not sure about this one though, is it possible I could be just 
blocking some spoffed IP's?

With Regards
£ukasz Hejnak

"Greg: It's a little known fact, but e-mail servers were the tenth 
plague that God visited upon the egyptians. All tat angel of death and 
passover stuff is pure crap."


                 reply	other threads:[~2005-06-07 14:17 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=42A5AC8B.5010401@wp.pl \
    --to=sziftgroup@wp.pl \
    --cc=netfilter@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox