From: Len Conrad (no email)
Date: Sun Oct 02 2005 - 08:30:57 EDT
>The smtp processes should eventually time out.
mx1# postconf | egrep "smtp_.*timeout"
smtp_connect_timeout = 60s
smtp_data_done_timeout = 60s
smtp_data_init_timeout = 60s
smtp_data_xfer_timeout = 60s
smtp_helo_timeout = 60s
smtp_mail_timeout = 60s
smtp_quit_timeout = 60s
smtp_rcpt_timeout = 60s
smtp_rset_timeout = 20s
...
... not if there were some kind of SMTP activity
>But what do they do to keep the session from timing out?
Somebody said some infra-SMTP TCP trick, but that would have been not
seen by postfix as smtp activity, so postfix would have smtp timed.
I wanted to fix the SMTP problem quickly, not research bit and
bytes. Perhaps smtp sessions were timing out and quickly
re-connecting, since after a postfix start, the number smtp
connections to them rose and stabilized quickly, rather than a gradual ramp up.
It's easy enough for anybody interested in the tarpitting details to
point their postfix smtp at those IPs.
For those Class Cs, the only host addresses I saw were in the range
.1 - .7, nothing higher.
imgate# telnet 204.9.246.1
Trying 204.9.246.1...
^C
imgate# telnet 204.9.246.2
Trying 204.9.246.2...
^C
imgate# telnet 204.9.246.3
Trying 204.9.246.3...
^C
imgate# telnet 204.9.246.4
Trying 204.9.246.4...
^C
imgate# telnet 204.9.246.5
Trying 204.9.246.5...
telnet: connect to address 204.9.246.5: Connection refused
telnet: Unable to connect to remote host
imgate# telnet 204.9.246.6
Trying 204.9.246.6...
telnet: connect to address 204.9.246.6: Connection refused
telnet: Unable to connect to remote host
imgate# telnet 204.9.246.7
Trying 204.9.246.7...
telnet: connect to address 204.9.246.7: Connection refused
telnet: Unable to connect to remote host
However, perhaps their tarpitting daemon waited for specific SAV
"RCTP TO: " before tarpitting.
Here are the totals/day of smtp timeouts to those Class Cs:
mx1# zegrep -ic "... .. ........ ... postfix/smtp\[.*204.9.24.*timed"
/var/log/maillog.[0-9].gz
/var/log/maillog.0.gz:45848
/var/log/maillog.1.gz:128552
/var/log/maillog.2.gz:40818
/var/log/maillog.3.gz:55149
/var/log/maillog.4.gz:0
/var/log/maillog.5.gz:9488
/var/log/maillog.6.gz:3405
/var/log/maillog.7.gz:3242
/var/log/maillog.8.gz:1357
/var/log/maillog.9.gz:0
... perhaps there was not tricky tarpitting tricks going, but simply
their port 25 that were extremely slow combined with the sheer
volume of spam from them, causing our SAV to have 200+ smtp sessions
tied up continuously.
Our MX runs postgrey, so here are the qty of reject: per domain.tld
for the sender@*.domain.tld that were greylisted from those ClassC's
in the last 10 days:
mx1# zegrep -i "... .. ........ ... postfix/smtpd\[.*reject:
.*204.9.24.\." /var/log/maillog.[0-9].gz |\
awk '{print $(NF-3)}' |\
cut -d @ -f 2 | tr -d ">" |\
cut -d "." -f 2,3 |\
sort -fn |\
uniq -ic |\
less
6 aboutgoodstuff.com
9 aboutgoodstuff.net
9 absinthiated.com
16 absinthiated.net
14 absolutelygoodnews.com
17 absolutelygoodnews.net
8 absolutelygoods.com
18 absolutelygoods.net
11 absolutelyinformation.net
7 absolutelyname.com
12 absolutelynation.com
4 absolutelynation.net
12 absolutelynews.com
10 absolutelynews.net
8 absolutelyobservation.com
3 absolutelyproducts.net
7 absolutelysavings.com
13 acetol.net
5 acraspeda.com
12 acraspeda.net
335 agistment.net
6 allglobalnews.com
18 amazinggoodnews.com
8 amazinggoodnews.net
14 amazinginformation.net
12 amazingobservation.com
9 amazingopinion.net
30 amazingorder.com
11 amazingornament.net
13 amazingowner.net
15 ancestorial.com
4 ancestorial.net
4 anchylosing.com
14 anchylosing.net
11 approvedfreestuff.com
11 approvedgoodnews.com
9 approvedgoodnews.net
23 approvedgoods.com
9 approvedgoods.net
9 approvedinformation.com
10 approvedinformation.net
9 approvednews.com
10 approvedproducts.net
12 approvedwaiting.net
7 approvedwhite.net
10 arundiferous.com
5 arundiferous.net
20 attractivefreestuff.com
14 attractivegoodnews.com
11 attractivegoodnews.net
11 attractivegoods.com
9 attractivegoods.net
8 attractiveinformation.com
4 attractiveinformation.net
9 attractiveinternet.com
10 attractivemilk.com
7 attractivenews.com
14 attractiveproducts.net
14 aurazone.com
14 authenticfreestuff.com
7 authenticgoodnews.com
6 authenticgoodnews.net
16 authenticinformation.net
15 authenticproducts.net
19 authenticsavings.com
7 autogenous.com
11 autogenous.net
7 awaynews.com
9 awaynews.net
11 bargainfreestuff.com
8 bargaingoodnews.com
8 bargaingoodnews.net
8 bargaininformation.com
14 bargaininformation.net
18 beautifulfreestuff.com
9 beautifulgoodnews.com
7 beautifulgoodnews.net
8 beautifulgoods.net
5 beautifulproducts.net
11 bettera.net
15 betterfruit.com
9 bettergive.net
12 bettergold.net
24 bettergoodnews.com
10 bettergoodnews.net
13 bettergovernment.net
5 betterinformation.net
9 bettertake.net
18 betterword.net
5 betteryear.net
7 bigdogsavings.com
12 bigdogsavings.net
4 bigfoodsavings.com
13 bigfreestuff.com
10 biggong.com
9 biggong.net
5 biggoodnews.com
9 biggoodnews.net
25 biggoods.net
3 bighomesavings.net
13 bigoar.com
10 bigoar.net
7 bigoracle.com
9 bigoracle.net
18 bigorganic.com
3 bigorganic.net
9 bigproducts.net
14 bigsavingsbank.com
7 bigsavingsguy.com
6 bigsavingsguy.net
14 bigtopsavings.com
11 bigtopsavings.net
19 bluezapp.com
7 brownmaster.com
10 buhlwork.com
12 buhlwork.net
13 bunglingly.com
11 bunglingly.net
8 burkism.com
20 calcule.net
11 canthisbetrue.com
12 chirosophist.com
10 ciliform.com
15 circumfluous.com
14 circumfluous.net
7 colorfulfreestuff.com
18 colorfulgoodnews.com
7 colorfulgoodnews.net
8 colorfulgoods.net
12 colorfulinformation.com
18 colorfulinformation.net
7 colorfulsavings.com
8 colossalgoodnews.com
5 colossalgoodnews.net
6 colossalgoods.com
12 colossalgoods.net
15 colossalinformation.com
6 colossalinformation.net
6 colossalproducts.com
10 colossalproducts.net
10 colubrine.com
9 colubrine.net
2 com
10 combating.net
16 completefold.com
5 completefront.net
5 completegoodnews.com
9 completegoodnews.net
14 completegoods.net
10 completehumor.net
7 completeinformation.net
16 completeproducts.net
15 confidentialfreestuff.com
8 confidentialgoodnews.com
4 confidentialgoodnews.net
3 confidentialgoods.net
10 confidentialinternet.com
7 confidentialnews.com
9 confidentialproducts.net
10 confidentialsavings.com
7 coolletter.com
3 coolletter.net
8 crammedgoodnews.com
13 crammedgoodnews.net
5 crammedgoods.com
7 crammedgoods.net
8 crammedinformation.com
12 crammedinformation.net
15 crammedproducts.com
6 crammedproducts.net
14 cyclostoma.com
7 cyclostoma.net
16 decession.net
16 deliveredfreestuff.biz
17 deliveredfreestuff.com
4 deliveredfreestuff.info
7 deliveredfreestuff.la
12 deliveredfreestuff.name
16 deliveredfreestuff.net
11 deliveredfreestuff.org
11 deliveredfreestuff.tv
6 deliveredfreestuff.us
21 deliveredgoodnews.com
11 deliveredgoodnews.net
5 deliveredgoods.net
12 deliveredinformation.net
17 deliveredinternet.com
12 deliverednews.com
7 deliveredproducts.net
16 deliveredsavings.com
7 detainment.net
9 diastaticsearch.net
15 diodont.com
15 diodont.net
10 directfear.com
10 directfiction.net
10 directflame.com
12 directfriend.com
27 directgoodnews.com
9 directgoodnews.net
6 directgoods.net
20 directhumor.net
6 directinformation.net
5 discountblow.net
7 discountgoodnews.com
10 discountgoodnews.net
11 discountinformation.net
4 discountlead.net
16 dissemblance.net
21 dissociable.net
12 divellicate.com
10 divellicate.net
8 dobbersearch.net
7 domainsecurefirst.com
6 donaldjackson.net
20 donaldthomas.net
13 donaldwilson.net
15 dueful.com
9 duskiness.com
14 duskiness.net
13 e-goodstuff.com
10 e-goodstuff.net
9 easilyfreestuff.com
12 easilygoodnews.com
5 easilygoodnews.net
7 easilygoods.com
24 easilygoods.net
10 easilyinformation.com
15 easilylip.net
12 easilymap.com
7 easilynews.com
10 easilyproducts.com
12 easilysavings.com
14 eastcoastdns.net
4 edwarddavis.net
16 edwardmoore.net
7 enactment.net
8 endorsedfreestuff.com
14 endorsedgoodnews.com
16 endorsedgoodnews.net
20 endorsedgoods.com
6 endorsedgoods.net
13 endorsedinformation.com
9 endorsedinformation.net
25 endorsedproducts.com
15 endorsedproducts.net
85 enervating.com
19 enormousfreestuff.com
6 enormousinternet.com
11 enormousnews.com
9 epiploon.com
9 epiploon.net
5 epispastic.com
3 epispastic.net
6 epispasticsearch.com
148 euctical.com
21 euhemerism.com
15 euhemerism.net
8 excitingfreestuff.com
6 exclusiveact.com
11 exclusiveadvertisement.com
16 exclusiveback.net
12 exclusivebite.net
14 exclusivefreestuff.com
11 exclusivewest.com
7 exorcisedsearch.com
10 expertfreestuff.com
10 expertrespect.net
8 expertside.net
9 expertsize.net
14 experttime.com
10 fairletter.com
34 fairletter.net
16 fallowed.net
5 famousfoot.net
10 famousisland.net
7 famousjewel.net
113 feoffment.com
8 firstnetsecure.com
17 firstpointsecure.com
10 firstsecuredcapital.com
15 firstsecurelink.com
7 flattraffic.com
13 flukeworm.net
11 forgetfulness.net
13 fugh.net
8 fusibility.com
6 fusibility.net
12 fusile.com
28 fusile.net
14 gallomania.net
12 georgerobinson.net
7 georgewhite.net
15 giganticapple.net
10 giganticbottle.net
10 giganticboy.net
16 giganticnews.com
11 girdsearch.net
16 goodgiftsforyou.com
13 goodstuffcentral.com
6 goodstuffcentral.net
7 goodstuffonline.net
18 goodtimeoffers.com
10 haplomi.com
8 haplomi.net
9 heedful.net
6 heedfulsearch.com
17 heedfulsearch.net
14 homesraffle.com
10 housecarl.net
6 hugebut.com
11 hugeside.net
328 hylaeosaur.net
13 illimitation.com
13 illimitation.net
7 improvedfreestuff.com
14 improvedinternet.com
386 incitant.net
20 incyour.com
12 incyour.net
15 indilatory.com
14 indilatory.net
8 instructivenews.com
10 inswept.com
13 inswept.net
10 integratednethosting.com
7 inwalling.com
7 inwalling.net
11 isoprene.net
366 jeffersonite.com
15 jobyour.com
8 jobyour.net
17 josephwilson.net
9 justmaster.com
9 kavasses.net
11 kennethtaylor.net
4 largestnews.com
6 leftsearch.net
20 lessnews.com
10 lessnews.net
9 lightletter.com
9 lightletter.net
10 locisearch.net
16 lowestnews.com
11 loxodromics.net
11 macrosporic.com
6 macrosporic.net
5 madreporian.com
9 madreporian.net
15 mahometanized.com
10 mahometanized.net
13 mammothfreestuff.com
13 maninternet.com
11 maninternet.net
10 marazone.com
21 masterbbs.com
11 masterface.com
10 masterthai.com
6 melanic.net
13 mineroof.com
13 minestart.com
10 minisaver.com
67 minisaver.net
17 minisavers.com
8 minisavers.net
13 miracleinternet.com
18 mistthunder.com
11 mobilegood.com
15 mobilegood.net
6 monoroom.com
10 monoroom.net
9 monthbrown.com
9 monthwho.net
9 motionattraction.net
12 multisavers.com
10 multisavers.net
9 mumnews.com
11 mumnews.net
9 nameweek.net
11 narazone.com
9 neoroad.com
12 neoroad.net
2 net
9 newsany.com
5 newsany.net
8 newsierra.com
12 newsierra.net
7 newsolo.com
11 newsolo.net
12 newsred.com
7 newsred.net
14 newssecond.net
9 newssign.net
9 nitromagnesite.com
4 nitromagnesite.net
5 nodated.com
15 nodated.net
7 noiseglass.net
6 objectively.net
19 omnisaver.com
10 omnisaver.net
8 opinionamount.net
5 orgulous.net
11 ornamentfalse.net
17 otaries.net
6 ourzaps.com
14 outstandinginternet.com
104 oxacid.com
346 oystering.net
14 painstomach.net
7 paintyellow.net
20 palkane.com
452 palkids.com
475 palkids.net
8 palkiss.com
21 palkiss.net
307 panym.com
14 parfocal.net
14 paulpalka.net
7 pereirazone.com
14 plantshoe.com
12 poisonable.com
19 poisonable.net
16 positionfemale.net
7 positionside.net
14 powderhair.net
15 powerfulinternet.com
7 powerfulnews.com
18 pressinternet.com
9 pressinternet.net
9 pressuris.com
8 pressuris.net
10 pressurisation.com
19 pressurisation.net
17 pressurise.com
12 pressurise.net
11 pressurised.com
18 profitparcel.com
12 profuselygoods.com
10 profuselygoods.net
15 profuselyproducts.net
9 proraffle.com
4 proron.com
7 proron.net
8 provengoodnews.com
19 provengoods.net
16 proveninformation.com
21 proveninformation.net
8 proveninternet.com
10 pugging.net
7 pullheat.com
15 punishmentroom.net
9 purlsearch.net
10 qualitygoodnews.net
8 quavering.com
16 quavering.net
15 quicklygoodnews.com
7 quicklygoodnews.net
5 quicklygoods.com
16 quicklygoods.net
2 quicklyinformation.com
10 quicklyinformation.net
7 quicklynews.com
5 quicklyproducts.com
13 quicklyproducts.net
11 raregoodnews.com
3 raregoodnews.net
6 raregoods.net
14 rareinformation.net
10 rareproducts.net
11 reciprocalness.net
21 recreance.net
4 reducedgoodnews.com
14 reducedgoodnews.net
11 reducedgoods.net
17 reducedproducts.net
11 refundablegoodnews.com
10 refundablegoodnews.net
6 refundableproducts.com
11 refundableproducts.net
13 remarkablegoodnews.net
12 remarkablenews.com
9 repercussive.com
7 repercussive.net
8 repinesearch.net
12 responsal.com
12 responsal.net
9 revealment.com
16 revealment.net
5 revolutionaryinternet.com
5 rightletter.com
13 rightletter.net
10 rimose.com
11 rimose.net
9 roadinternet.com
14 roadinternet.net
15 ronaldallen.net
10 ronaldclark.net
12 ronaldmoore.net
4 ronaldtaylor.net
13 ronaldthomas.net
13 ronaldwilliams.net
17 roughdraw.com
3 roughdraw.net
4 rubricate.net
10 rumply.net
9 saltfoot.com
7 saltfoot.net
8 sarazone.com
9 saveinternet.com
6 saveinternet.net
7 scarpsearch.net
11 schilerization.com
13 schilerization.net
5 schilerizationsearch.net
14 secretsinternet.com
5 secretsnews.com
5 securecross.com
13 securegirl.com
5 securemovie.com
11 securenetexchange.com
24 securerock.com
14 securewill.com
20 semeiography.com
11 semeiography.net
9 semeiographysearch.com
18 sensationalinternet.com
13 sesquialteral.com
7 sesquialteral.net
10 shiftiness.net
6 shopyour.com
10 shopyour.net
18 shrewish.net
3 sizablenews.com
5 slickersearch.com
8 slickersearch.net
9 soloron.com
6 soloron.net
11 somite.net
8 specialism.net
3 startlinginternet.com
7 startlingnews.com
14 stomatic.com
4 stomatic.net
13 strangeinternet.com
10 stronginternet.com
9 sturdyinternet.com
11 sturdynews.com
15 subereous.com
10 subereous.net
10 successfulinternet.com
13 successfulnews.com
8 supersavingsnews.com
7 supra-acromial.com
13 supra-acromial.net
12 suprasternal.com
12 suprasternal.net
14 surffreedom.net
15 surpriseinternet.com
6 sylvanium.com
5 sylvanium.net
8 synonyma.com
16 synonyma.net
14 tabellionsearch.net
13 taptime.com
12 tartrelic.com
22 tartrelic.net
10 teemful.net
13 termsearch.net
6 thinletter.com
4 thinletter.net
17 thomasharris.net
15 timearea.com
11 tinnersearch.net
8 todnews.com
8 todnews.net
142 tracheobranchia.com
8 trafficmess.com
67 trafficopen.com
3 transshaped.net
7 tremendousinternet.com
9 tremendousnews.com
10 turanian.com
11 turanian.net
6 undulatesearch.com
16 unpursed.com
12 unpursed.net
12 urontechnology.com
13 usefulgoods.net
5 usetime.com
15 usurious.net
15 valuablegoods.com
16 valuablegoods.net
14 valuableinformation.net
10 valuableinternet.com
10 verygoodoffer.com
4 vettime.com
14 wannews.com
5 wannews.net
15 wealthgoodnews.com
10 wealthgoods.com
11 wealthgoods.net
17 wealthinternet.com
12 wealthproducts.net
14 weirdgoodnews.com
6 weirdgoodnews.net
11 weirdgoods.net
19 weirdinformation.com
13 weirdinformation.net
12 weirdinternet.com
11 weirdproducts.net
9 westcoastdns.net
11 wholesalefiber.net
6 williamrobinson.net
6 williamwilliams.net
10 wirbling.com
5 wirbling.net
7 wirblingsearch.com
6 wonderfulgoodnews.com
7 wonderfulgoodnews.net
9 wonderfulgoods.net
3 wonderfulinformation.com
18 wonderfulinformation.net
8 woodinternet.com
19 woodinternet.net
9 wordsman.net
8 yourfort.com
16 yourfort.net
23 yournow.com
11 yournow.net
11 yourzap.com
3 zapatour.com
10 zapgourmet.com
11 zaptour.com
9 znapinc.com
7 zowltd.com
Len
_____________________________________________________________________
http://IMGate.MEIway.com : free anti-spam gateway, runs on 1000's of sites
|
|
|