[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: backscatter joe-job attack

From: Bob Proulx
Subject: Re: backscatter joe-job attack
Date: Mon, 4 Jan 2021 14:13:33 -0700

Bob Proulx wrote:
> FYI: I routed a nonexisting address to /dev/nullon on debbugs tonight
> to mitigate a backscatter joe-job style attack to it.  Some dozens of
> exit nodes are connecting and dumping what looks like
> backscatter to an 11 digit number address.  WAT?  I have no idea.  But

grep'ing the logs I see this has sent 12053 of them silently to
/dev/null so far since yesterday.  Exim logs flummox me but I think
there have been 55108 messages to that address in total in the last
two days.  The listhelper anti-spam auto-discarded the first many
thousands before I routed it to /dev/null upstream.

Mostly things have stopped but I am still seeing a very few to that
address this afternoon.  Probably mostly done but some still draining
from mail queues.  Might see a few more drag in over the next couple
of days as machines process their deferred queues.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]