[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: backscatter joe-job attack
From: |
Bob Proulx |
Subject: |
Re: backscatter joe-job attack |
Date: |
Mon, 4 Jan 2021 14:13:33 -0700 |
Bob Proulx wrote:
> FYI: I routed a nonexisting address to /dev/nullon on debbugs tonight
> to mitigate a backscatter joe-job style attack to it. Some dozens of
> outlook.com exit nodes are connecting and dumping what looks like
> backscatter to an 11 digit number address. WAT? I have no idea. But
grep'ing the logs I see this has sent 12053 of them silently to
/dev/null so far since yesterday. Exim logs flummox me but I think
there have been 55108 messages to that address in total in the last
two days. The listhelper anti-spam auto-discarded the first many
thousands before I routed it to /dev/null upstream.
Mostly things have stopped but I am still seeing a very few to that
address this afternoon. Probably mostly done but some still draining
from mail queues. Might see a few more drag in over the next couple
of days as machines process their deferred queues.
Bob